AEPD (Spain) - PS/00479/2019

AEPD - PS/00479/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 12 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	05.08.2020
Fine:	3000 EUR
Parties:	Spanish entrepreneur City Council of Vigo
National Case Number/Name:	PS/00479/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	Miguel Garrido de Vega

5 August 2020 - The Spanish Data Protection Agency (AEPD) decided to impose a fine up to 3,000 € on a Spanish entrepreneur, owner of a bar, for the non-adequate installation of a video surveillance system pointing to the public road and the lack of any kind of information poster related, with the consequent infringement of the data minimisation principle related, as per Article 5(1)(c) GDPR, and the lack of transparent information, as per Article 12 GDPR.

English Summary

Facts

The decision is the consequence of a complaint submitted by the City Council of Vigo stating that the defendant has installed a video surveillance system pointing to the public road, without any kind of information poster; such complaint included pictures by the local police proving that the video surveillance system was installed.

Dispute

The defendant did not answer to any AEPD investigation requests, so the AEPD started the corresponding sanction procedure. During its investigations, the AEPD discovered that (i) there is no information poster at the premises nor information clauses on such processing activity, that (ii) there is a total of two cameras in the premises of the defendant, located outdoors and pointing to the public road from which they obtain images from the pedestrians.

Holding

Thus, the AEPD understood that the video surveillance system has infringed the data minimisation principle and did not offer transparent information, so after considering some circumstances [(i) the surveillance system is recording to the public road without cause and without information poster, (ii) there is intentionality, (iii) the defendant is a small business and has not been fined in the past for similar facts], it decided to impose a fine of 3,000 € to the defendant. The AEPD also requires the defendant to install the corresponding information poster and information forms inside the business.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

