AEPD (Spain) - PS/00272/2019

AEPD - PS/00272/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 12 GDPR Article 13 GDPR Article 83(5) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	12.03.2020
Fine:	-3 EUR
Parties:	COMUNIDAD DE PROPIETARIOSR.R.R
National Case Number/Name:	PS/00272/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES) (in ES)
Initial Contributor:	n/a

The Spanish Data protection authority (the AEPD) imposed a 2,000 € fine for unlawful recording of personnal data throug surveillance cameras on a building facade.

English Summary

Facts

The claimant filed a complaint with the AEPD against the defendant for installing surveillance cameras on the building facade which are directed at common and transit areas, without any authorization from the owners’ cooperative. Moreover, the information poster installed next the surveillance cameras does not procedure for sufficient information regarding the controller of the processing. It is acknowledged that the surveillance cameras processe personal data as there are recording clear images of natural persons.

Dispute

The AEPD had to examine whether the recording of personal data carried through the video surveillance system is in accordance with the GDPR. Especially, if the installation of surveillance camera is contrary to the data minimisation principle, under Article 5(1)(c) GDPR.

Holding

First, the AEPD reminded that surveillance cameras installed by individuals cannot record images/sound from third party conversations, or affecting their privacy, unless there are less invasive measures necessary to protect the property. Also, it specified that the installation of a video surveillance system which may record partially the public area security could be lawful only it is indispensable for the achievement of security purposes or if it is impossible to avoid it due to the location of the cameras to the extent that the minimum space for that purpose is collected. Finally, the AEPD also mentioned that, pursuant to Articles 12 and 13 GDPR, the information related to the processing has to be sufficiently visible, and must include he controller’s identity, the purposes of the processing and the possibility of exercising the rights provided under the GDPR.

Then, in the situation based on the claim, the APED hold that the controller should have informed the President of the owners’ cooperative and that the recording must not affect common areas. Also, it must have an approved sign, indicating the controller's identity and an effective address to which it can be directed.

Therefore, by having installed some surveillance cameras without any appropriate safeguard, the controller infringed Article 5(1)(c) GDPR. In addition, the controller infringed Article 12 because he prevented the data subject to effectively exercised theirs rights under Articles 15 to 22 GDPR.

