AEPD (Spain) - PS/00215/2020

AEPD - PS/00215/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	2000 EUR
Parties:	n/a
National Case Number/Name:	PS/00215/2020
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Sergi Ariño Mayans

The Spanish DPA (AEPD) fined a data controller €1,200 for installing surveillance cameras in public spaces without a lawful basis under Article 6 GDPR.

English Summary

Facts

An individual lodged a complaint with the Spanish DPA (AEPD) arguing that the defendant has set surveillance cameras in a public area, not properly oriented to his private property.

The defendant stated that there is a sign in place warning about being a video-recorded zone, that the images are not being stored and that the cameras are aiming to his property.

Dispute

Since the GDPR requires that the personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimization), would that be an infringement of the Article 5.(1)(c) GDPR?

Holding

The AEPD held, that it is responsibility of the demandant to make sure his surveillance cameras are set up in a lawful manner. The surveillance cameras must preferably be oriented to the private property, otherwise that might constitute a privacy violation for third parties, when believing that they are being permanently recorded.

Besides, recording public spaces is an exclusive competence of the Spanish state.

Therefore, the AEPD imposed a fine of €2000 to the defendant for a violation of the Article 5(1)(c) GDPR, for having surveillance cameras recording public space, affecting the rights of third parties without a lawful ground.

