AEPD (Spain) - PS/00023/2020

AEPD - PS/00023/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 58(2)(b) GDPR Article 83(5) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	13.10.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	PS/00023/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Francesc Julve Falcó

The Spanish DPA (AEPD) argued that the installation of security cameras must always be done in accordance with Article 5(1)(c) GDPR, concerning the minimisation of data processed.

English Summary

Facts

The Spanish DPA analyzed the possible unlawfulness of the installation of a video surveillance system composed of 3 cameras located outside a house in SANTA CRUZ DE TENERIFE, a system that could capture images of neighbouring areas of houses in a disproportionate manner, as well as an automatic door phone for private use outside the building, all without the corresponding authorization of the Neighbours' Community.

The authorization of the Homeowners' Association has not been accredited for the installation of the above-mentioned devices, having to comply with the requirements established by Law 49/1960 of 21 July on horizontal property (LPH). This law regulates that the installation of a video surveillance system by a private individual will require the authorization of the Community of Owners' Meeting both when it is planned to be located in a common area and when, even if located in a private use area, it is oriented towards surrounding common areas and captures - respecting, in any case, the principle of data minimization - tangentially these common areas.

Dispute

Is the installation of security cameras that capture images of the neighborhood and the street a violation of Article 5 (1) (c) GDPR?

Holding

The Spanish DPA has found that the facts of the present proceedings show that 2 of the 3 cameras installed by the claimant capture a disproportionate share of communal areas, neighbouring housing, and even public roads.

This situation is not covered by the exclusion set out in Article 22.5 of LOPDGDD as the capture of images that exceed the verification about the identity of people trying to access an address beyond the treatment "carried out by a natural person in the exercise of exclusively private or domestic activities" of Article 2.2.c) of the RGPD.

The same consideration must be extended to the video door entry system installed on the exterior wall of the Community, since its location cannot be compared to the video door phone installed at the front door of a house.

As this is a warning sanction, the AEPD gives the defendant a period of one month to correct the unlawful conduct.

The AEPD agreed to impose a warning sanction, according to the following facts:

-This is a private individual whose main activity is not linked to the processing of personal data -No recidivism can be detected since no more than one infringement of the same nature has been recorded within a year. And furthermore, because the respondent has shown a cooperative attitude with the Agency in replying to the request.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

PS/00023/2020
938-300320
RESOLUTION OF SANCTIONING PROCEDURE
From the procedure instructed by the Spanish Data Protection Agency and on the basis of the following

FACTS

FIRST: On October 8, 2019, he joined this Spanish Agency Data Protection Department has prepared a document submitted by A.A.A. on behalf of B.B.B. (hereinafter referred to as the claimant), by which it makes a claim against C.C.C. with NIF ***NIF.1 (hereinafter the claimant), for the installation of a video surveillance in ***ADDRESS.1, ***APPARTMENTS.1 - ***LOCALITY.1 (SANTACRUZ OF TENERIFE), where there are indications of possible non-compliance with provided for in the personal data protection regulations.

The reasons for the complaint and, where appropriate, the documents  following are the contributions made by the claimant:

"[...] SECOND: From some time ago (January 15, 2019) they have placed cameras for private use on the communal façade and focused on the house and garden of D. B.B.B. and family, as well as an intercom for private use in the Community external wall, without the authorisation of the Community of Owners. […]
Attached is a photographic report of the location of the cameras and two recordings video.

SECOND: Prior to the admission of this claim, the following will be transferred the respondent, in accordance with the provisions of Article 65.4 of the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of digital rights (hereinafter referred to as LOPDGDD), with notification being made on
23/10/2019. 

On 18/11/2019, a written reply was received from the respondent with the following content:
"[...] SECOND: That the installation of the camera is based on the threats of injury and death received from the neighbour living in the flat first of the property (flat 101). These threats are reported and is currently under investigation.

