AEPD (Spain) - PS/00461/2019

AEPD - PS/00461/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 83(2)(a) GDPR Article 83(2)(b) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	3000 EUR
Parties:	State Security Forces and Corps
National Case Number/Name:	PS/00461/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD Spain (in ES)
Initial Contributor:	JST

The Spanish DPA (AEPD) imposed a €3000 fine on the defendant for the installation of a video surveillance camera oriented towards public space, affecting the rights of third parties.

English Summary

Facts

The Spanish DPA received a complaint about the installation of a video surveillance camera on the private property of a local residence, oriented towards public space and a neighbouring school area, disrupting citizen coexistence without just cause. The complaint was filed by the State Security Forces and Corps (Fuerzas y Cuerpos de Seguridad del Estado) in November 2019.

In addition, the system does not have an informational poster indicating the responsible person for data processing, contravening Article 5(1)(c) GDPR. The defendant was identified as a local resident who failed to comply with the recommendations made by the State Security Forces and Corps.

Dispute

Does the installation of a surveillance camera in private property, oriented towards public spaces, violate Article 5 (1)(c) GDPR?

Holding

The Spanish DPA found the defendant has a video surveillance camera oriented towards public spaces, affecting the right to privacy and treating personal data without consent of third parties, in violation of Article 5(1)(c) GDPR.

The DPA found the installation of the surveillance camera to lack an informational poster and to be oriented towards a nearby public school, causing distress to the local neighbours. This justified imposing a fine pursuant to Article 83(2)(a). The defendant also ignored the recommendations of the State Security Forces and Corps, proving his intentionality. This justified imposing a fine pursuant to Article 83(2)(b).

The DPA clarified surveillance cameras should be oriented preferably towards private space to avoid intimidation of local neighbours and to control public transit areas without just cause. Also, the obtaining of image(s) from public spaces is an exclusive competence of the State Security Forces and Corps.

Therefore, in light of the violations, the Spanish DPA imposed a €3000 fine on the defendant and stated he has to comply with Article 5(1)(c) and Article 83(2)(a)(b) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following

ACTS

FIRST: LOCAL POLICE OF *** LOCALITY. 1 (* hereinafter, the claimant) with
On November 11, 2019, he filed a claim with the Spanish Agency for
Data Protection. The claim is directed against Don A.A.A. with NIF *** NIF.1 (in
forward, the claimed).

The grounds on which the claim is based are "installation of a video surveillance camera oriented towards public space without just cause" affecting the right
of third parties (folio nº 1).

Along with the claim, it provides documentary evidence (Document No. 1) that
certifies the presence of the chamber in question.

SECOND: In view of the facts reported in the claim and the documents provided by the claimant, the General Sub-Directorate of Data Inspection proceeded to carry out preliminary investigation actions to clarify of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of Regulation (EU) 2016/679 (Regulation General Data Protection, hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5 of December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD). 

As a result of the investigative actions carried out, it is verified that the person responsible for the treatment is the one claimed.

THIRD: On January 9, 2020, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure to the claimed, by the
alleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the
RGPD.

FORTH. There is in the computer system of this Agency the double attempt to
notification at the address provided by the Security Forces and Bodies of the
Status listed as "Absent in distribution", as well as the publication of the Agreement of Start in the BOE (02/10/20).

FIFTH. Consulted the database of this organization on 08/02/20 there is no evidence any allegation in relation to the facts that are the object of the complaint.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
1/5

Of the actions carried out in this procedure and of the documentation Obrante in the file, the following have been accredited:

PROVEN FACTS
First. On 11/11/19, this agency received a claim from the Forces and State Security Bodies, transferring as main fact: "Installation of a video surveillance camera oriented towards public space without Justified cause ”affecting the rights of third parties (folio nº 1).

Second. The local resident Don is identified as the main responsible A.A.A., which has a video surveillance device oriented towards public space altering citizen coexistence.

Third. The following address is provided by force acting as address *** ADDRESS.1

Forth. A photograph (Doc. No. 1) is attached as the main proof that proves the installation of a video surveillance camera with a clear orientation towards public space and a nearby schools area.

Fifth. The system is devoid of an informational poster indicating the person responsible for the treatment of the data to which you can contact.

Sixth. According to the manifestation of the acting force, the citizen in question has been widely warned, "ignoring" the recommendations.

FOUNDATIONS OF LAW

I
By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Agency for Data Protection is competent to initiate and
to solve this procedure.

II
In the present case, we proceed to examine the claim dated 11/11/19 by means of which "the presence of a camera oriented towards public space" is transferred as a fact without just cause by a private individual, ignoring Local Police warnings (*** LOCALIDAD.1).

