AEPD (Spain) - EXP202209175

AEPD - PS-00624-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 13 GDPR Article 22(3) LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:	29.07.2022
Decided:	01.09.2023
Published:	01.09.2023
Fine:	300 EUR
Parties:	n/a
National Case Number/Name:	PS-00624-2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	isabela_maria_rosal

The Spanish DPA fined a controller for providing incomplete information about the use of video cameras. Article 13 GDPR was breached since the sign contained no information about the identity of the controller nor how to exercise data subjects' rights.

English Summary

Facts

The data subject presented a complaint against the controller alleging that the video cameras installed on private property were also gathering images from a public space. Even though the Spanish DPA held that the public space filmed was not significant, the sign informing data subjects about the video cameras was insufficient.

Holding

The DPA held that there was a breach of Article 13 GDPR since the sign informing citizens about the video surveillance cameras did not present enough information. Even though there was a sign on the private property, it did not mention the identity of the controller nor provided information about how to exercise the data subjects' rights..

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/5








     File No.: EXP202209175



                RESOLUTION OF SANCTIONING PROCEDURE

From the procedure instructed by the Spanish Data Protection Agency and based
to the following

                                  BACKGROUND


FIRST: A.A.A. (hereinafter, the complaining party) dated July 29, 2022
filed a claim with the Spanish Data Protection Agency. The
claim is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the part
claimed). The reasons on which the claim is based are the following:


The complaining party states that the complained party is responsible for a camera
video surveillance that is oriented towards public roads, without authorization
prior administrative for this and without it being properly signposted
through the mandatory video surveillance area information signs.
Provides images of the camera location.


SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party, to
to proceed with its analysis and inform this Agency within a period of one month, of the

actions carried out to adapt to the requirements provided for in the regulations of
Data Protection.

The transfer, which was carried out in accordance with the rules established in Law 39/2015, of
October 1, of the Common Administrative Procedure of Administrations

Public (hereinafter, LPACAP), was collected on 09/14/2022, as stated in the
acknowledgment of receipt that appears in the file.

On 10/28/2022, this Agency received a written response indicating:

-That the claimed party is responsible for the video surveillance system.

-That the surveillance system is made up of two cameras.
-A photograph of the sign that warns of the existence of the area is attached.
video-surveillance.
-That the maintenance of the system has been contracted with the company ***COMPANY.1.
-That the recording of images is maintained for 7 days.


THIRD: On October 29, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the complaining party was admitted for processing.

FOURTH: On March 16, 2023, the Director of the Spanish Agency for

Data Protection agreed to initiate sanctioning proceedings against the claimed party,
for the alleged violation of Article 5.1.c) of the RGPD and Article 13 of the RGPD,
typified in Article 83.5 of the RGPD.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/5








FIFTH: The aforementioned initiation agreement has been notified in accordance with the rules established in
Law 39/2015, of October 1, on the Common Administrative Procedure of the
Public Administrations (hereinafter, LPACAP), the claimed party presented a written

of allegations in which, in summary, he stated:

-That the images captured by the “patio 1” camera are part of the property
of the identity without, at any time, affecting the promenade, beach or
include buildings.


       In this regard, this Agency points out that, having studied the documents on record
       in the file, mainly the images that correspond to the space
       captured by the cameras, it is not observed, in fact, that they affect excessively
       considered contrary to data protection regulations, to public areas
       or adjacent buildings. The alleged allegation is therefore accepted and we proceed to

       archive the infringement alleged by article 5.1.c of the RGPD.

-That he does not agree with the imputation of the infraction to the provisions of the
article 13 RGPD since the precise and regulatory information is included, the poster being
provided by the company in charge of maintaining the video surveillance system.


        In this regard, this Agency points out that, although in the photo provided with the
       response to the transfer, a zone warning sign is indeed observed
       video-surveillance, this does not comply with the requirements established in article 22.4
       of the LOPDGDD, since neither the identity of the person responsible nor the
       possibility of exercising the rights provided for in articles 15 to 22 of the

       GDPR

-That, currently, there are no cameras installed on the property as a result of
the works that are being carried out on the property. This point is credited with the
photographs that, as annexes, are attached.


       In this regard, this Agency points out that, although currently it is not
       observe installed video surveillance cameras, if there were any at the time of
       present the claim by the complaining party, for which it is appreciated
       breach of the aforementioned article 13 of the RGPD, although, logically, it is not
       measures will be imposed in relation to the need to complete the information

       provided on the posters, since currently no
       data treatment.