THIRD: That this part states that although the camera is installed in the exterior of the house, CANNOT capture images of people in entrances, facades or partitions, but only the entrance to the house I own,
so the RGPD provisions do not apply.

FOURTH: That in spite of the above, this part has been complying with the RGPD, so it answers the following points:
1. Identification of the person responsible for the facility by providing his/her NIF and telephone number contact: D. C.C.C., with N.l.E. number ***NIF.1
2. Information provided on the existence of a video-surveillance area by Photographs of the information poster(s): Photo attached. This poster clearly indicates the existence of the processing, the identity of the controller, the possibility of exercising the rights in Articles 15 to 22 of the GPRD and a reference to where to get more information on data processing personal.
3. If a third party has been commissioned to view and process images captured by the cameras, provide contract: No contract with no third party will be allowed to view or process the images.
4. Number and characteristics of the cameras: Three fixed cameras, not rotating.
5. Scope of the cameras and places where they are installed: Attached photographs of the installation of the cameras as well as the which it is noted that they do not capture images of land and adjacent houses or any other alien space.
6. Indicate the conservation period of the registered images: The images are not recorded on any media, they are only used to visualize that there are no strangers outside the home when to get out of it.
7. Any other information of interest:
Access to the images is by internet connection, with [Sic.] access is restricted with a user code and a password that guarantees the unique identification and authentication, which is known only to me.
The password is changed regularly, avoiding the easy deductibles. . ." the photo report attached.

THIRD: In view of the reply made by the respondent to the transfer on 27/11/2019 he was asked to complete the information provided. Specifically, it was requested:

"-Contribution of the Minutes of the Meeting of the Community of Owners in which approve the  authorisation for the installation of the video surveillance cameras, located outside your home, for which you are responsible.
-With regard to the video door entry system with camera, of his property, installed on the wall outside the house, inform if the camera is activated and switched on when calls the bell, visualizing the person calling it during sayings moments and without the system having an image recording system, or if the system is articulated through procedures that reproduce and/or record images on a constant basis.

I also provided, with regard to the latter system: a copy of the minutes of the Meeting of the Community of Owners in which the installation of the aforementioned video door phone; information provided on the existence of video surveillance by means of photographs of the information poster in which it is possible
appreciate both their location and the data shown; photograph of the images captured by it as displayed on the monitor and time of conservation of the registered images".

On 9/12/2019, the reply to the complaint was received with the following content:

"[...] FIRST: THE MINUTES OF THE MEETING OF THE C.P. ARE NOT PROVIDED AS THE CAMERAS DO NOT CAPTURE ANY IMAGES OF COMMON ELEMENTS, BUT OF THE ENTRANCE OF THE HOUSE THAT HAS THE CONSIDERATION OF A PRIVATE ELEMENT, SO IT IS NOT NECESSARY BOARD APPROVAL.

SECOND: REGARDING THE VIDEO DOOR ENTRY SYSTEM WITH INSTALLED CAMERA ON THE COMMUNITY'S EXTERNAL WALL, IT IS REPORTED THAT THE IS NOT OPERATIONAL, THE CALLER IS NOT DISPLAYED NOR DOES IT HAVE AN IMAGE RECORDING SYSTEM."

FOURTH: The complaint was admitted for processing by resolution of 16 December 2019.

FIFTH: On 8 June 2020, the Director of the Spanish Agency for Data Protection agreed to initiate sanctioning procedures against the respondent, by the alleged violation of Article 5.1.c) of the RGPD, as defined in Article 83.5 of the GDPR.

SIXTH: Formal notification of the agreement to initiate the proceedings, the respondent has not submitted
The provisions of Article 64 of the Directive apply to this case. Law 39/2015, of 1 October, on the Common Administrative Procedure of Public administrations, which in its section f) establishes that in case of failure
to make representations within the time limit laid down on the content of the initiating agreement, the latter may be considered as a motion for a resolution when it contains a precise statement of the liability charged, so that to issue a resolution.

