AEPD (Spain) - PS/00393/2021

AEPD - PS/00393/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1) GDPR Article 13 GDPR Art. 22 LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	07.06.2022
Fine:	3000 EUR
Parties:	n/a
National Case Number/Name:	PS/00393/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Sergi Ariño Mayans

The Spanish DPA fined a restaurant owner €3,000 for installing CCTV cameras to monitor the public space outside the restaurant which included a neighbor's front door.

English Summary

Facts

An individual lodged a complaint with the Spanish DPA (AEPD) alleging that the owner of a restaurant across the street had installed a hidden video surveillance camera that recorded the public space outside the restaurant, including complainant's front door, at all hours. The owner of the cameras claimed that they were installed for security purposes after there thefts in the area but provided no documentation to substantiate that claim.

Holding

The AEPD held that the cameras constituted excessive surveillance and imposed a fine of €2,000 on the controller for violating the principle of data minimisation in Article 5(1)(c) GDPR. The AEPD fined the controller an additional €1,000 for failing to provide adequate signage in compliance with Article 13 GDPR. The AEPD noted that it is the responsibility of the controller to make sure surveillance cameras are set up in a lawful manner. Surveillance cameras must be oriented towards private property to avoid excessive recording; recording public spaces is an exclusive competence of the Spanish state. Furthermore, cameras must be accompanied by signage indicating their presence, the purpose of surveillance, and the identy of the controller. This is true even in the case of a "simulation" camera which might lead to third parties believe that they are being permanently recorded.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/7










     File No.: PS/00393/2021


                RESOLUTION OF PUNISHMENT PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


                                       FACTS

FIRST: A.A.A. (*hereinafter, the complaining party) dated April 12, 2021
filed a claim with the Spanish Data Protection Agency. The
claim is directed against LODEJU, S.L. with NIF B92047745 (hereinafter, the part

claimed). The grounds on which the claim is based are as follows:

       "He has placed hidden among the plants a camera with a colored casing.
white as indicated in the attached photo. This camera is oriented towards the door.
entrance door of my house (...)”-folio nº 1--.


       “Finally, I want to express that in our case we found out about the existence
ence of said chambers by the same claimed. Because on March 17,
2021 sends a WhatsApp to my husband, expressing that he has cameras recording the
24 hours (I enclose the screenshot of said conversation”.—folio nº 1--.


       Together with the claim, it provides documentary evidence (Annex I) that proves the
presence of the device, as well as images obtained from the device in question.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in

hereinafter LOPDGDD), said claim was transferred to the claimed party in fe-
cha 04/30/21 and 06/24/21, to proceed to its analysis and inform this Agency
within a month, of the actions carried out to adapt to the requirements
provided for in the data protection regulations.

       No response to this letter has been received, nor has any reasoned explanation been

has made on the device in question.

THIRD: On July 27, 2021, the Director of the Spanish Agency for Pro-
Data protection agreed to admit for processing the claim presented by the claimant party.
keep.


FOURTH: On September 10, 2021, the Director of the Spanish Agency
of Data Protection agreed to initiate sanctioning procedure to the claimed, with
in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,

LPACAP), for the alleged infringement of Article 5.1.c) of the RGPD, typified in the
Article 83.5 of the RGPD.

FIFTH: The database of this Agency consulted on 10/20/21 has not been

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 2/7








received any allegation in this regard, nor has the reason for the installation of
the camera(s).


SIXTH: On 10/21/21, the collaboration of the Security Forces and bodies is requested.
Security of the town (Marbella-Málaga City Council) so that displaced people
place of the facts verify the presence and operability of the cameras object of
claim.

SEVENTH: On 11/02/21 a Local Police Report (Marbella-Málaga) was received in

where Don B.B.B., responsible for the
Shop (...) and Restaurant (...).

       The reasons for the installation of the cameras are security reasons for the
establishment(s) of its ownership as a result of "thefts" that occurred in the area, without further

specs.

       Images are provided where the capture of public space in the
outside area of tables of the hotel establishment (Page No. 5-6 Police Report
Local-Marbella 01/11/21).


       Item, documentary evidence is provided that proves the presence of a cartel(s) yes
well in the same one only informs about the installation, not being posters approved to
current regulations in force, not identifying the data controller.