As a consequence, the APED imposed a 12,000 € fine to the controller

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Page 1
1/7
 Procedure No.: PS / 00272/2019
938-051119
RESOLUTION OF PENALTY PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following
ACTS
FIRST: On April 9, 2019, he had entry into this Spanish Agency of
Data Protection a letter submitted by COMMUNITY OF OWNERS
RRR (hereinafter the claimant), by means of which he claims against
AAA with NIF *** NIF.1 (hereinafter, the claimed), for the installation of a system
video surveillance installed at *** ADDRESS.1, there are indications of a possible
breach of the provisions of art. 5.1 c) RGPD.
The reasons underlying the claim and, where appropriate, the documents
contributed by the claimant are the following:
“Place cameras on the façade facing common areas, stairs and corridors,
recording all the comuneros who pass by ”(folio nº 1).
SECOND: Prior to the admission for processing of this claim,
transferred the claimed, in accordance with the provisions of article 65.4 the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD). The result of this action is
described below.
"It does not make any reply to the request of this body"
THIRD: The claim was admitted for processing through a resolution of July 10
of 2019.
FOURTH: On October 25, 2019, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning procedure to the claimed, by the
alleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the
RGPD.
FIFTH: Consulted the database of this Agency on 02/13/20 it has not been
received any allegation in this regard in relation to the system under complaint.
In view of everything that has been done by the Spanish Protection Agency
Data in the present procedure, the following are considered proven facts,
ACTS
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 2
2/7
First. On 04/09/19, a complaint was received at this Agency from the denounced-
cient through which the following is transferred as the main fact:
“Place cameras on the façade facing common areas, stairs and corridors,
recording all the comuneros who pass by ”(folio nº 1).
The complaining party certifies the installation of the device on the facade of the
real estate, without the authorization of the set of owners. (Evidentiary Doc
No. 1).
Second . Don AAA is identified as the main person in charge .
Third. It is proven that it has proceeded to install a
video surveillance on the facade of the property, oriented towards transit areas, without
any authorization from the Board of owners.
With the installed device, images are obtained according to the orientation of the
same of the corridor area through which you access your home.
Fourth . The person responsible is not informed in the informative poster (Probatory Doc. No. 2)
of the treatment, nor any effective address is provided to which, where appropriate, to go.
FUNDAMENTALS OF LAW
I
By virtue of the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), recognizes each
Control Authority, and as established in articles 47, 48.1, 64.2 and 68.1 of the
LOPDGDD, the Director of the Spanish Agency for Data Protection is competent
you to start and solve this procedure.
II
In the present case, the complaint dated 09/04/19 is examined by
gave of which the following is transferred as the main fact:
“Place cameras on the façade facing common areas, stairs and corridors,
recording all the comuneros who pass by ” (folio nº 1).
The physical image of a person, according to article 4.1 of the RGPD, is a piece of information
personal and their protection, therefore, is object of said Regulation. In Article 4.2
The RGPD defines the concept of "treatment" of personal data.
It is, therefore, pertinent to analyze whether the processing of personal data (image
of natural persons) carried out through the video surveillance system reported
This is in accordance with the provisions of the RGPD.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 3
3/7
The cameras installed by individuals cannot be oriented towards the area
exclusive to third parties, obtaining images / sound from third party conversations, by
affect your privacy, apart from the fact that there are less invasive protection measures
of the property, if necessary.
The facts described suppose an affectation to article 5.1 c) RGPD “The data-
Personal coughs will be:
c) adequate, pertinent and limited to what is necessary in relation to the purposes
for which they are processed ("data minimization").
The individuals who install this type of device are responsible for
it complies with current legislation, and must comply with the established requirements-
also cited in the Horizontal Property Law (LPH).
III
In accordance with the aforementioned, the treatment of images through a system
subject of video surveillance, to be in accordance with current regulations, you must comply with the
following requirements:
- Respect the principle of proportionality.
- When the system is connected to a central alarm, you can only
be installed by a private security company that meets the required requirements
set forth in article 5 of Law 5/2014 on Private Security, of April 4.
- Camcorders will not be able to capture images of people who are
are outside the private space where the video surveillance system is installed-
cia, since image processing in public places can only be performed,
unless there is governmental authorization, by the Security Forces and Bodies.
Neither can spaces owned by third parties be captured or recorded without the consent
ment of their owners, or, where appropriate, of the people who are in them.
This rule admits some exceptions since, on some occasions, for the
tection of private spaces, where cameras have been installed on facades or in the
indoor, it may be necessary to ensure the security purpose of recording
a portion of the public highway. In other words, the cameras and video cameras installed with
Security authorities will not be able to obtain images of public roads unless it is impossible
dispensable for this purpose, or it is impossible to avoid it due to the location of
those and, extraordinarily, the minimum space for said fin-
quality. Therefore, cameras could exceptionally capture the smallest portion-
mind necessary for the intended security purpose.
- The duty to inform the affected parties as provided in the articles must be fulfilled.
12 and 13 of the RGPD, resulting from application -in not contradicting the provisions of the
said Regulation-, the way provided for in article 3 of Instruction 1/2006, of 8
November, from the Spanish Agency for Data Protection, on the Treatment
of Personal Data for Surveillance Purposes through Camera or Video Systems
of cameras.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 4
4/7
Specifically, at least a different distinction must be placed in the video-monitored areas.
informative sign located in a sufficiently visible place, both in open spaces
as closed, which will identify, at least, the existence of a treatment, the
identity of the person responsible and the possibility of exercising the rights provided for in said
precepts. Likewise, the information must be kept available to those affected
to which the aforementioned GDPR refers.
- The person responsible must keep a record of treatment activities
carried out under his responsibility in which the information he makes is included
Reference article 30.1 of the RGPD.
- The installed cameras cannot obtain images of private space of
third and / or public space without duly accredited justified cause, nor can
affect the privacy of passers-by who freely pass through the area. It is not per-
therefore, the placement of cameras towards the private property of neighbors with
the purpose of intimidating them or affecting their private environment without just cause.
- In no case will the use of surveillance practices be accepted beyond the
lathe object of the installation and in particular, not being able to affect public spaces
Surrounding buildings, adjoining buildings, and vehicles other than those that access the space
monitored.
In relation to the aforementioned, to facilitate the consultation of those interested, the Agency
Spanish company for Data Protection offers through its website
[https://www.aepd.es] access to the legislation on personal data protection-
, including the RGPD and the LOPDGDD (section “Reports and resolutions” / “norms
mativa ”), as well as the Guide on the use of video cameras for security and other
as well as the Guide for the fulfillment of the duty to inform (both available
bles in the section "Guides and tools").
It is also of interest, in case of low data processing