 Procedure No.: PS / 00479/2019938-051119RESOLUTION OF SANCTIONING PROCEDUREOf the procedure instructed by the Spanish Agency for Data Protection andbased on the followingACTSFIRST: VIGO CITY COUNCIL (* hereinafter, the claimant) dated 7October 2019 filed a claim with the Spanish Agency for the Protection ofData. The claim is directed against AAA with NIF *** NIF.1 (hereinafter, thereclaimed). The grounds on which the claim is based are “installation of variouscameras ”without the mandatory information poster, oriented in adisproportionate to public roads.In the Report dated 07/19/19 Local Police (Vigo) the following is stated, forpart of the members of the local police transferred to the scene:“At the same time inside the premises there are two cameras, one above the door ofentrance focusing towards the back of the premises and another at the back of the premises facing towardsthe front door ”."That both inside and outside the information poster does not presenthomologated video-surveillance zone (…) qualifying that the interior of the premises isalso devoid of any type of poster ”.Along with the claim, provide documentary evidence (Doc. 3) Part of service thatmanifests it by denouncing it by the acting authority.SECOND: In view of the facts denounced in the claim and the documentsprovided by the claimant, the General Subdirectorate for Inspection of Dataagreed to carry out preliminary investigation actions to clarifyof the facts in question, by virtue of the investigative powers granted to thecontrol authorities in article 57.1 of Regulation (EU) 2016/679 (RegulationGeneral Data Protection, hereinafter RGPD), and in accordance with the provisionscited in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5December, Protection of Personal Data and guarantee of digital rights (inhereinafter LOPDGDD).As a result of the investigative actions carried out, it is verifiedthat the person responsible for the treatment is the one claimed.THIRD: On 10/30/19, the Complaint presented is TRANSFERRED, withoutthat any allegation has been made in this regard regarding the legality of the systemdenounced.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/6FOURTH: On 01/15/20, the Initiation Agreement associated with the procedure is issued.penalty PS / 00479/2019, for the alleged infringement of the content of art.5.1 c) RGPD, being notified in a timely manner at the address provided by theLocal Police of the town (headquarters of the establishment).In view of everything that has been done, by the Spanish Protection Agencyof Data in this procedure, the following are considered proven facts,PROVEN FACTSFirst . On 10/07/19, this body received a Complaint transferred by theVigo City Council, as a result of an inspection carried out by the Local Police in a statehotel establishment of the town."Installation of various cameras" without having the mandatory posterinformative, disproportionately oriented towards public roads.Second . Mr. AAA is identified as the main responsibleThird . The absence of an informative poster in the visible infor-that it is a video-monitored area, as well as the main person responsible for theI lie.Fourth . It is accredited according to attached documentary evidence (Complaint 07/19/19) thatWith the local cameras, images are obtained from the outside of the same, affectingdisproportionate to public space.“… Like a screen above the entrance door where you can see the outside of thepremises, understood as exterior, the entrance of the same premises and the entire sidewalk, in additionof the vehicles that are parked in front of it "Fifth . It is proven that the establishment does not have available form (s)position of customers who may require it.FOUNDATIONS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authoritycontrol, and according to what is established in articles 47 and 48 of the LOPDGDD, therector of the Spanish Agency for Data Protection is competent to initiate andto solve this procedure.IIIn the present case, the claim dated 07/10/19 is examined by me-gave from which the following is transferred as fact:"Installation of various cameras" without having the mandatory information poster(folio nº 1).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/6Individuals can install video surveillance cameras although they areresponsible that they comply with current legislation.With this type of device it is not possible to exercise control of the spaceadjacent to the establishment, and should preferably be orientedtowards the access doors of the premises for security reasons.The art. 5.1 c) RGPD provides the following: Personal data will be:"Adequate, relevant and limited to what is necessary in relation to the purposesfor which they are processed ("data minimization").For more information, the report submitted shows the absence of a posterinformative inside / outside the premises indicating that it is a video-viewing areagilada and indicating the person responsible for the treatment of the data obtained, if applicable.Article 12 RGPD provides the following: “The person responsible for the treatment will take theappropriate measures to provide the interested party with all the information indicated in the articles13 and 14, as well as any communication in accordance with articles 15 to 22 and 34regarding the treatment, in a concise, transparent, intelligible and easily accessible way, withclear and simple language, in particular any information directed specifically atyou a child. The information will be provided in writing or by other means, including, ifproceeds, by electronic means. When requested by the interested party, the informationIt shall be provided verbally provided that the identity of the interested party is proven byother media".It should be remembered that individuals are responsible for ensuring that systemsmost installed comply with current legislation.The installation of this type of device must have the mandatory posterinformative, indicating the purposes and responsible for the treatment, where appropriate, of the dataof a personal nature.Article 22 LOPDGG (LO 3/2018, December 5) provides the following:“The duty of information provided for in article 12 of the Regulation (EU)2016/679 will be understood as fulfilled by placing an information devicein a sufficiently visible place identifying, at least, the existence of the treatment,the identity of the person in charge and the possibility of exercising the rights provided in theArticles 15 to 22 of Regulation (EU) 2016/679.A connection code or address may also be included in the information device.from the internet to this information. In any case, the person responsible for the treatment mustkeep the information referred to in the aforementioned report at the disposal of those affectedregulation ”.The establishment must also have an information form (s) availablesition of customers who may require it, in order to exercise their rights in theframework of the regulations in force.