AEPD (Spain) - PS/00253/2020

AEPD - PS/00253/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	04.01.2021
Published:	08.02.2021
Fine:	5000 EUR
Parties:	n/a
National Case Number/Name:	PS/00253/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) imposed a fine of €5,000 on the owner of a property that he rented out. The defendant had placed a video camera inside the rented property which went beyond filming the entrance as he claimed. This breached Article 5(1)(c) GDPR.

English Summary

Facts

The Complainant filed a complaint before the Spanish DPA (AEPD) against an unnamed data controller (the defendant). The Complainant rented two rooms from the defendant, the property owner. The Complainant claims to have been told by the defendant that the surveillance camera inside only focused on the front door of their property for security.

However, the Complainant later discovered that the camera did not focus only on the door as the defendant showed the Complainant a recording (with sound) of the Complainant breaking the television whilst vacuuming.

The Complainant highlighted to the AEPD that they felt spied on, especially as they had private telephone conversations in parts of the room where the camera also focused on (rather than just the door as claimed by the defendant).

The defendant, the owner of the property, claimed that the video camera was inside their private house and focused on the interior to scare potential thieves. They asserted that they were the only person with access to the data stored on the camera's memory card.

The AEPD found whilst investigating that there was no informational poster on the door of access to the property regarding the video-surveillance camera.

Dispute

Is the presence of a video surveillance camera placed by the owner of a rented property in violation of Article 5(1)(c)?

Holding

The Spanish DPA (AEPD) held that the facts highlighted that there was a video surveillance camera installed in a rental property processing personal data without a reason or clear purpose.

The DPA referred to Article 5(1)(c) GDPR on data minimisation. It also highlighted that it is for the individual in charge of camera to comply with the requirement of the law.

The DPA held that when it comes to a property that is rented out (the object of a contract), the notion of personal of "purely personal or household activities" disappears. The owner of the property (that is rented to a third party), who is in charge of the video camera, must comply with the GDPR. The DPA went on to highlight a Constitutional Court decision (nº 22/1984 (Rec.59/1983)) on the concept of a private home, which stated that this is a place where an individual can exercise their freedom more intimately, outside of social conventions.

Therefore, the Spanish DPA concluded that the defendant processed personal data without just cause by filming the complainant inside their rented house. This was particularly because the video camera did not just record the entrance to scare burglars, but instead also filmed some other parts of the property. Therefore, the defendant breach Article 5(1)(c) GDPR.

The Spanish DPA imposed a fine of €5,000 on the defendant.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/7










     Procedure Nº: PS / 00253/2020


                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following

                                       ACTS

FIRST: Mrs. A.A.A. (hereinafter, the claimant) dated January 30, 2020
filed a claim with the Spanish Data Protection Agency. The
claim is directed against B.B.B. with NIF *** NIF.1 (hereinafter, the claimed one). The
reasons on which the claim is based are the following:


       "He has a surveillance camera that supposedly told me he was only focusing
to the front door for security and the sound was turned off. For a mishap
vacuuming I broke the television, he sent me the video which does not focus the
entrance door as assured and above it has sound, I felt spied on since

focuses on part of the room where I have had private conversations on the phone and
he has been able to see everything he did. Not only is it here, an expert had to come to see the
damage and was listening to the conversation and watching us ”(folio nº 1).

       Along with the claim, you provide a CD to support your claim about the

facts described (Evidentiary Document No. 1) that corroborate the presence of the device in
the table in the hall of the premises rented as a home.

SECOND: On 06/18/20 the defendant requests from this Agency a copy of the
administrative file for the appropriate legal purposes.


THIRD: On 03/24/20, the claim is TRANSFERRED to the
denounced to express what it deems appropriate in relation to the facts
exposed.

       "I do not understand why the Complaint has been received at my ex-partner's house, NO

I understand the reason for the Complaint, because the camera is inside my house, it is not a
local as indicated in the writing but my private home. The camera is
tabletop purchased on Amazon, located in the hall furniture and focused on the
interior (…) to scare away potential thieves. The data is stored in a
memory card installed in the same camera and the only person who has access

it's me".

BEDROOM. On September 1, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against the complained party, with
according to the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Pro-
Common Administrative Assignment of Public Administrations (hereinafter, LPA-

CAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in Article
83.5 of the GDPR.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/7








FIFTH. On 10/07/20, a copy of the Declaration Act made before the
State security forces and bodies by the defendant himself dated
01/17/20, where he acknowledges being responsible for the installation of a camera in the

interior of the room rented to the complainant.

SIXTH: A list of documents in the document is attached as an annex.
procedure, being at your disposal the content of the administrative file.

SEVENTH. On the date a proposal for a Resolution is issued by means of which the

accredits the infringement of the content of art. 5.1 c) RGPD, proposing a sanction in
the amount of € 5,000 (Five Thousand Euros).

