AEPD (Spain) - PS/00389/2021

AEPD (Spain) - PS/00389/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	1500 EUR
Parties:	LA OFICINA BAR
National Case Number/Name:	PS/00389/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

A bar was fined €1500 for installing video surveillance cameras pointed towards a public street, violating the data minimisation principle under Article 5(1)(c) GDPR.

English Summary

Facts

A case was filed against LA OFICINA BAR for installing two video surveillance cameras oriented towards a public street and not towards their private area, thus surveilling the movement of all citizens circulating on the street.

Holding

The Spanish DPA (AEPD) recalled that the installation of this type of device must be accompanied by a mandatory information sign, indicating the purposes and the person responsible for the processing of personal data, if applicable. In any case, the cameras must be oriented towards private areas, to avoid intimidating neighborhoods with this type of device, as well as surveilling public transit areas without a justified cause. The AEPD held that this type of device cannot be used to obtain images of public space, as this is the exclusive competence of the State Security Forces and Corps.

The AEPD considered that, in accordance with the evidence available in the procedure, the defendant had two video-surveillance cameras that affect a public traffic area without a justified reason. Therefore the DPA imposed a fine of €1500 on LA OFICINA BAR for violating the data minimisation principle under Article 5(1)(c) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/6










     Procedure No.: PS/00389/2021


                RESOLUTION OF PUNISHMENT PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


                                       FACTS

FIRST: A.A.A. (*hereinafter, the complaining party) dated May 21, 2021
filed a claim with the Spanish Data Protection Agency. The
claim is directed against LA OFFICE BAR XXXX with CIF 49981173B (in

hereafter, the party claimed). The grounds on which the claim is based are
following.

       “Installation of 2 video surveillance cameras oriented towards public roads and
not to their private area thereby controlling the movement of all citizens
that circulate on the road. The orientation of the cameras...”—folio nº 1--.


       Along with the claim, provide documentary evidence that proves the presence
of the cameras on the outside of the facade of the establishment with palm trees
orientation towards public space (Annex I frames 1-4).


SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party in fe-
cha 05/27/21 and 06/18/21, to proceed to its analysis and inform this Agency
within a month, of the actions carried out to adapt to the requirements

provided for in the data protection regulations.

No response has been received to this letter, nor any explanation about the cameras
has produced.

THIRD: On July 26, 2021, the Director of the Spanish Agency for Pro-

Data protection agreed to admit for processing the claim presented by the claimant party.
keep.

FOURTH: On September 10, 2021, the Director of the Spanish Agency
of Data Protection agreed to initiate a sanctioning procedure against the claimed, for the

alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the
GDPR.

FIFTH: On 10/15/21, it is verified that no allegation has been received
by the claimed party, nor has the system been regularized.


In view of everything that has been done, by the Spanish Data Protection Agency
In this proceeding, the following are considered proven facts:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 2/6









                                        FACTS


First. The facts bring cause of the claim dated 05/21/21 through the
which translates the following:

        “Installation of 2 video surveillance cameras oriented towards public roads and

not to their private area thereby controlling the movement of all citizens
that circulate on the road. The orientation of the cameras...”—folio nº 1--.

Together with the claim, it provides documentary evidence that proves the presence of the
cameras on the outside of the establishment's facade with oriented palm trees

tion towards public space (Annex I frames 1-4).

Second. The Bar Office entity is identified as the main responsible entity.
XXXX.


Third. There is evidence of the presence of two exterior chambers whose orientation
allows them to capture public space without just cause.

                            FOUNDATIONS OF LAW


                                             I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and according to the provisions of articles 47 and 48 of the LOPDGDD, the Director
of the Spanish Agency for Data Protection is competent to initiate and to re-

solve this procedure.

                                             II

Before going into the substance of the matter, it should be noted that, as indicated in the Agreement of

Start date 09/10/21, in case of absence of allegations it could be
"considered as a resolution proposal", referring to what was stated in the same
for reasons of procedural economy.

In the present case, we proceed to analyze the claim dated 05/21/21 by means of

gave from which the following is transferred as the main fact

        “Installation of 2 video surveillance cameras oriented towards public roads and
not to their private area thereby controlling the movement of all citizens
that circulate on the road. The orientation of the cameras...”—folio nº 1--.


The image of a person is a "personal data" as long as it can be identified,
which can be treated in different ways, for different purposes.

        The purpose of a video-surveillance system is the security of the property

private property and residents against external aggression (eg robbery with force in the
things).


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 3/6








The art. 5.1 c) RGPD provides the following: The personal data will be:

        “adequate, relevant and limited to what is necessary in relation to the purposes

for which they are processed ("data minimization").

It should be remembered that individuals are responsible for ensuring that the systems installed
felled comply with current legislation, proving that it complies with all
the requirements demanded by the regulations in force.


The installation of this type of device must have the mandatory informative sign.
tive, indicating the purposes and responsible for the treatment, where appropriate, of the data of each
personal character.

