AEPD (Spain) - PS/00191/2020

AEPD - PS/00191/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	22.02.2021
Published:	09.02.2021
Fine:	1600 EUR
Parties:	n/a
National Case Number/Name:	PS/00191/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Paola L.

The Spanish DPA (AEPD) imposed a fine of €2,000 against Ripobruna 207, S.L. (defendant) for the alleged violation of Article 5(1)(c) GDPR for the unauthorised use of two video surveillance cameras that also recorded parts of the public road without any justified cause. The original fine of €2,000 was reduced for voluntary payment to €1,600.

English Summary

Facts

A City Council office filed a complaint with the AEPD against Ripobruna 2007, S.L. for the use of cameras video surveillance oriented towards the public road without a justified cause. The AEPD requested the Local Police to verify that the establishment denounced was in operation and confirm the presence of the cameras in question.

The Local Police verified the operation of the establishment and confirmed that two cameras video surveillance were facing the public road without any justified cause.

Dispute

Is it an offence to have cameras facing the public road? Does it constitute a breach of Article 5(1)(c) GDPR?

Holding

The AEPD held, that the actions of the defendant constitute an infringement of Article 5(1)(c) GDPR " Data Minimisation principle". The AEPD further noted that:

- Those responsible must ensure that the installed systems comply with current legislation, proving that it complies with all the requirements of the regulations in force.

- The installation of this type of device must have the mandatory information notice, indicating the purposes and the responsible for the processing, where appropriate, of the personal data.

- With reference to its Resolution R/00818/2012, the capture of images of public spaces by private surveillance cameras must be limited to what is strictly necessary, applying in any case the principle of proportionality.

- Security cameras installed in private spaces will not be able to capture images of public spaces, the security function of public spaces corresponds exclusively to the State Security Forces and Bodies.

The AEPD imposed an initial fine of €2,000 which was reduced for voluntary payment to €1,600 in accordance with Article 85 (2) LPACAP).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                             1/7










     Procedure Nº: PS / 00191/2020


RESOLUTION R / 00056/2021 OF TERMINATION OF THE PROCEDURE FOR PAYMENT
                                   VOLUNTARY

In the sanctioning procedure PS / 00191/2020, instructed by the Spanish Agency for

Data Protection to RIPOBRUNA 2007, S.L., Considering the claim presented by
*** LOCALITY CITY COUNCIL. 1, and based on the following,


                                 BACKGROUND


FIRST: On September 2, 2020, the Director of the Spanish Agency
of Data Protection agreed to initiate a sanctioning procedure against RIPOBRUNA
2007, S.L .. The initiation agreement has been notified and after analyzing the allegations presented,
On January 11, 2021, the resolution proposal was issued that
The following is transcribed:


<<


Procedure number: PS / 00191/2020


Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following:

                                     ACTS


FIRST: CITY COUNCIL OF *** LOCALITY. 1 (* hereinafter, the claimant) with
On June 11, 2020, he filed a claim with the Spanish Agency for
Data Protection. The claim is directed against RIPOBRUNA 2007, S.L.

(RESTAURANT *** RESTAURANT.1) with NIF B64595242 (hereinafter, the
reclaimed). The reasons on which the claim is based are installation of cameras
video surveillance towards public space without just cause


       “It has been verified by the agents that the surveillance cameras are
oriented towards the public thoroughfare, a fact that has also been verified in previous
occasions and dates after the AEPD Resolution reference E / 00984/2018

(* is attached) ”- folio nº 1--.

       Along with the claim, it provides a photographic report made at the time of
inspection and before the person in charge, stating in the same the orientation of two

cameras towards public space (photos 1, 4 and 5).

SECOND: On 06/25/20, the claim is TRANSFERRED to the
entity denounce so that it manifests in law what it deems appropriate, without

any allegation has been made for this purpose.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/7








THIRD: On September 2, 2020, the Director of the Spanish Agency
of Data Protection agreed to initiate a sanctioning procedure to the claimed, with

in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in the

Article 83.5 of the RGPD.

FOURTH: The aforementioned initiation agreement has been notified, the claimed party has not made
any allegation in time and form to this body.


FIFTH: Consulted the database of this AEPD on 01/10/21 there is no record
any allegation in this regard, nor has the legality of the system been clarified.

SIXTH: On the date, collaboration is requested from the Local Police (*** LOCALIDAD.1) to

to verify that the reported establishment is in operation and confirm the
presence of the cameras in question.