In view of the above, the Spanish Data Protection Agency:

The following are considered to be proven facts in these proceedings,
FACTS
FIRST: The claimant has installed a video surveillance system outside of housing located at ***ADDRESS.1, ***APARTMENTS.1 - ***LOCATION.1 (SANTA CRUZ DE TENERIFE) composed of three fixed cameras. It has a poster information.

SECOND: Of the photographs provided by the respondent in the reply to transfer of the claim is evidenced that: 
Camera 1 (so called on the viewing monitor) captures the staircase leading to the house and part of the lower garden that corresponds to another neighbouring house.
The camera shown in the lower left quadrant of the monitor captures part of the access staircase, part of the lower garden and reaches vehicles parked on the roadway outside the building.

THIRD: The complainant has also installed a video entry system on the exterior wall Community for which it states that it is not operational, without proceeded to accredit this.

FOURTH: The authorization of the Owners' Meeting of the Community for the installation of these devices.

FIFTH: The sound recording provided by the in its brief, since the parties to the proceedings of the Commission have not been recording.

SIXTH: The respondent has not made any allegations within the procedure.

LEGAL GROUNDS

I
By virtue of the powers conferred on each of the parties by Article 58(2) of the GDPR authority, and in accordance with the provisions of Articles 47 and 48.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to resolve this procedure.

II
The defendant is charged with an infringement of the Article 5.1(c) of the GDPR on the principles of processing, which provides that personal data shall be "adequate, relevant and limited to what is necessary in relation to for the purposes for which they are processed ("data minimisation")." This article enshrines the principle of data minimisation in data processingpersonal. It presupposes that such processing is adjusted and proportionate to the purpose to the one being addressed, with excessive data processing being restricted or be abolished.

The violation of this article is typified as an infraction in article 83.5 of the RGPD, which it considers as such:
"Infringements of the following provisions shall be sanctioned, in accordance with paragraph 2, with administrative fines of up to EUR 20 000 000 or in the case of a company, for an amount equivalent to a maximum of 4% of total annual turnover for the previous financial year, opting for the largest:

(a) the basic principles for treatment, including the conditions for consent under articles 5, 6, 7 and 9; [...].
However, Article 58(2)(b) of the same legal text provides for the possibility of to sanction with a warning, in relation to the provisions of recital 148:
"In the event of a minor infringement, or if the fine likely to be imposed constitute a disproportionate burden on a natural person, rather than a warning may be imposed by way of a fine. However, it must
particular attention should be paid to the nature, gravity and duration of the infringement, its the Commission shall take all necessary measures to mitigate the damage suffered, the degree of liability or any previous relevant infringement, the way in which that the monitoring authority has been made aware of the infringement, to compliance of measures ordered against the person responsible or entrusted, to the adherence to codes of conduct and to any other aggravating or mitigating circumstances".

For the purposes of the limitation period for infringements, the infringement in question in the previous paragraph is considered very serious and prescribes after three years, according to Article 72.1 of the LOPDGDD, which establishes that

"In accordance with Article 83(5) of Regulation (EU) 2016/679 are considered very serious and will be subject to a three-year statute of limitations for infringements involving a substantial breach of the articles mentioned therein, and in particular the following:
a) The processing of personal data in violation of the principles and guarantees laid down in Article 5 of Regulation (EU) 2016/679.

III
In this procedure, the alleged unlawfulness of the installation, by the defendant, of a video surveillance system consisting of 3 cameras located outside the house on STREET ***DIRECTION.1, ***APARTMENTS.1 - ***LOCALITY.1 (SANTA CRUZ DE TENERIFE), system that could capture images of neighbouring housing areas in a way disproportionate, as well as an intercom for private use outside the without the corresponding authorisation of the Owners' Association of the Community. 