In any case, the cameras must be oriented towards the particular space, avoiding

intimidate neighboring neighbors with this type of device, as well as control areas
transit of the same without just cause.

With this type of device it is not possible to obtain image(s) of public space either.
co, as this is the exclusive competence of the State Security Forces and Bodies
ted.


It should be remembered that even in the case of a "simulated" camera, the same
should preferably be oriented towards private space, since it is considered
that this type of device can affect the privacy of third parties, that they are inti-
measured by it in the belief of being the subject of permanent recording.


        On the part of individuals, it is not possible to install devices for obtaining
images of public space, outside the cases allowed in the regulations.

                                             III


In accordance with the evidence available in this proceeding,
sanctioning act, it is considered that the claimed party has two chambers of
video-surveillance that affect public transit areas without just cause.


        The evidence provided (Doc. Annex I) allows verifying the presence of two
devices that are blatantly oriented towards the public sidewalk, affecting
rights of third parties without just cause, being a negligent conduct to the
effects of the administrative infraction.


Security cameras installed in private spaces will not be able to obtain images
public spaces, the security function of public spaces corresponding to
exclusively to the State Security Forces and Bodies, not to the Companies
Private Security companies.

        The known facts constitute an infraction, attributable to the party

claimed for violation of the content of art. 51. C) GDPR, cited above.

                                             IV


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 4/6








The art. 83.5 RGPD provides the following: “Infringements of the following provisions
will be sanctioned, in accordance with section 2, with administrative fines of 20
EUR 000,000 maximum or, in the case of a company, an equivalent amount.

to a maximum of 4% of the total global annual turnover of the financial year
above, opting for the highest amount:

        a) the basic principles for the treatment, including the conditions for the
            consent under articles 5, 6, 7 and 9;


When motivating the sanction, the following is taken into account:

        - the nature, seriousness and duration of the offence, taking into account the nature
nature, scope or purpose of the treatment operation in question, as well as
the number of interested parties affected and the level of damages suffered

fried; (art. 83.2 a) RGPD).

        - the intent or negligence in the infringement; (art. 83.2 b) RGPD), by not doing
have adopted the necessary measures to prevent the orientation of the cameras towards the
public sidewalk, the conduct described being at least slightly negligent.


The cameras are oriented towards the public transit area, exceeding the angle
collection necessary for the protection of the establishment, affecting rights
of third parties who are intimidated by them as they consider themselves to be recorded
for the same


In accordance with article 58.2 d) RGPD, the claimed party must clarify the reason
(s) of the installation of the system, as well as in its case that is captured with the same
(providing screen printing with date and time) or failing that, prove that
It is a simulated camera, providing a copy of the invoice, if applicable, of the same or
either proceed to reorient it exclusively towards the façade area of the

local.

        For all this, it is agreed to impose a sanction encrypted in the amount of €1,500,
offense located on the lower scale for this type of behaviour.

Therefore, in accordance with the applicable legislation and after assessing the graduation criteria

tion of the sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE BAR XXXX OFFICE, with NIF 49981173B, for an infraction

tion of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of
€1,500 (One thousand five hundred euros).

SECOND: ORDER the respondent so that within ONE MONTH from the notification
cation of this administrative act proceed to regularize the situation described reo-

orienting the cameras towards the façade area of their entertainment venue, accrediting such ex-
I tremble to this organism.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 5/6








THIRD: NOTIFY this resolution to THE BAR XXXX OFFICE and INFORM
MAR of the result of the actions to the claimant party A.A.A.


FOURTH: Warn the sanctioned party that he must make the imposed sanction effective once
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co-
of the Public Administrations (hereinafter LPACAP), within the term of payment
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,

of December 17, through its entry, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency
Department of Data Protection at the banking entity CAIXABANK, S.A.. In case of
Otherwise, it will be collected during the executive period.


Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
will be until the 20th day of the following month or immediately after, and if
is between the 16th and last day of each month, both inclusive, the term of the payment
It will be valid until the 5th of the second following month or immediately after.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
resents may optionally file an appeal for reconsideration before the Director
of the Spanish Agency for Data Protection within a month from the date of
the day following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court,

in accordance with the provisions of article 25 and section 5 of the additional provision
Final fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-
administrative, within a period of two months from the day following the notification
tion of this act, as provided for in article 46.1 of the aforementioned Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,

may provisionally suspend the firm resolution in administrative proceedings if the interested party
do states its intention to file a contentious-administrative appeal. If it is-
In this case, the interested party must formally communicate this fact in writing
addressed to the Spanish Agency for Data Protection, presenting it through the Re-
Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or to

through any of the other registers provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also transfer to the Agency the documentation
that proves the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious-administrative appeal
tive within two months from the day following the notification of this

resolution, would end the precautionary suspension.


                                                                                   938-131120
Sea Spain Marti
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 6/6










Director of the AEPD, P.O. the Deputy Director General for Data Inspection, Olga

Pérez Sanjuán, Resolution 4/10/2021








































































C/ Jorge Juan, 6 www.aepd.es

28001 – Madrid sedeagpd.gob.es