AEPD (Spain) - E/13223/2021

AEPD (Spain) - E/13223/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5 GDPR Article 32 GDPR Ley Orgánica 4/2015 de protección de la seguridad ciudadana Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales.
Type:	Complaint
Outcome:	Rejected
Started:	03.05.2021
Decided:
Published:	03.02.2022
Fine:	None
Parties:	n/a
National Case Number/Name:	E/13223/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Jennifer Vidal

The Spanish DPA held that, in the context of the Covid-19 pandemic, the registration of a data subject’s ID by a police officer, using a photograph taken with a cellphone owned by the police unit, did not violate the GDPR.

English Summary

Facts

A data subject filed a complaint with the Spanish DPA (AEPD) against the Local Police of the Municipal Council of La Puebla del Río, Seville after a police officer took a photograph of their ID with a cell phone. The data subject claimed that the device was privately owned by the police officer.

The context involved restrictive measures due to the Covid 19 pandemic, and the City of La Puebla del Río had its perimeter closed, with entry and exit controls for vehicles. The police officers managed to identify that the data subject was from a different location, and their ID was required and photographed, based on public safety regulatory legislation. The device was actually owned by the police unit, and was not the private property of the agent. Upon completion of police registration procedure, the photograph was removed from the device.

The purpose of taking the photograph was to obtain an image of the ID without physically handling it, and carry out the necessary checks in accordance with Article 16 of the Spanish Citizen Safety Law (Ley Orgánica 4/2015, de 30 de marzo, de protección de la seguridad ciudadana) to comply with specific health and security measures in the context of the pandemic.

Holding

The AEPD held that as long as data protection principles in the GDPR and the Spanish Data Protection Act (Ley Orgánica 3/2018 Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales - LOPDGDD) were observed, state security bodies could process data to achieve their inherent objectives, including prevention, investigation, detection or repression of criminal offenses. The AEPD concluded that in this case, given the exceptional context related to the pandemic, a police agent's use of a cell phone which is owned by the police unit to photograph ID documents complied with the security measures established in Article 32 GDPR, and therefore dismissed the case.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/6








     File No.: E/13223/2021

                   RESOLUTION OF FILE OF ACTIONS


Of the actions carried out by the Spanish Data Protection Agency before
the CITY COUNCIL OF LA PUEBLA DEL RÍO- Seville, Local Police, (hereinafter, “the
claimed party"), by virtue of the claim filed by D. AAA, (hereinafter,
“the claimant party”), and based on the following:


                                       ACTS

FIRST: On 05/03/21, this Agency received a document submitted by
the claimant, in which he indicated, among others, the following:


“The local police of Puebla del Río, in a police control, on the afternoon of Sunday, March 2,
May, with his mobile he took a photograph of my ID, without any explanation.

SECOND: On 05/28/21 and 06/09/21, this Agency addressed
two separate documents requesting information on the claim received, to the City Council
de la Puebla del Rio, (Local Police), in accordance with the provisions of article

65.4 of Organic Law 3/2018, of December 5, on the protection of personal data
and guarantee of digital rights, (“LOPDGDD”).

THIRD: On 07/29/21, the Local Police of Puebla del Rio, sends to this
Agency written response, in which, among others, indicates the following:


“That during the afternoon shift on 05/02/21 the agents were ready to
surveillance of compliance with the limitations and restrictions in force in the D. Law
21/2020, of August 4, which establishes the sanctioning regime for the
non-compliance with the prevention and containment measures applicable in Andalusia

before COVID-19, in accordance with the Decree of the President 13/2021, of 22 of
April, which extends the measures established in Decree 9/2021, of 18
March, which establishes measures in the area of the autonomous community of
Andalusia in application of R.D. 926/2020 of October 25, which declares the
state of alarm to contain the spread of infections caused by SARS-
VOC-2.


That the town of La Puebla del Río was closed at that time
perimeter, with which, the agents prepared to control entry and exit
of vehicles in the polygon of the municipality. When a vehicle is stopped, being
identified its driver, being these agents of the authority totally

authorized to request or take data from people for reasons of
investigation, preventive or for those cases that occur in the context of
that the individual may be incurring in some type of illegality or infraction of the
law, in accordance with Organic Law 4/2015. March 30, Security Protection
Citizen, which establishes in its articles 16.1 and 9.2, that citizens must

It is mandatory to provide your personal data or ID when the agents of the
Security Forces and Bodies require their identification when there are indications
that they have been able to participate in the commission of an offense and when it is considered
reasonably necessary to prove your identity to prevent the commission of a

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 2/6








crime. All this in accordance with the provisions of Organic Law 3/2018, of 5
December, Protection of Personal Data and Guarantee of Digital Rights, the
European Directive 2016/680, of April 27, 2016.