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/6IIIIn accordance with the evidence available at the present time,ment of the sanctioning procedure, it is considered that the defendant has twoexterior cameras obtaining images of public space without just cause, thewhich lack an informational poster.Article 77 section 5 of Law 39/2015 (October 1) provides: “The documentsformalized by officials who are recognized as authoritativeand in which, observing the corresponding legal requirements, thefacts verified by the former will make proof of these unless it is provenotherwise ".The acting force confirms the “irregularity” of the system, as well as the obtainedimages of a large public space, without just cause, allowing thecontrol of passers-by and residents of the town.The known facts are constitutive of an infraction, attributable to the claimmado , for violation of art. 5.1 c) RGPD.The known facts are constitutive of an infraction, attributable to the claimmado , for violation of article 12 RGPD.The art. 83.5 GDPR provides the following: "Violations of the provisionsfollowing will be sanctioned, in accordance with section 2, with administrative finesof a maximum of EUR 20,000,000 or, in the case of a company, of an equal amountequivalent to a maximum of 4% of the total global annual turnover for the financial yearprevious financial statement, opting for the highest amount:a) the basic principles for the treatment, including the conditions for theconsent in accordance with articles 5, 6, 7 and 9;In the present case, when motivating the sanction, the following is taken into account:next:-the nature of the infringement, as it is affecting the right of third parties thathave been intimidated by the installed device, obtaining images of public spacewithout just cause (art. 83.2 a) RGPD).-The intentionality or negligence of the conduct, lacking the mandatory characterinformative tel, indicating the person in charge and the purposes of the treatment (art. 83.2 b)RGPD).So, based on the foregoing, taking into account the lack of infractionsprevious statements for the same or similar events, as well as that it is aindividual who runs a small hotel establishment that has not carried outIn this regard, an economic sanction is ordered on the lowest scale of thistype of sanctions, calculating the same in the amount of € 3,000 (Three Thousand Euros).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/6All this without prejudice to documentary evidence of compliance with therequired measures, that is, the placement of an approved sign indicating theresponsible for the treatment and the provision of information form (s) insideof the establishment. You can obtain an indicative model on the website of this organization.ganismo www.aepd.es in the “Video-surveillance” Section.All information must be arranged in an orderly manner and available tothe authority that, for reasons of inspection of the establishment, may require it,making sure that the installed system complies with current legislation.Therefore, in accordance with the applicable legislation and assessed the criteria ofgraduation of sanctions whose existence has been proven,the Director of the Spanish Agency for Data Protection RESOLVES :FIRST: IMPOSE Mr. AAA , with NIF *** NIF.1 , for a violation of the article5.1 c) RGPD, having installed a video surveillance camera system that obtainsimages of public space, a financial penalty of € 3,000 (Three Thousand Euros),fraction typified in article 83.5 a) RGPD, being punishable in accordance witharticle 58.2 RGPD.SECOND: NOTIFY this resolution to Mr. AAA and REPORT the resulttado of the present actions to the complainant entity CITY COUNCIL OFVIGO.THIRD: Warn the sanctioned person that the sanction imposed by aOnce this resolution is enforceable, in accordance with the provisions of theart. 98.1.b) of Law 39/2015, of October 1, on the Administrative Procedure Co-of the Public Administrations (hereinafter LPACAP), within the vo-luntario established in art. 68 of the General Collection Regulations, approvedby Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,of December 17, by means of their entry, indicating the NIF of the sanctioned person and the numberprocedure that appears in the heading of this document, in the accountrestricted number ES00 0000 0000 0000 0000 0000 , opened in the name of the Spanish AgencyData Protection Policy at Banco CAIXABANK, SA Otherwise,it will be collected in the executive period.Once the notification has been received and once it is executed, if the date of execution isBetween the 1st and 15th of each month, both inclusive, the deadline to carry out theVoluntary payment will be until the 20th of the following or immediately subsequent business month, and ifis between the 16th and last days of each month, both inclusive, the term of thepayment will be up to the 5th of the second following or immediate business month.In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once it has been notified to the interested parties.Against this resolution, which puts an end to the administrative procedure in accordance with art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPA-CAP, the interested parties may optionally file an appeal for reconsideration beforethe Director of the Spanish Data Protection Agency within one month toC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/6count from the day after notification of this resolution or directly appealcontentious administrative procedure before the Contentious-Administrative Chamber of theNational authority, in accordance with the provisions of article 25 and section 5 of theFourth additional provision of Law 29/1998, of July 13, regulating the JurisdictionContentious-administrative diction, within a period of two months from the day if-following notification of this act, as provided in article 46.1 of the aforementionedLaw.Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPA-CAP, the final administrative resolution may be suspended provisionally if theinterested party expresses his intention to file contentious-administrative appeal.If this is the case, the interested party must formally communicate this fact throughwriting addressed to the Spanish Agency for Data Protection, presenting it throughof the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web /], or through any of the other records provided for in art. 16.4 of the ci-Tada Law 39/2015, of October 1. You must also forward to the Agency the documentationtion that proves the effective filing of the contentious-administrative appeal. Yesthe Agency was not aware of the filing of the contentious-administrative appealnistrative within two months from the day following the notification of theThis resolution would terminate the precautionary suspension.
Mar España Martí
Director of the Spanish Agency for Data Protection