AEPD (Spain) - PS/00332/2019

AEPD (Spain) - PS/00332/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 83 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	27.06.2020
Fine:	None
Parties:	Anonymous
National Case Number/Name:	PS/00332/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The AEPD issued a reprimand against property owner who had installed and operated video surveillance system and recorded disproportionate number of images of public spaces violating the principle of data minimisation as foreseen in Article 5(1)(c) GDPR.

English Summary

Facts and questions arising

The complaint regarded the allegedly unlawful installation of video surveillance system that recorded public spaces without a justified cause, thus interfering with the right to privacy of people passing by. Among others, the defendant claimed that only he had access to the recordings and he deleted them daily.

Holding

The AEPD noted that there was a violation of the principle of data minimisation according to Article 5(1)(c) GDPR. The video surveillance system here was found to be not compliant with the applicable legislation, since it recorded disproportionate number of images of public spaces at least from 2012 to 2019 that it was operating.

Following Article 83(5)(a)GDPR, read in the lights of Recital (148) GDPR, the AEPD issued a reprimand to the owner of the video surveillance system. It indicated that the cameras should point to the owner's property, even if they are not real, and there should be a sign about the compliance of the system with the applicable legislation. If in doubt, the interested parties may consult the Guardia Civil or the AEPD.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Spanish original for more details.

From the procedure instructed by the Spanish Data Protection Agency and based on the following

FACTS

FIRST: Mr. A.A.A. (hereinafter, the claimant) on 24 May 2019 filed a complaint with the Spanish Data Protection Agency.   The claim is directed against B.B.B. with NIF ****NIF.1 (hereinafter, the claimant).

The reasons on which the complaint is based are "installation of cameras that record the public thoroughfare" without justified cause, thus affecting the right to privacy of third parties who are affected by them. Together with the complaint, it provides documentary evidence (Doc. No. 1) that proves the presence of a device on the premises owned by the defendant.

SECOND: In view of the facts denounced in the complaint and the documents provided by the claimant, the Subdirectorate General of Data Inspection proceeded to carry out preliminary investigative actions to clarify the facts in question, by virtue of the investigative powers granted to the control authorities in article 57.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to as the GDPR), and in accordance with the provisions of Title VII, Chapter I, Section 2 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter referred to as the LOPDGDD), as a result of the investigative actions carried out, it has been established that the data controller is the one who is being challenged.

THIRD: On 01/07/18 the complaint was transferred to the defendant, and a reply was received on 12/08/19 and 28/08/19. From all the allegations, the following can be inferred:
-He acknowledges that he is responsible for the installation of the video surveillance system, which is due to the security of the installations.
-He admits that he is responsible for the installation of the video surveillance system, which is for security reasons.
-It does not provide an impression of what in your case is captured with the camera(s) installed on your property.
-It does not provide a location plan of the place where the camera(s) is installed and the main access points to your private property.
-Does not provide a technical report that certifies that the system is not operational, nor has it provided any documentation after the last allegations to this body.

FOURTH: On January 13, 2020, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the defendant, for the alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD.

FIFTH: On February 3, 2010, a letter of allegation was received from the defendant, in which he stated the following: "I provide copy No. 4: Complaint against A.A.A. dated January 28, 2019 for attempted aggression and death threats, this occurred in front of my warehouse (where the camera is installed)."I only had access to the recordings, I watched them and deleted them daily, and only two recordings have come out of that camera which were presented before consultation (to the Subdelegate of the Government of Cuenca) in the Court and First Instance of ***LOCALIDAD.1 as proof of the complaints I have against A.A.A." I would like you to understand that it was never my intention to do anything wrong, nor to bother anyone, quite the contrary (...)". 

PROVEN FACTS

First. On 24/05/19, this agency received a complaint by means of which the following was transferred as the main event: "installation of cameras that record the public highway" without justified cause, thus affecting the right to privacy of third parties who are affected by the same.

Second. It is proven that the defendant has modified the informative poster after the requirement of this Agency, although it refers to a legal regulation.

Third.  It is proven that the camera was removed from the façade where it was installed, providing documentary evidence of this, stating that it was "inoperative" since August 2019.

Fourth. It provides a technical report, which accredits the disassembly of the window camera where it was installed (Evidentiary Doc. No. 3).

Fifth.   Between the denouncing and denounced parties, there is a bad relation, accredited with the denounces contributed by the denounced.

Sixth. According to the evidence examined, it is proven that the chamber allowed a wide area to be recorded, beyond the perimeter of the industrial premises. 

LEGAL GROUNDS

By virtue of the powers that Article 58.2 of the RGPD recognises to each supervisory authority, and as established in Articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to resolve this procedure.