That at that moment he is informed of the reason for his stop, stating, being
this gentleman from a different locality, in this case from the municipality *** LOCATION.1
(Sevilla), who is informed of the prohibition that at that time was the
municipality where it was located, being also informed that it would be proposed for
sanction.


However, your National Identity Document is requested to be identified
fully, taking the photo of the DNI with the mobile device belonging to the
body of this local police headquarters taking into account the existing circumstances and
not doing as this man exposes with a private mobile in order to protect and

guarantee that said procedure complies with the measures of confidentiality and
security established for the protection of data and personal information, such as
establishes article 5 of the RGPD

When our work of inspection, identification and sanction is finished, we proceed to
the elimination of the photograph of our mobile device belonging to this

Corporation, to ensure that the security measures continue to be guaranteed.
confidentiality and security established for the protection of personal data”.

FOURTH: On 09/27/21, by the Director of the Spanish Agency for
Data Protection agreement is issued for the admission of claims processing

presented, in accordance with article 65 of the LPDGDD Law, having appreciated
possible rational indications of a violation of the rules in the field of
powers of the Spanish Data Protection Agency.

                           FOUNDATIONS OF LAW


                                    I.- Competition:

By virtue of the powers that article 58.2 of Regulation (EU) 2016/679, of the Parliament-
European Act and of the Council, of 04/27/16, regarding the Protection of Natural Persons
regarding the Processing of Personal Data and the Free Movement of es-

Data (RGPD) recognizes each Control Authority and, as established in the
art. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of
Personal Data and Guarantee of Digital Rights (LOPDGDD), the Director of the
Spanish Data Protection Agency is competent to resolve this procedure.
I lie.


Sections 1) and 2), of article 58 of the RGPD, list, respectively, the
investigative and corrective powers that the supervisory authority may provide to the
effect, mentioning in point 1.d), that of: "notifying the person in charge or in charge of the
treatment of alleged infringements of these Regulations” and in 2.i), that of:

“impose an administrative fine under article 83, in addition to or instead of the
measures mentioned in this section, according to the circumstances of each
case."


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 3/6








II.- Summary of the facts:

According to the claimant, in a control carried out by the Local Police of the town of the
Puebla del Rio (Seville), on 05/02/21, the agents required him to
they will identify When he showed them his ID, one of the agents took a photograph of the

document and returned it.

    - For its part, the Local Police of the town of Puebla del Rio indicates, in its
        written response to this Agency, several things to take into account in
        this case:


    - That the police control was carried out in compliance with the limitations and
        restrictions in force in Decree Law 21/2020, of August 4, which establishes
        establishes the sanctioning regime for non-compliance with the measures of
        prevention and containment applicable in Andalusia against COVID-19.


    - That the town of La Puebla del Río (Seville), was at that time
        closed perimeter for cases of contagion, with which, the agents are
        They arranged to control the entry and exit of vehicles from the town.

    - That these agents were authorized to request and take data from the
        persons in accordance with Organic Law 4/2015. of March 30, Protection

        of Citizen Security, (articles 16.1 and 9.2.)

    - That the respondent is informed of the reason for his stop, being this Mr.
        a town other than Puebla del Rio, so you are informed of the
        prohibition that at that time was the municipality where
        found and that he will be proposed for sanction for it.


    - That your ID is requested to be identified, taking a photograph of your
        DNI with the mobile device belonging to the Local Police Headquarters, in
        compliance with the security measures established by the pandemic.

    - That when the police work was finished, the photograph was removed

        of the mobile device.

III.- About the possible infringement of the RGPD by taking the photograph of the DNI of the
claimant with a mobile phone by the Local Police of Puebla del Rio.

As established in section III of the "Preamble" of Organic Law 4/2015, of

March 30, protection of citizen security (LOPSC), "(...) the
competent authorities to agree on different actions aimed at the
maintenance and, where appropriate, the restoration of citizen tranquility in
assumptions of public insecurity, regulating with precision the budgets, the
and the requirements to carry out these procedures, in accordance with the principles, among

others, of proportionality, minimal interference and non-discrimination (...)”.