EIGHTH: On 01/17/22, a “Resolution proposal” was issued, considering

accredited the presence of cameras that excessively record public space,
without proper signage, which is why a sanction of
three thousand euros (€3,000), for the infringement of articles 5.1 c) and 13 RGPD.

Of the actions carried out in this procedure and the documentation

in the file, the following have been accredited:

                                PROVEN FACTS

First. The facts bring cause of the claim dated 04/12/21 through the
which translates the following "he has placed hidden among the plants a camera with

a white casing as indicated in the attached photo. This camera is
oriented towards the entrance door of my house (...)”-folio nº 1--.

       “Finally, I want to express that in our case we found out about the existence
ence of said chambers by the same claimed. Because on March 17,

2021 sends a WhatsApp to my husband, expressing that he has cameras recording the
24 hours (I enclose the screenshot of said conversation”.—folio nº 1--.

       Together with the claim, it provides documentary evidence (Annex I) that proves the
presence of the device, as well as images obtained from the device in question.


Second. It is identified as the main person in charge of the installation Don B.B.B.,
as reflected in the Local Police report (Marbella) dated 11/01/21.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 3/7








Third. It is proven that the person claimed does not have an informative badge in the area
visible informing that it is a video-monitored area, indicating the "responsible
of the treatment” or the purpose of capturing the images.


Fourth. The presence of video-surveillance devices that affect
to a public area without just cause, exercising a control reserved to the Forces and
State security forces, obtaining images of public space where
Various tables have been placed next to the Restaurant establishment (...).


Fifth. No documentation has been provided that proves the theft.
or other types of acts that justify, in the judgment of this body, the presence of
cameras.
                            FOUNDATIONS OF LAW


                                             Yo

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and according to the provisions of articles 47 and 48 of the LOPDGDD, the Director
of the Spanish Agency for Data Protection is competent to initiate and to re-
solve this procedure.

                                            II

In the present case, the claim dated 04/12/21 is examined by me-
gave from which the following is transferred as the main "fact":


       "He has placed hidden among the plants a camera with a colored casing.
white as indicated in the attached photo. This camera is oriented towards the door.
entrance door of my house (...)”-folio nº 1--.

The art. 5.1 c) RGPD provides the following: The personal data will be:


       “adequate, relevant and limited to what is necessary in relation to the purposes
for which they are processed ("data minimization").

It should be remembered that individuals are responsible for ensuring that the systems installed

felled comply with current legislation, proving that it complies with all
the requirements demanded by the regulations in force.

The installation of this type of device must have the mandatory informative sign.
tive, indicating the purposes and responsible for the treatment, where appropriate, of the data of each

personal character.

In any case, the cameras must be oriented towards the particular space, avoiding
intimidate neighboring neighbors with this type of device, as well as control areas
transit of the same without just cause.


With this type of device it is not possible to obtain image(s) of public space either.
co, as this is the exclusive competence of the State Security Forces and Bodies
ted.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 4/7








It should be remembered that even in the case of a "simulated" camera, the same
should preferably be oriented towards private space, since it is considered
that this type of device can affect the privacy of third parties, that they are inti-

measured by it in the belief of being the subject of permanent recording.

       On the part of individuals, it is not possible to install devices for obtaining
images of public space, outside the cases allowed in the regulations.

                                            III


In accordance with the evidence available in this proceeding
sanctioning party, it is considered that the claimed party has a chamber(s) of
video-surveillance with which it controls the public sidewalk "processing third-party data" without
justified cause, lacking proper signage.


       The known facts constitute an infraction, attributable to the party
claimed, for violation of the content of art. 5.1 c) GDPR.

       Item, the establishment lacks an informative sign indicating that it is
a video-monitored area, in such a way that passers-by are unaware that it is

of a video-monitored area, the data being processed by a camera
conveniently simulated.

       So that the exposed facts suppose a violation of art. 13
RGPD, lacking a duly approved informative label, indicating the res-

responsible for the treatment or the purpose(s) of the treatment carried out with the device
in question.

       Article 22 of Organic Law 3/2018 (December 5)-LOPDGDD- provides:


       "1. Natural or legal persons, public or private, may carry out the
processing of images through camera systems or video cameras with the purpose of
to preserve the safety of people and property, as well as its installations.
nes.