Comment

The initial fined was reduced to €1200 due to a voluntary payment made by the defendant along with acknowledgment of his liability.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Page 1
1/9 Procedure No.: PS / 00215/2020RESOLUTION R / 00589/2020 TERMINATION OF THE PAYMENT PROCEDUREVOLUNTARY
In the sanctioning procedure PS / 00215/2020, instructed by the Spanish Agency forData Protection to BBB , considering the complaint filed by AAA , and based onthe following,BACKGROUNDFIRST: On October 16, 2020, the Director of the Spanish Agency forData Protection agreed to initiate sanctioning procedure to BBB (hereinafter,the claimed), through the Agreement that is transcribed:<<Procedure Nº: PS / 00215/2020935-200320AGREEMENT TO START THE SANCTIONING PROCEDUREOf the actions carried out by the Spanish Agency for the Protection ofData and based on the followingACTSFIRST: Mr. AAA (* hereinafter, the claimant) dated April 30, 2020filed a claim with the Spanish Agency for Data Protection. Theclaim is directed against BBB with NIF *** NIF.1 (hereinafter, the claimed). Thereasons on which the claim is based are “presence of video surveillance cameras haspublic space, not oriented towards their private property ”(folio nº 1).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/9Along with the claim, it provides documentary evidence (Annex I) that proves thepresence of the camera (s) on the exterior of the facade oriented towards spacepublic.SECOND. On 06/24/20, this Agency received a letter of allegations from thecomplained party alleging the following:"The guarded area is informed through an informational poster whereinforms the email address where you can request information about theimages. Although it should be noted that the images are not stored or displayed.In fact, a monitor had to be installed to capture the image and be able to bereported.The cameras have been installed to cover the access area to the house andindustrial warehouse where all the material and tools of my activity are housedbusiness.They have been installed avoiding exceeding the limits set by law and preventing theinfrared cameras make the images null by saturating the targets.As stated above, images are not stored.visualize and the installation of cameras in addition to avoiding theft is used ascompany testing laboratory to check equipment. (Attached image ofinstallation)".FOUNDATIONS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authoritycontrol, and as established in articles 47 and 48 of the LOPDGDD, the Di-rector of the Spanish Data Protection Agency is competent to initiate andto solve this procedure.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/9IIIn the present case, we proceed to examine the claim dated 04/30/20 by means ofof which the “presence of video surveillance cameraslancia towards public space ”(folio nº 1).The art. 5.1 c) RGPD provides the following: Personal data will be:"Adequate, relevant and limited to what is necessary in relation to the purposesfor which they are processed ("data minimization").It should be remembered that individuals are responsible for ensuring that the systems installedharvested comply with current legislation, proving that it complies with allthe requirements demanded by the regulations in force.The installation of this type of device must have the mandatory informative postertive, indicating the purposes and responsible for the treatment, where appropriate, of the ca-personal character.In any case, the cameras should preferably be oriented towards spaceparticular, avoiding intimidating neighboring neighbors with this type of device, thushow to control traffic areas of the same without just cause.Also, with this type of device, it is not possible to obtain images of public space.co, as this exclusive competence of the Security Forces and Corps of the Statetado.It should be remembered that even in the case of a "simulated" camera the sameshould preferably be oriented towards private space, since it is consideredthat this type of device can affect the privacy of third parties, which aremeasured by it in the belief of being the object of permanent recording.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/9Individuals cannot install devices for obtainingimages of public space, outside the cases permitted in the regulations.IIIIn accordance with the evidence available at presentagreement to initiate the sanctioning procedure, and without prejudice to whatSubsequent to the instruction, it is considered that the defendant has a video systemsurveillance oriented towards public space, affecting the rights of third parties withoutjust cause.In the stills provided by the accused (Annex I), the obtaining-images of the width of the public sidewalk , so that it is observed evencars parked on public roads, without any kind of masking.The known facts could be constitutive of an infraction, attributable to theclaimed , for violation of the content of article 5.1 c) RGPD, previouslytranscribed.The installation of video cameras in public places, both fixed and mobile,It is the exclusive competence of the Security Forces and Bodies, governing thetreatment of said images by its specific legislation, contained in the Organic Lawca 4/1997, of August 4, and its Development Regulations, without prejudice to their beingapplicable, where appropriate, what is specially provided in the RGPD, in aspects such as theadoption of the security measures resulting from the analysis ofrisks as well as the registration of treatment activities.Security cameras installed in private spaces will not be able to obtainimages of public spaces, the security function of public spacesit corresponds exclusively to the State Security Forces and Bodies.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/9The art. 83.5 RGPD provides the following: "Violations of the provisionsfollowing will be sanctioned, in accordance with section 2, with administrative finesof a maximum of EUR 20,000,000 or, in the case of a company, of an equal amountequivalent to a maximum of 4% of the total global annual turnover for the financial yearabove, opting for the one with the highest amount:a) the basic principles for the treatment, including the conditions for theconsent in accordance with articles 5, 6, 7 and 9;When motivating the penalty to be imposed, the following is taken into account:- l to nature, severity and duration of the violation, the system being athat allows images of public space to be obtained, without just cause, proceeding to"Process third party data" (art. 83.2 a) RGPD).- the intentionality or negligence in the infringement (art. 83.2 b) RGPD).For all these reasons, it is considered appropriate to propose an initial penalty of the amountof 2,000 € (two thousand euros) penalty at the lowest level for this type of in-administrative fractions, given the seriousness of the events described.All this without prejudice to proving the legality of the system once it has adoptedcorrective measures that it deems pertinent, to avoid the uptake of spacepublic service.Therefore, based on the foregoing,By the Director of the Spanish Agency for Data Protection,HE REMEMBERS:C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/9FIRST: INITIATE SANCTIONING PROCEDURE to the investigated BBB , withNIF *** NIF.1 , for the alleged infringement of art. 5.1 c) RGPD, offense typified in theart. 