In the present case, the complaint dated 24/05/19, by means of which the following "installation of cameras recording the public highway" is transferred as the main event without justified cause, is examined. The "facts" described above affect the content of Article 5(1)(c) of the RGPD, since they have video surveillance cameras that obtain images of the street, affecting the rights of passers-by who walk freely in the area". Personal data shall be: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization")". The processing of images in public places can only be carried out in case and after the fulfillment of the legally required requirements, by the Security Forces and Bodies, unless the exception established in article 4.3 of the Instruction 1/2006, of November 8, of this Agency, which establishes, operates: "Cameras and video cameras installed in private spaces may not obtain images from public spaces unless it is essential for the purpose of surveillance that is intended, or it is impossible to avoid it due to the location of the same. In any case, any processing of data that is unnecessary for the purpose in question must be avoided". In no case shall the use of surveillance practices be allowed beyond the environment that is the object of the installation and, in particular, they may not affect the surrounding public spaces, adjacent buildings or vehicles other than those that access the space under surveillance.On 03/02/20, this Agency received a letter from the accused, stating "that the camera has been inoperative since August 2019", justifying the presence of the same as a result of a vandalic attack on his property. On this last aspect, it should be remembered that there is new legislation on data protection, the current legislation in force being Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights. Article 22.4 of the LOPDGDD provides as follows: "The duty of information provided for in Article 12 of Regulation (EU) 2016/679 shall be understood to have been fulfilled by placing an information device in a sufficiently visible location identifying, at least, the existence of the processing, the identity of the controller and the possibility of exercising the rights provided for in Articles 15 to 22 of Regulation (EU) 2016/679. A connection code or Internet address to this information may also be included in the information system. In accordance with the evidence available in the present sanctioning procedure, it is considered that the defendant had a system of video surveillance cameras, without this body having been able to analyse what was captured with it, although an excessive recording can be seen from a frame provided by the defendant.The evidence analysed shows that the organisation had a camera system that did not comply with current legislation, even though the images had been handed over to accredit alleged criminal acts by a neighbour. For a long time the cameras have been in operation, obtaining disproportionate images of public space, at least from 2012 until August 2019.The known facts constitute an infringement, attributable to the defendant, for violation of Article 5.1 c) RGPD. With this device, images of the public sidewalk adjacent to its establishment are obtained in a disproportionate manner, with less harmful means for the rights of pedestrians and having been able to redirect the exterior camera exclusively to their private property.Article 83(5) of the RGPD states that 'infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of not more than EUR 20 000 000 or, in the case of an undertaking, of not more than 4 % of its total annual turnover in the preceding business year, whichever is the greater':

(a) the basic principles for the processing, including the conditions for consent under Articles 5, 6, 7 and 9; the installed camera captured disproportionately public space, requires that there are means less damaging to the rights of third parties to install the camera Without prejudice to the provisions of Article 83 of the RGPD, the aforementioned Regulation provides in its Article 58.2 

(b) the possibility of a warning, in relation to that set out in recital 148: 'In the case of a minor infringement, or if the fine likely to be imposed would constitute a disproportionate burden on a natural person, a warning may be imposed instead of a penalty in the form of a fine. However, particular attention should be paid to the nature, gravity and duration of the infringement, its intentionality, the measures taken to mitigate the damage suffered, the degree of liability or any previous relevant infringement, the manner in which the supervisory authority became aware of the infringement, the enforcement of measures ordered against the person responsible or entrusted, the adherence to codes of conduct and any other aggravating or mitigating circumstances."In order for this body to specify the situation that is the object of the complaint, it makes the following recommendations: the cameras should be directed in all cases to the main access points of the property, whether they are real or not, and should have a sign that complies with the regulations in force, or if they do not have any camera(s), they can have a simulated sign.Therefore, this organization does not prevent you from having the cameras, as long as they comply with current legislation, that is, facing the perimeter of your industrial building. If you have any doubts, you can consult the nearest Guardia Civil headquarters or this organization about the correct installation of the cameras.In the case that they capture criminal acts, they must be transferred to the Court of Instruction closest to the place of the facts or be made available to the Security Forces, remembering that recordings made with a mobile phone are admissible.The rest of the questions must be analysed, if necessary, by the corresponding Courts, as they exceed the framework of competence of this body, which is competent to analyse the images provided as evidence. Therefore, in accordance with the applicable legislation and having assessed the criteria for the downgrading of the penalties whose existence has been accredited, the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE on B.B.B., with NIF ***NIF.1, for an infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a penalty of APPROVAL.

SECOND: TO NOTIFY this resolution to Mr. B.B.B. 

In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties..6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the interested parties may, optionally, file an appeal for reversal before the Director of the Spanish Data Protection Agency within a period of one month from the day following notification of this resolution or directly file an administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law.