risk, the free tool Facilitates (in the “Guides and tools” section), which
by means of specific questions, it allows assessing the situation of the person responsible
pect of the processing of personal data that it carries out, and where appropriate, generate di-
verses documents, informative and contractual clauses, as well as an annex with
Guidance security measures considered minimal.
IV
The claim is based on the installation of a video surveillance system with
alleged orientation towards common areas, without the authorization of the Board
of owners and without having the proper approved informative poster.
The neighbor of the
property referenced above.
In order to install a video surveillance camera, in the case of the
your property, you must inform the President of the Community of
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 5
5/7
owners, in any case must be oriented towards the door and sale-
of your property, not affecting common areas (such as traffic aisles) given
that the privacy of third parties is affected without just cause.
Likewise, you must have an approved poster , indicating the person responsible
of the treatment, its purpose and an effective direction to which to go,
especially if it is seasonal housing in this country.
The known facts are constitutive of an infraction, attributable to the claim
mado , for violation of art. 5.1 c) RGPD, previously described.
In addition, the claimant warns that the listed property does not have a poster
in which the presence of the cameras and the identity of the res-
responsible for data processing, so that interested persons can exercise
cite the rights provided for in arts. 15 to 22 of the RGPD.
Article 83.5 RGPD provides the following: “Violations of the provisions-
Subsequent measures will be sanctioned, in accordance with section 2, with administrative fines
you go for a maximum of 20,000,000 EUR or, in the case of a company, a quantity
equivalent to a maximum of 4% of the total global annual turnover for the year.
previous financial year, opting for the largest amount:
to)
the basic principles for treatment, including conditions for con
sentiment under articles 5, 6, 7 and 9; (…) ”.
V
The corrective powers available to the Spanish Protection Agency
Data, as the control authority, are established in article 58.2 of the RGPD. In-
Among them are the power to sanction with warning -article 58.2 b) -,
the power to impose an administrative fine pursuant to article 83 of the GDPR
-article 58.2 i) -, or the power to order the controller or data controller
that the processing operations comply with the provisions of the GDPR, when
proceed, in a certain way and within a specified period -article 58. 2
d) -.
In accordance with the provisions of article 83.2 of the RGPD, the measure provided for in article
Article 58.2 d) of said Regulation is compatible with the sanction consisting of a fine
administrative.
Without prejudice to the provisions of article 83 of the RGPD, the aforementioned Regulation
provides in its art. 58.2 b) the possibility of sanctioning with warning, in relation
with what is stated in Recital 148:
"In the event of a minor offense, or if the fine is likely to be imposed
constituted a disproportionate burden for a natural person, instead of san-
With a fine, a warning may be imposed. You must nevertheless pay
special attention to the nature, seriousness and duration of the offense, its character
intentional, to the measures taken to mitigate the damages suffered, to the extent
of responsibility or any pertinent previous infraction, to the way in which the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 6
6/7
control entity has been aware of the infringement, compliance with
days ordered against the person responsible or in charge, to adhere to
it already covers any other aggravating or mitigating circumstance. ”
In the present case, it is considered that the community of owners has warned
given to the accused, about the “disagreement” of the Board of owners, being able to-
have given at least the necessary explanations to avoid reporting the "facts" to
this body, the cameras according to the evidence provided affect common areas and
are not properly marked, which justifies the imposition of a figure sanction-
gives in the amount of € 2000 (Two Thousand Euros), taking into account the absence of infringement
previous provisions and the particular nature of the same, but being the denounced knowledgeable
of the “illegality” of the installation of the camera in question.
The denounced party must clarify the cause / reason for the installation of the camera.
mara, as well as its technical characteristics, providing photographs with
cha and time of what it captures with it in a situation plane, or failing that
has proceeded to remove it from the scene (eg, providing photographs
(date / time before / after).
It is warned that not meeting the requirements of this body may be
considered an administrative offense in accordance with the provisions of the RGPD,
typified as an offense in its article 83.5 and 83.6, being able to motivate such conduct the
opening of a further administrative sanctioning procedure.
The President of the Community of owners or, where appropriate, the Administrator,
You can deliver a copy of this resolution to the accused, since you must have a
address to communicate with it, or make reliable delivery in the bus-
post office of this, being able once accredited the access to the same or in
tempted the notification, file a new complaint if the accused persists in his
offending conduct.
Therefore, in accordance with the applicable legislation and the criteria of
graduation of sanctions whose existence has been proven,
the Director of the Spanish Agency for Data Protection RESOLVES :
FIRST: TO IMPOSE Don AAA , with NIF *** NIF.1 , for a violation of the article
5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 2000 (Two Thousand
Euros).
SECOND: NOTIFY this resolution to Don AAA and INFORM the
result of the actions to the complaining party COMMUNITY OF
OWNERS RRR.
THIRD: Warn the sanctioned that they must make effective the sanction imposed a
once this resolution is executive, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period
volunteer established in art. 68 of the General Collection Regulation, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
December 17, by entering, indicating the NIF of the sanctioned and the number
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 7
7/7
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000 , opened in the name of the Agency
Spanish Data Protection at Banco CAIXABANK, SA . Otherwise,
will be collected in the executive period.
Notification received and once executive, if the date of enforcement is
finds between the 1st and 15th of each month, both inclusive, the deadline to carry out the
Voluntary payment will be until the 20th of the following month or the next business day, and if
is between the 16th and last day of each month, both inclusive, the term of the
Payment will be until the 5th of the second following month or immediately following business.
In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public once the interested parties have been notified.
Against this resolution, which ends the administrative procedure pursuant to art.
48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the
LPACAP, interested parties may file, optionally, appeal for reversal
before the Director of the Spanish Agency for Data Protection within one
month from the day after notification of this resolution or directly
administrative contentious appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from
day after notification of this act, as provided in article 46.1 of the
referred Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the
LPACAP, the firm resolution may be provisionally suspended in administrative proceedings
if the interested party expresses his intention to file a contentious appeal-
administrative. If this is the case, the interested party must formally communicate this
made by writing addressed to the Spanish Agency for Data Protection,
presenting it through the Electronic Registry of the Agency
[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest
records provided in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too
You must transfer to the Agency the documentation that proves the effective filing
of the contentious-administrative appeal. If the Agency had no knowledge of the
filing of the contentious-administrative appeal within two months from the
day after notification of this resolution, would terminate the
precautionary suspension.
Sea Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es