SIXTH; On April 26, 2023, a proposed resolution was formulated,
proposing:


That the Director of the Spanish Data Protection Agency sanction
B.B.B., with NIF ***NIF.1, for a violation of Article 13 of the RGPD, typified in the
Article 83.5 of the RGPD, with a fine of €300 (Three hundred euros).


SEVENTH: Postal notification of the proposed resolution was attempted, it has not been
collected at the address of the claimed party, the acknowledgment of receipt being returned with
the result “absent”.
No allegations have been presented to the proposed resolution.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/5









In view of everything that has been done, by the Spanish Data Protection Agency
In this procedure, the following are considered proven facts:


                                 PROVEN FACTS

FIRST: It is proven that, at the time of filing the claim, the
claimed party had video surveillance cameras installed on its property, although
From the images of their field of vision it is clear that they do not capture

images of public roads, at least not in excess that is punishable, according to the regulations
of data protection, nor adjacent buildings.

SECOND: It is proven that, although according to the image provided by the party
claimed, there are signs warning of the existence of video cameras, the information

that they provide is insufficient and does not meet the requirements demanded by the article
22 of the LOPDGDD, as it does not contain either the identity of the person responsible or the
possibility of exercising the rights provided for in articles 15 to 22 of the RGPD.

                            FOUNDATIONS OF LAW


                                             Yo
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on Protection of Personal Data and

guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures

processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."



                                            II
The installation of a video camera entails the unavoidable obligation to warn of the
sence of it through an informative device, in a sufficiently visible place.

ble, identifying at least the existence of the treatment, the identity of the person responsible, and
the possibility of exercising the rights provided for in articles 15 to 22 of the GDPR.

In the present case, although the claimed party has provided a photograph of a poster

placed next to the cameras, it is observed that it does not comply with all the requirements.
requirements established for this purpose in article 22 of the LOPDGDD, as it is incomplete and
the information provided is sufficient.


Therefore, it is considered that the facts presented violate the provisions of the
Article 13 of the RGPD, which means the commission of an offense classified in the
Article 83.5 of the GDPR, which provides the following:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/5









       “Infringements of the following provisions will be sanctioned, according to
       with paragraph 2, with administrative fines of EUR 20 000 000 as

       maximum or, in the case of a company, an amount equivalent to 4%
       maximum of the overall total annual turnover of the financial year
       above, opting for the highest amount:

        (…)
       b) the rights of the interested parties under articles 12 to 22; (…)”.


For the purposes of the limitation period, article 74 “Infringements considered minor” of
The LOPDGDD indicates:

       “The remaining infractions of violations are considered minor and will expire after one year.”
       purely formal nature of the articles mentioned in sections 4 and
       5 of article 83 of Regulation (EU) 2016/679 and, in particular, the following:
       a) Failure to comply with the principle of transparency of information or the
       right to information of the affected person for not providing all the required information

       by articles 13 and 14 of Regulation (EU) 2016/679.
       (…)”


                                          III

In light of the facts presented, it is considered that it is appropriate to impute a sanction to
the party claimed for the violation of Article 13 of the GDPR typified in Article
83.5 of the GDPR. The sanction that must be imposed is an administrative fine for
an amount of 300 euros (THREE HUNDRED EUROS)


Therefore, in accordance with the applicable legislation and evaluated the criteria of
graduation of sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE B.B.B., with NIF ***NIF.1, for a violation of Article 13
of the RGPD, typified in Article 83.5 of the RGPD, a fine of 300 euros

(THREE HUNDRED EUROS)

SECOND: NOTIFY this resolution to B.B.B..

THIRD: Warn the sanctioned person that he must make the sanction imposed effective

once this resolution is executive, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,

of December 17, by entering it, indicating the NIF of the sanctioned person and the number
of procedure that appears in the heading of this document, in the account
restricted IBAN number: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code:
CAIXESBBXXX), opened on behalf of the Spanish Data Protection Agency in
the banking entity CAIXABANK, S.A.. Otherwise, it will be
collection in executive period.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/5








Once the notification is received and once enforceable, if the enforceable date is
between the 1st and 15th of each month, both inclusive, the deadline to make the payment

voluntary will be until the 20th of the following month or immediately following business month, and if
The payment period is between the 16th and last day of each month, both inclusive.
It will be until the 5th of the second following or immediately following business month.

In accordance with the provisions of article 50 of the LOPDGDD, this

Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the

Director of the Spanish Data Protection Agency within a period of one month to
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the

Contentious-administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,

may provisionally suspend the final resolution through administrative channels if the
interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-

web/], or through any of the other registries provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the

notification of this resolution would terminate the precautionary suspension.


                                                                                938-010623
Sea Spain Martí
Director of the Spanish Data Protection Agency
















C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es