83.5 a) RGPD, being punishable in accordance with article 58.2 RGPD.TWO: APPOINT as an instructor at CCC and as secretary to DDD , indi-Whereas any of them may be challenged, if applicable, in accordance with the provisionscido in articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regimeof the Public Sector (LRJSP).THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the claimmation filed by the claimant and his documentation, the documents obtained andgenerated by the Subdirectorate General for Data Inspection during the investigation phasevestigaciones, all of them part of the administrative file.FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1,tubre, of the Common Administrative Procedure of Public Administrations, theThe penalty that may correspond would be € 2,000 (Two Thousand Euros), without prejudice to theresulting from the instruction.SIXTH: NOTIFY this agreement to BBB , with NIF *** NIF.1 , granting it ahearing period of ten business days to make the allegations and presentthe tests it deems appropriate. In your statement of allegations you must provideYour NIF and the procedure number that appears at the top of this document.ment.If, within the stipulated period, no allegations are made to this initiation agreement, theIt may be considered a resolution proposal, as established in articleArticle 64.2.f) of Law 39/2015, of October 1, on the Administrative Procedure Co-common of the Public Administrations (hereinafter, LPACAP).In accordance with the provisions of article 85 of the LPACAP, in the event ofthat the sanction to impose was a fine, you may recognize your responsibility withinof the term granted for the formulation of allegations to this initiation agreement; thewhich will entail a reduction of 20% of the sanction to be imposed inthis procedure. With the application of this reduction, the sanction would beC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/9established at € 1600, resolving the procedure with the imposition of this penaltytion.In the same way, you may, at any time prior to the resolution of theThis procedure, carry out the voluntary payment of the proposed sanction, whichwill mean a reduction of 20% of its amount. With the application of this reduction,the penalty would be set at 1,600 euros and its payment will imply the termination of theprocess.The reduction for the voluntary payment of the sanction is cumulative to the oneIt corresponds to apply for the recognition of responsibility, provided that thisknowledge of responsibility is made manifest within the period grantedto formulate allegations at the opening of the procedure. The voluntary payment of theamount referred to in the preceding paragraph may be made at any time prior tothe resolution. In this case, if both reductions should be applied, the amount of theThe penalty would be set at 1,200 euros (One Thousand Two Hundred Euros)In any case, the effectiveness of either of the two mentioned reductionsIt will be conditioned to the withdrawal or resignation of any action or remedy inadministrative against the sanction.In case you choose to proceed to the voluntary payment of any of the amountsindicated € 1600 or € 1200, you must make it effective by entering the accountnº ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for Pro-Data protection in the bank CAIXABANK, SA, indicating in the conceptthe procedure reference number in the heading of thisdocument and the cause of reduction of the amount to which it is accepted.Likewise, you must send proof of admission to the Subdirectorate General ofInspection to continue with the procedure in accordance with the amount enteredsada.The procedure will have a maximum duration of nine months fromthe date of the initiation agreement or, where appropriate, the draft initiation agreement. Trans-after this period, its expiration will occur and, consequently, the current filetions; in accordance with the provisions of article 64 of the LOPDGDD.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 8
8/9Finally, it is pointed out that in accordance with the provisions of article 112.1 of theLPACAP, against this act there is no administrative appeal.Mar Spain MartíDirector of the Spanish Agency for Data Protection>>SECOND : On November 7, 2020, the defendant has proceeded to paythe sanction in the amount of 1,200 euros making use of the two reductionsprovided for in the Initiation Agreement transcribed above, which implies theacknowledgment of responsibility.THIRD : The payment made, within the period granted to formulate allegations tothe opening of the procedure, entails the waiver of any action or appeal in the processadministrative against the sanction and the recognition of responsibility in relation tothe facts to which the Initiation Agreement refers.FOUNDATIONS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authority ofcontrol, and as established in art. 47 of Organic Law 3/2018, of 5December, Protection of Personal Data and guarantee of digital rights (inhereinafter LOPDGDD), the Director of the Spanish Agency for Data Protectionis competent to sanction the infractions that are committed against saidRegulation; infractions of article 48 of Law 9/2014, of May 9, Generalof Telecommunications (hereinafter LGT), in accordance with the provisions of thearticle 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of theinformation and electronic commerce (hereinafter LSSI), as provided in article43.1 of said Law.IIArticle 85 of Law 39/2015, of October 1, on Administrative ProcedureCommon of Public Administrations (hereinafter, LPACAP), under the rubric" Termination in sanctioning procedures " provides the following:"1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility,the procedure may be resolved with the imposition of the appropriate sanction.2. When the sanction is solely of a pecuniary nature or it is possible to impose apecuniary sanction and another of a non-pecuniary nature but theC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 9
9/9inadmissibility of the second, the voluntary payment by the presumed responsible, inany time prior to the resolution, will imply the termination of the procedure,Except for the replacement of the altered situation or the determination of thecompensation for damages caused by the commission of the offense.3. In both cases, when the sanction is solely of a pecuniary nature, thecompetent body to resolve the procedure will apply reductions of, at least,20% of the amount of the proposed penalty, these being cumulative among themselves.The aforementioned reductions must be determined in the notice of initiationof the procedure and its effectiveness will be conditioned to the withdrawal or resignation ofany action or appeal in administrative proceedings against the penalty.The reduction percentage provided for in this section may be increasedregulations.In accordance with the above, the Director of the Spanish Agency for the Protection ofData RESOLVES :FIRST: DECLARE the termination of procedure PS / 00215/2020 , ofin accordance with the provisions of article 85 of the LPACAP.SECOND: NOTIFY this resolution to BBB .In accordance with the provisions of article 50 of the LOPDGDD, thisResolution will be made public once it has been notified to the interested parties.Against this resolution, which puts an end to the administrative procedure as prescribed bythe art. 114.1.c) of Law 39/2015, of October 1, on Administrative ProcedureCommon of Public Administrations, interested parties may file an appealadministrative litigation before the Contentious-administrative Chamber of theNational High Court, in accordance with the provisions of article 25 and section 5 ofthe fourth additional provision of Law 29/1998, of July 13, regulating theContentious-Administrative Jurisdiction, within a period of two months from theday following notification of this act, as provided in article 46.1 of thereferred Law.936-031219Mar Spain MartíDirector of the Spanish Agency for Data Protection