The art. 5.1 c) RGPD provides the following: Personal data will be:

"Adequate, relevant and limited to what is necessary in relation to the purposes
for those who are processed ("data minimization").

It should be remembered that individuals are responsible for ensuring that the installed systems comply with current legislation, proving that it complies with
all the requirements demanded by the regulations in force.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
2/5

The installation of this type of device must have the mandatory poster informative, indicating the purposes and responsible for the treatment, where appropriate, of the data of a personal nature.

In any case, the cameras should preferably be oriented towards the particular space, avoiding intimidating neighboring neighbors with this type of device,
as well as controlling areas of transit of the same without just cause.

Neither with this type of device can image (s) of public space be obtained, as this is the exclusive competence of the Security Forces and Bodies. of the State.

It should be remembered that even in the case of a "simulated" camera the
It should preferably be oriented towards private space, since it is considers that this type of device can affect the privacy of third parties, which they are intimidated by it into the belief of being the subject of permanent recording.

III
In accordance with the evidence available in this sanctioning procedure, it is considered that the defendant has a video surveillance camera that affects the privacy of third parties, treating their personal data without consent.

The known facts are constitutive of an infringement, attributable to the defendant, for violation of the content of art. 5.1 c) RGPD.

Article 77 section 5 of Law 39/2015 (October 1) provides the following:

“The documents formalized by the officials who are recognized
condition of authority and in which, observing the corresponding legal requirements, the facts verified by those are collected, they will prove them except that the opposite is accredited ”.

According to the acting force, the camera “is oriented towards public roads”, specifically towards the public primary school located in front of their home (folio no one).

Consequently, the set of indications points to the operation of the camera, being oriented towards the nearby school area, lacking an information poster,
the observations of the local Police and to "ignore" the recommendations of the State Security Forces and Bodies.

The art. 83.5 RGPD provides the following: "Violations of the provisions
following will be sanctioned, in accordance with section 2, with administrative 

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
3/5

fines of a maximum of EUR 20,000,000 or, in the case of a company, of an amount equivalent to a maximum of 4% of the total global annual turnover of the previous financial year, choosing the higher amount:

a) the basic principles for the treatment, including the conditions for the
consent in accordance with articles 5, 6, 7 and 9;

When motivating the sanction, the following is taken into account:

-That the device in question is oriented towards public space without cause
justified, causing a situation of discomfort in the residents of the town (art.
83.2 a) RGPD).
-That the same facts have already been the subject of a complaint, so we can speak of intentionality in the persistence of the conduct (art. 83.2 b) RGPD).

The above facts advise imposing a sanction in the amount of € 3,000 (Three Thousand Euros) given the recurrence of the events and the seriousness of the behavior described; as well as the obligation to reorient the camera towards the interior of your home.

The accused is advised that a new Complaint for the facts described, may lead to the opening of a new sanctioning procedure, for failing to comply with the
requirements of this body, specifically the legalization of the system, oriented towards its private space.

Therefore, in accordance with the applicable legislation and the criteria of
graduation of sanctions whose existence has been proven, 

the Director of the Spanish Agency for Data Protection RESOLVES:

FIRST: TO IMPOSE Mr. A.A.A., with NIF *** NIF.1, for a violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 3,000 (Three thousand euros).

SECOND: ORDER the accused to reorient the camera installed in your home, avoiding the impact of public space and / or third parties, in the terms of art. 58.2 d) RGPD.

THIRD: NOTIFY this resolution to Mr. A.A.A. and INFORM the result of the actions to the complaining party LOCAL POLICE OF *** LOCALITY. 1

FOURTH: Warn the sanctioned person that he must make the sanction imposed a
Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of their entry, indicating the NIF of the sanctioned 

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
4/5

person and the number procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency Spanish Data Protection in the bank CAIXABANK, S.A .. In case otherwise, it will be collected in the executive period.

Once the notification has been received and once it is executed, if the date of execution is finds between the 1st and 15th of each month, both inclusive, the deadline to carry out the voluntary payment will be until the 20th of the following or immediately subsequent business month, and if is between the 16th and last days of each month, both inclusive, the term of the Payment will be made until the 5th of the second following or immediate business month.

In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the interested parties may optionally file an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of month from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, the firm resolution may be suspended in an administrative way
if the interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this
made by writing to the Spanish Agency for Data Protection, Presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too must forward to the Agency the documentation proving the effective filing of the contentious-administrative appeal. If the Agency is not aware of the filing of the contentious-administrative appeal within a period of two months from the day after the notification of this resolution, I would terminate the precautionary suspension.

Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
5/5