EIGHTH. Consulted the database of this organization on 11/30/20, it has not been
received any allegation in relation to it, nor has the payment of

any amount for the appropriate legal purposes.

Of the actions carried out in this procedure and of the documentation
Obrante in the file, the following have been accredited:

                                 PROVEN FACTS


First. On 01/30/20, this AEPD receives a claim from the complainant for
means of which translates the following:

       "He has a surveillance camera that supposedly told me he was only focusing

to the front door for security and the sound was turned off. For a mishap
vacuuming I broke the television, he sent me the video which does not focus the
entrance door as assured and above it has sound, I felt spied on since
focuses on part of the room where I have had private conversations on the phone and
he has been able to see everything he did. Not only is it here, an expert had to come to see the

damage and was listening to the conversation and watching us ”(folio nº 1).

Second. It is identified as the main responsible B.B.B., which is the owner
of the property where the camera was installed, not denying that it was the
responsible for its presence.


Third. In the statement provided before the Security Forces and Bodies (Direc-
General Assembly of the Police 01/17/20) states that “he has rented two rooms to
a girl named A.A.A. " “That from the beginning A.A.A. knew of the existence of the
camera at the entrance of the house and that works as a deterrent for thieves ”.


Bedroom. There is no contract with a specific clause on data protection,
informing of the purpose of the treatment of the same.

Fifth. There is no record that the defendant had an informational poster on the door of
access to the rented premises as a home, informing that it was an area

video-surveillance.

Sixth. It is known that the images obtained from the webcam were used when
affirm in a statement dated 01/17/20 before the General Police Directorate

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/7









        "That by showing the images to A.A.A., it denies what happened."


                            FOUNDATIONS OF LAW

                                              I

        By virtue of the powers that article 58.2 of the RGPD recognizes to each authority
control, and according to what is established in articles 47 and 48 of the LOPDGDD, the

rector of the Spanish Data Protection Agency is competent to initiate and
to solve this procedure.
                                              II

In the present case, the claim dated 01/30/20 is examined by me-

of which the claimant transfers the following as the main event:
        "Installation of camera in the house that has rented, obtained images
inside the same without just cause ”(folio nº 1).

        The facts are specified in the installation by the defendant of a device
recording (web-cam) you have used to obtain images / sound from the rental

of the same, without justified cause, proceeding to treat the data of this without
there is any apparent reason.

        The art. 5.1 c) RGPD provides the following: Personal data will be:
        “Adequate, relevant and limited to what is necessary in relation to the purposes

for which they are processed ("data minimization").

        It should be remembered that individuals are responsible for ensuring that systems
most installed comply with current legislation, proving that it complies with
all the requirements demanded by the regulations in force.


        The installation of this type of device must have the mandatory poster
informative, indicating the purposes and responsible for the treatment, where appropriate, of the data
of a personal nature.

        In the present case, we have a lease contract whose

leased object is to satisfy the primary and permanent housing need of the
tenant.

        A video camera is installed in the property that is the object of the contract.
surveillance (web-cam), specifically in the room under its use and enjoyment, in a

that it allows the landlord to obtain images of the interior of the room (lo-
lime as a home) and proceed to listen to what happens in it.

        From the moment the use (enjoyment) of the property was transferred to a
third (tenant), the notion of “personal and domestic sphere” disappears, is-

allowing the capture of images from third parties subject to the data protection regulations
cough, being mandatory to comply with a series of guarantees that are included in the
regulations in force, especially if the owner was the main responsible for the images.
tions obtained when entering / exiting the dwelling in question.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/7









        The description that the Constitutional Court makes regarding the concept of
micilio, taking as such "the space where the individual lives exercising their freedom

more intimate, outside of social conventions ”.

The inviolability of the home protects not only the physical space itself considered
but what is in it of emanation from the person and his private sphere, having
defined by the Constitutional Court, in its judgment nº 22/1984 (Rec. 59/1983), of 17
February, the inviolable home as: “a space in which the individual lives without

be necessarily subject to social customs and conventions and exercise their freedom more
intimate ”.
                                             III

        In accordance with the evidence available in these proceedings,

sanctioning, it is considered that the claimed had a web-cam, proce-
giving the claimant's data to be processed through the device installed inside
of the (local) home that he proceeded to lease, treating them without just cause.
gives.

        Specifically, the images obtained are used by it to reproduce

tell the tenant the breaking of the television screen that was in the
interior of the house.

        Manifests before the State Security Forces and Bodies (Declaration
date (01/17/20) “That when you see the images you see how Mrs. A.A.A., while using the

vaccum cleaner. He has thrown the screen and has broken the television, the screen and a design table
what's behind".