The facts of these proceedings show that 2 of the 3 cameras installed by the claimant (the so-called camera 1 and the one visible in the lower left quadrant of the viewing monitor) capture disproportionate share of communal areas, neighbouring housing and even public roads. 
This situation is not covered by the exclusion set out in Article 22.5 of LOPDGDD as the capture of images that exceed the verification about the identity of people trying to access an address beyond the
treatment "carried out by a natural person in the exercise of exclusively private or domestic activities" of Article 2.2.c) of the RGPD.
The same consideration must be extended to the video door entry system installed on the exterior wall
Community, since its location cannot be compared to the video doorphone installed at the front door of a house.
Likewise, although the purpose of the data processing carried out with the video surveillance system was to guarantee the security of the home and space and therefore this legitimizing basis could be asserted
-, the capture of images should be reduced to this private space, being limited that of common areas at the minimum tangential and essential, without in any case can reach the gardens of neighbouring houses or the public highway. They remind him that, with regard to the latter, the power is generally attributed to the Forces and Security Forces and that, in any case, the possibility of capturing a portion for security reasons, it would be necessary, because of the characteristics of the building in question, to the community of owners.
Finally, it should be noted that individuals who install this type of devices are responsible for ensuring that it complies with current legislation, and must comply with the requirements set out in Law 49/1960 of 21 July,
on horizontal property (LPH). Thus, the installation of a video surveillance system by a private individual will require the authorisation of the Community of Owners' Meeting both when its location is projected in a common area and when, even if located in an area of private use, to orient itself to surrounding common areas and to capture - while respecting the principle of data minimisation - tangentially these common areas.

IV
In the present case, when deciding on the penalty to be imposed, the following have been taking into account, in particular, the following elements.
That it is a private individual whose main activity is not linked to the processing of personal data.
That no recidivism is appreciated, as the commission is not recorded, within a year, of more than one infringement of the same nature.
That it has shown a cooperative attitude towards this Agency by replying to the requirement.
For all these reasons, it is considered that the sanction that should be imposed is warning, in accordance with Article 58(2)(b) of the GDPR, in connection with the above-mentioned Recital 148.

Therefore, in accordance with the applicable legislation and having regard to the criteria of graduation of the sanctions whose existence has been accredited, the Director of Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE C.C.C., with NIF ***NIF.1, for an infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a penalty of WARNING. To that effect, within ONE MONTH from the notification of this act, you must provide proof of the following:

Proof of the removal of camera 1 and of the camera listed in the monitor in the lower left quadrant of your current locations, or to its reorientation by reducing the angle of capture.
Please note that the automatic video door entry system installed on the community wall will
found to be inoperative.

SECOND: NOTIFY this resolution to C.C.C. and REPORT the result of actions to A.A.A. on behalf of B.B.B.
In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public after it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure according to art. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the interested parties may lodge, on an optional basis, an appeal for reversal to the Director of the Spanish Data Protection Agency within a period of month from the day following notification of this resolution or directly contentious-administrative appeal to the Administrative Chamber of the Audiencia Nacional, in accordance with Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July 1998, regulating Contentious-Administrative Jurisdiction, within two months from day following notification of this act, as provided for in Article 46(1) of the referred to Law.

Finally, it is pointed out that in accordance with the provisions of Article 90.3 a) of the LPACAP, the final decision may be suspended in administrative proceedings as a precautionary measure if the person concerned indicates his intention to lodge an administrative appeal. If this is the case, the interested party must formally communicate this made by writing to the Spanish Data Protection Agency, by submitting it through the Agency's Electronic Register [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registrations provided for in Article 16.4 of the aforementioned Law 39/2015, of 1 October. Also
must send to the Agency the documentation proving the effective intervention of the contentious-administrative appeal. If the Agency was not aware of the lodging of the contentious-administrative appeal within two months of day following notification of this resolution, would terminate the precautionary suspension.

Mar España Marti
Director of the Spanish Data Protection Agency