SEVENTH: On 12/29 / w20 a report from the Local Police is received

(*** LOCALIDAD.1) reporting the following:

       "That transferred to the scene, today 12/29/20, the Agents
of this Local Police (*** LOCALIDAD.1) have verified that the activity of

Maverick restoration continues in operation, open to the public and carried out
functions of its hospitality activity "

       “That it has also been verified that the cameras installed object of this

procedure, they are in the same position, focusing on the public highway without
just cause ”.

EIGHTH: A list of documents in the document is attached as an annex.

process.

Of the actions carried out in this procedure and of the documentation
Obrante in the file, the following have been accredited:


                                PROVEN FACTS

       First. A claim is received at this Agency on 06/11/20 by means of
from which the presence of video surveillance cameras oriented towards this

public space without just cause.

       Along with the claim, it provides a photographic report made at the time of
inspection and before the person in charge, stating in the same the orientation of two

cameras towards public space (photos 1, 4 and 5).

       Second. The entity Restauran-
te *** RESTAURANTE. 1 (Ripobruna 2007 S.L).


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/7








        Third. It has been proven that, once the act of force was transferred to the scene of the events,
While the aforementioned establishment is “operational”, the cameras remain in the position

sition reported (Report 12/29/20) -Local Police *** LOCALITY. 1.

        Bedroom. According to attached report dated 12/29/20 of the Local Police *** LOCALI-

DAD.1 the following is verified:

        “That it has also been verified that the cameras installed object of this
procedure, they are in the same position, focusing on the public highway without

just cause ”.

        Fifth. Consulted the database of this Agency 01/10/21 has not been carried out-
any allegation in relation to the facts described.











                             FOUNDATIONS OF LAW

                                              I


        By virtue of the powers that article 58.2 of the RGPD recognizes to each authority
control, and according to what is established in articles 47 and 48 of the LOPDGDD, the
rector of the Spanish Data Protection Agency is competent to initiate and

to solve this procedure.

                                              II

In the present case, the claim dated 06/11/20 is analyzed through

from which the installation of a video surveillance system that obtains images
genes from public space without just cause.


The art. 5.1 c) RGPD provides the following: Personal data will be:

        “Adequate, relevant and limited to what is necessary in relation to the purposes
for which they are processed ("data minimization").


It should be remembered that individuals are responsible for ensuring that the systems installed
felled comply with current legislation, proving that it complies with all
the requirements demanded by the regulations in force.


The installation of this type of device must have the mandatory information poster
tive, indicating the purposes and responsible for the treatment, where appropriate, of the ca-
personal character.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/7








In any case, the cameras should be oriented preferably towards the space
particular, avoiding intimidating neighboring neighbors with this type of device, thus

how to control areas of transit of the same without just cause.

Also with this type of device it is not possible to obtain images of public space.
co, as this exclusive competence of the Security Forces and Corps of the State

tado.

It should be remembered that even in the case of a "simulated" camera the same
should preferably be oriented towards private space, since it is considered

that this type of device can affect the privacy of third parties, who are seen to be
measured by it in the belief of being the object of permanent recording.

        On the part of private individuals, it is not possible to install devices for obtaining

images of public space, outside the cases allowed in the regulations.

                                             III

        In accordance with the evidence available at present,

ment of the sanctioning procedure, it is considered that the defendant has a
video surveillance system oriented towards public space without just cause, affecting
Going to the right of third parties to process your data without your informed consent.


        Article 77 section 5 of Law 39/2015 (October 1) provides the following:

        “The documents formalized by the officials who are recognized as
condition of authority and in which, observing the corresponding legal requirements

teeth are collected the facts verified by the former, they will prove these except
that the opposite is accredited ”.

        Security cameras installed in private spaces will not be able to obtain

images of public spaces, the security function of public spaces
it corresponds exclusively to the State Security Forces and Bodies.

For its part, the Spanish Agency for Data Protection in its Resolution

R / 00818/2012 of May 18 indicates:

        “The treatment of images in public places can only be carried out, sal-
vo that government authorization concurs, by the Security Forces and Bodies ".


        Therefore, the capture of images of public spaces by the cameras of
private surveillance, must be limited to what is strictly necessary, applying in any case
the principle of proportionality.


        The known facts are constitutive of an infraction, attributable to the claim.
mado, for violation of the content of art. 5.1 c) GDPR, previously transcribed.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/7








        The installation of two video surveillance cameras oriented towards
public space, without any explanation of them having been made, is-

having proven its clear orientation towards third party space, producing
a deviation from the purpose of controlling them.