        So it is proven that the orientation of the camera was not ex-
clusive as he asserts “only towards the entrance of the door”, since television is

ba inside the cabin, and only by viewing the images
was able to know with such precision of detail that the breakage of the television occurred "while passing
the vacuum cleaner and that affected a design table behind it ”.

        The proven known facts are constitutive of an administrative infraction.
trative, attributable to the complained party, for violation of the content of article 5.1 c) RGPD.


                                                 IV

Regarding the alleged non-existence of culpability in the commission of the offending conduct,
Torah. In this sense, there is no doubt that guilt constitutes an essential note in

sanctioning matter and that so-called strict liability has no place in De-
administrative sanctioning right.

Indeed, article 28 of Law 40/2015 (October 1) provides that “They may only
be sanctioned for acts constituting an administrative offense, individuals who

legal, as well as, when a Law recognizes their capacity to act, the groups
types of affected, unions and entities without legal personality and patrimonies
independent or autonomous, who are responsible for them as
fraud or guilt ”.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/7









 This simple non-observance cannot be understood as admission to the Law
administrative sanctioning of strict liability, since the doctrine of the Court

Constitutional (Sentences 15/1999, of July 4, and 76/1990, of April 26) and the
majority prudence of our Supreme Court (for all Judgment of 23 of
January 1998), as well as the requirements inherent to a rule of law, require
that the principle of guilt requires the existence of fraud or fault.

The Supreme Court (Judgments of April 16 and 22, 1991) considers that the ele-

of guilt it follows “that the action or omission, classified as an infringement,
administratively punishable action, must be, in any case, attributable to its author,
due to fraud or recklessness, negligence or inexcusable ignorance. "

The National High Court, in Judgment of June 29, 2001, on protection

of personal data, has stated that “simple negligence or incum-
compliance with the duties that the Law imposes on the persons responsible for files or
of the data processing of extreme diligence ... ”.

The Supreme Court (Judgments of July 5, 1998 and March 2, 1999) comes
understanding that there is recklessness whenever a legal duty of care is disregarded.

given, that is, when the offending subject does not behave with the required diligence. Dili-
The degree of exigency of which will be determined according to the circumstances
currents in each case, such as the special value of the protected legal asset or the
professionalism required of the offender. In this sense, the aforementioned Judgment of June 5
1998 demands from professionals in the sector “a duty to know especially the

applicable standards ”.

In the present case, the defendant is responsible for the installation of a web-
cam, having obtained personal data from the denounced, for a purpose not to per-
mitigated by the legal system, such as the use of them to reproach him for the

"Break" of a television of his property, for which the intentionality is accredited
of the accused by way of gross negligence at least.

                                             V

Article 83.5 RGPD provides the following:


        "Violations of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,
for a company, an amount equivalent to a maximum of 4% of the volume
total annual global business menu for the previous financial year, opting for the

higher amount:

        a) the basic principles for the treatment, including the conditions for the treatment
           consent in accordance with articles 5, 6, 7 and 9;


When motivating the sanction, the following is taken into account:

        -the seriousness of the offense when obtaining data (s) from a space reserved for the
privacy, as was the space leased to the claimant, being able to listen to the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/7








Versions of the same and treating the data of this without just cause (art. 83.2 a)
GDPR).


       -the intentionality or negligence of the infringement, by not informing in the contract
of leasing of the purpose of processing the data obtained with the device
vo denounced and exceeding the recording area (article 83.2 b) RGPD).

       In the present case, the seriousness of the events described is taken into account,
which represent an attack on the inviolability of the home, in this case the object of

giving to the complainant, proceeding to process data of the same in their tasks
newspapers without just cause, all of which justify imposing a civil sanction.
frada in the amount of € 5,000 (Five Thousand Euros).

Therefore, in accordance with the applicable legislation and assessed the criteria of

graduation of sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE Don B.B.B., with NIF *** NIF.1, for a violation of Article
5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 5,000 (Five

A thousand euros).

SECOND: NOTIFY this resolution to Mr. B.B.B. and INFORM the
result of the proceedings against the complainant Doña A.A.A ..


THIRD: Warn the sanctioned person that the sanction imposed by a
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved

by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number
procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency
Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case
Otherwise, it will be collected in the executive period.


Received the notification and once executive, if the date of execution is found
Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment
volunteer will be until the 20th of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term

It will be until the 5th of the second following or immediate business month.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/7








counting from the day after the notification of this resolution or directly

contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the

day following notification of this act, as provided in article 46.1 of the
referred Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,

may provisionally suspend the final resolution through administrative channels if the
interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-

web /], or through any of the other records provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal

contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.


                                                                                     938-131120
Mar Spain Martí

Director of the Spanish Agency for Data Protection
































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es