And so they are established in articles 9.2 and 16.1 of the LOPSC, regarding the obligation
to display and allow verification of the DNI by agents of the Forces and
State Security Corps:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 4/6









In article 9, on the obligations and rights of the holder of the National Document
of Identity, indicates that:


"two. All persons required to obtain the National Identity Document
they are also to exhibit it and allow the verification of the security measures to
those referred to in section 2 of article 8 when required to do so by the
authority or its agents, for the fulfillment of the purposes set forth in section 1
of article 16. You must report your theft or loss as soon as possible.

possible to the nearest Police station or post of the Security Forces and Bodies
next".

In its article 16, on the identification of persons, it is established that:


1. In the fulfillment of its functions of criminal investigation and prevention, as well as
for the sanction of penal and administrative infractions, the agents of the Forces
and Security Bodies may require the identification of the persons in the
following assumptions: a) When there are indications that they may have participated in the
commission of an offence. b) When, in view of the concurrent circumstances,
it is considered reasonably necessary to prove their identity to prevent the

commission of a crime. In these cases, the agents may carry out the
necessary checks on public roads or in the place where the
requirement, including the identification of persons whose face is not fully visible
or partially for using any type of garment or object that covers it, preventing or
making identification difficult, when necessary for the indicated purposes.


In the practice of identification, the principles of
proportionality, equal treatment and non-discrimination based on birth,
nationality, racial or ethnic origin, sex, religion or belief, age, disability,
sexual orientation or identity, opinion or any other condition or circumstance

personal or social.

Therefore, the State Security Forces and Bodies can process the data
of citizens for the prevention, investigation, detection or
prosecution of criminal offenses and for the performance of the functions of
public interest that are their own. However, these treatments must be

carried out respecting at all times, what is established in the regulations in force in
matter of protection of personal data, the RGPD and the LOPDGDD,
respectively.

The GDPR, in its article 32, requires data controllers to adopt

the corresponding security measures of a technical and organizational nature
necessary to guarantee that the treatment is in accordance with current regulations, as well as
such as ensuring that any person acting under the authority of the controller or
of the person in charge and has access to personal data, they can only be processed following their
instructions.


Thus, in the present case, the collection of the personal data of a citizen for its
identification, by the agents of the Local Police, must be carried out with


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 5/6








technical and organizational methods that guarantee the security and confidentiality of
these, following the instructions of the data controller.


In the present case, the Local Police of Puebla del Rio affirms that said photograph
was made with an official mobile phone belonging to the Local Police Headquarters
with the sole purpose of taking an image of the identity document and with it
carry out the appropriate checks in accordance with article 16 of LO 4/2015, of
March 30, protection of citizen security, avoiding the manipulation of the
document, thereby complying with the health security measures established by

the exceptional situation that was taking place.

In addition to all this, we must take into account the fact that it was advised
take extreme precautions and speed up interventions as much as possible due to the situation
health emergency, using an exceptional means of identification such as

take pictures with an official mobile phone belonging to the Local Police,
made it possible, in the identification work, to reduce the interpersonal contact between the
identified person and agents. All this together with the fact that, once the
necessary verifications in the identification, the images taken with the mobile
were erased without leaving any trace in any police file, according to
confirms the police themselves.


Therefore, based on the evidence available at this time,
considers that the use of the official mobile phone of the acting unit for the decision
of a photograph of the claimant's DNI complies with the security measures that
marks article 32 of the RGPD, in the exceptional situation that was being

producing.

Therefore, by the Director of the Spanish Data Protection Agency,

                                     HE REMEMBERS:


FIRST: PROCEED TO FILE these proceedings.

SECOND: NOTIFY this resolution to the CITY COUNCIL OF LA PUEBLA
DEL RÍO- Seville, Local Police, and D. A.A.A.,


In accordance with the provisions of article 50 of the LOPDGDD, this Re-
The solution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure

Common to Public Administrations, and in accordance with the provisions of the
art. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may inter-
optionally file an appeal for reconsideration before the Director of the Spanish Agency
Data Protection Regulation within a month from the day following the
notification of this resolution or directly contentious-administrative appeal before

the Contentious-administrative Chamber of the National High Court, in accordance with the provisions
placed in article 25 and in section 5 of the fourth additional provision of the Law
29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, in the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 6/6










period of two months from the day following the notification of this act,

in accordance with the provisions of article 46.1 of the aforementioned Law.




Sea Spain Marti

Director of the Spanish Agency for Data Protection.





























































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es