        Article 83.5 RGPD provides the following:


        "Violations of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,
for a company, an amount equivalent to a maximum of 4% of the volume

total annual global business menu for the previous financial year, opting for the
higher amount:

        a) the basic principles for the treatment, including the conditions for the treatment

consent in accordance with articles 5, 6, 7 and 9;

        When motivating the sanction, the following is taken into account:

        -the nature of the offense by having a video surveillance system that

it is oriented towards public space without just cause 8art. 83.5 a) GDPR).

        -the way in which this body has had knowledge of the facts, being
transferred by the State Security Forces and Bodies (eg Local Police),

having been repeatedly warned by the acting force about the illegality of the
conduct (art. 83. 5 h) RGPD).

        Therefore, it is considered correct to propose a sanction in the amount of

€ 2,000 (Two Thousand euros), a penalty located on the lower scale for this type of conduct.
tas, all without prejudice to proceeding with the regularization of the denounced system.

 In view of the above, the following is issued


                            MOTION FOR A RESOLUTION

That the Director of the Spanish Data Protection Agency sanction RI-
POBRUNA 2007, S.L., With NIF B64595242, for a violation of Article 5.1.c) of the
RGPD, typified in Article 83.5 of the RGPD, a fine of € 2,000 (Two Thousand Euros).


Likewise, in accordance with the provisions of article 85.2 of the LPACAP,
informs that it may, at any time prior to the resolution of this
transfer, carry out the voluntary payment of the proposed sanction, which will mean
a reduction of 20% of the amount thereof. With the application of this reduction

tion, the sanction would be set at € 1,600 and its payment will imply the termination of the
process. The effectiveness of this reduction will be conditioned to the withdrawal or
waiver of any action or appeal in administrative proceedings against the sanction.

In the event that you choose to proceed to the voluntary payment of the amount specified above,

Subsequently, in accordance with the provisions of the aforementioned article 85.2, it must be carried out
tiva by entering the restricted account number ES00 0000 0000 0000 0000 0000
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/7








opened in the name of the Spanish Agency for Data Protection in the banking entity-
ria CAIXABANK, S.A., indicating in the concept the reference number of the procedure

statement that appears in the heading of this document and the cause, by voluntary payment
luntario, of reduction of the amount of the sanction. Likewise, you must send the receipt
of entry to the Subdirectorate General of Inspection to proceed to close the expe-
tooth.


By virtue of this, you are notified of the foregoing, and the procedure is revealed
so that within TEN DAYS you can claim whatever you consider in your defense and
present the documents and information it deems pertinent, in accordance with
Article 89.2 of the LPACAP).


                                                                                  926-300320
A.A.A.

INSPECTOR / INSTRUCTOR

 >>


SECOND: On February 5, 2021, RIPOBRUNA 2007, S.L. has proceeded to
payment of the penalty in the amount of 1,600 euros making use of the planned reduction
in the proposed resolution transcribed above.

THIRD: The payment made entails the waiver of any action or recourse in progress.

administrative against the sanction, in relation to the facts to which the
motion for a resolution.


                            FOUNDATIONS OF LAW


                                             I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in art. 47 of Organic Law 3/2018, of 5 of

December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said
Regulation; infractions of article 48 of Law 9/2014, of May 9, General
of Telecommunications (hereinafter LGT), in accordance with the provisions of the

article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and
38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.


                                            II

Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/7








      "1. Initiated a sanctioning procedure, if the offender acknowledges his
      responsibility, the procedure may be resolved with the imposition of the

      appropriate sanction.
      2. When the sanction is solely of a pecuniary nature or it fits
      impose a pecuniary and a non-pecuniary sanction but it has been
      justified the inadmissibility of the second, the voluntary payment for the alleged
      responsible, at any time prior to the resolution, will imply the

      termination of the procedure, except in relation to the reinstatement of the situation
      altered or to the determination of compensation for damages
      caused by the commission of the offense.
      3. In both cases, when the sanction is solely of a pecuniary nature, the
      competent body to resolve the procedure will apply reductions of, at

      less, 20% of the amount of the proposed penalty, these being
      cumulative with each other. The aforementioned reductions must be determined in
      the notification of initiation of the procedure and its effectiveness will be
      conditioned to the withdrawal or resignation of any action or remedy in
      administrative against the sanction.

      The percentage of reduction foreseen in this section may be increased
      regulations. "


In accordance with the above, the Director of the Spanish Agency for the Protection of

Data
RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00191/2020, of
in accordance with the provisions of article 85 of the LPACAP.


SECOND: NOTIFY this resolution to RIPOBRUNA 2007, S.L ..

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the

National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.



                                                                                968-150719
Mar Spain Martí
Director of the Spanish Agency for Data Protection





C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es