       The AEPD, in a related report, stipulates that it is not necessary for car-

TVs are placed just below the cameras. It is enough to do it in a visible place and
that includes open and closed spaces where the video camera circuit is
operative.
       This badge will be displayed in a visible place, and at least, at the entrances to the
monitored areas whether indoors or outdoors. In the event that the video surveillance space

If it has several entrances, it must have said video zone badge.
gilada in each of them.

       The fact that the owner of the hotel activity has a License for
terrace, does not justify the installation of a video-surveillance system that controls the an-

public space, this being a task reserved for the Police Forces and Corps.
Security of the Town, who are the ones who have to video-monitor the space, if applicable
public.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 5/7








        Remember that the cameras must be oriented (vgr in the case of the store)
da) at most to the facade of the same to avoid as a guideline the breakage of the
storefront or towards the main points of access to it, while the interiors

must be marked with an informative poster indicating the presence of the same
more to the potential clients of the same.
                                            IV

The art. 83.5 RGPD provides the following: “Infringements of the following provisions
will be sanctioned, in accordance with section 2, with administrative fines of 20

EUR 000,000 maximum or, in the case of a company, an equivalent amount.
to a maximum of 4% of the total global annual turnover of the financial year
above, opting for the highest amount:

        a) the basic principles for the treatment, including the conditions for the

           consent under articles 5, 6, 7 and 9;
        b) the rights of the interested parties under articles 12 to 22 (…)

When motivating the sanction, the following is taken into account:

        - the nature, seriousness and duration of the offence, taking into account the nature

nature, scope or purpose of the treatment operation in question, as well as
the number of interested parties affected and the level of damages suffered
fried; (art. 83.2 a) RGPD).

        - the intent or negligence in the infringement; (art. 83.2 b) RGPD), to the proce-

to obtain images of a public area, whose competence is reserved to the
State Security Forces and Bodies, being the same considered a negligence
serious agency for the reasons stated.

The cameras are oriented towards the public transit area, exceeding the angle

collection necessary for the protection of the establishment, affecting rights
of third parties who are intimidated by them as they consider themselves to be recorded
by them, not being the same informed with the presence in visible area of
informative poster(s) about it.

        So it is considered correct to impose a sanction encrypted in the amount

€2,000 (two thousand euros) for the violation of art. 5.1 c) GDPR and €1,000 (Thousand euros)
for the infringement of art. 13 RGPD, lacking the required signage, being the
total sum of both amounts €3000 (three thousand euros), sanction located on the scale
lower for this type of behavior.


Therefore, in accordance with the applicable legislation and after assessing the graduation criteria
tion of the sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: IMPOSE the company LODEJU, S.L., with NIF B92047745, for an in-
fraction of Article 5.1.c) and 13 of the RGPD, typified in Article 83.5 of the RGPD, a
fine of €3,000 (three thousand euros).


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 6/7








SECOND: NOTIFY this resolution to the entity LODEJU, S.L. (major
responsible Don B.B.B.).


THIRD: Warn the sanctioned party that he must make the imposed sanction effective once
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co-
of the Public Administrations (hereinafter LPACAP), within the term of payment
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,

of December 17, through its entry, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency
Department of Data Protection at the banking entity CAIXABANK, S.A.. In case of
Otherwise, it will be collected during the executive period.


Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
will be until the 20th day of the following month or immediately after, and if
is between the 16th and last day of each month, both inclusive, the term of the payment
It will be valid until the 5th of the second following month or immediately after.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
resents may optionally file an appeal for reconsideration before the Director
of the Spanish Agency for Data Protection within a month from the date of
the day following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court,

in accordance with the provisions of article 25 and section 5 of the additional provision
Final fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-
administrative, within a period of two months from the day following the notification
tion of this act, as provided for in article 46.1 of the aforementioned Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,

may provisionally suspend the firm resolution in administrative proceedings if the interested party
do states its intention to file a contentious-administrative appeal. If it is-
In this case, the interested party must formally communicate this fact in writing
addressed to the Spanish Agency for Data Protection, presenting it through the Re-
Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or to

through any of the other registers provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also transfer to the Agency the documentation
that proves the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious-administrative appeal
tive within two months from the day following the notification of this

resolution, would end the precautionary suspension.


                                                                                  938-270122
Sea Spain Marti
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 7/7











Director of the Spanish Data Protection Agency















































































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es