AEPD (Spain) - PS/00397/2019

AEPD (Spain) - PS/00397/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 12 GDPR Article 13 GDPR Article 30(1) GDPR Article 83(5) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	3,600 EUR
Parties:	ZHANG BORDETA 2006 S.L., D.G. GUARDIA CIVIL PUESTO DE TÁRREGA
National Case Number/Name:	PS/00397/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The AEPD initiated sanctions proceedings against a catering company and imposed a fine of EUR 6,000, which could be reduced to EUR 3,600. The company had set security cameras outside of the restaurant, contravening the principle of data minimization, as required in Article 5(1)(c) GDPR.

English Summary

Facts

The AEPD examined a complaint submitted by a unit of the police against a catering company that set a video surveillance system on its restaurant. Some of the cameras were inside the restaurant, but one was outside to control the tables of the terrace, being able to record the public street.

Dispute

Does the setting of the camera surveillance system, including the recording of the public street, constitute an infringement of the data minimization principle?

Holding

The AEPD confirmed that the setting of the outdoor camera could not obtain images of public spaces, sufficing the cameras installed in the restaurant. In this sense, the images obtained outdoors are not covered by the principle of data minimization. In addition, the treatment of the image shall comply with other requirements. Among them, it needed to comply with the duty to inform the individuals affected by the recording according to Article 12 GDPR and Article 13 GDPR and to maintain a record of the processing activities under its responsibility according to Article 30(1) GDPR.

These duties were not accomplished and therefore a fine of EUR 6,000 was imposed, in accordance with Article 83(5) GDPR. Nevertheless, the company paid EUR 3,600 after applying two reductions due to the acknowledgment of the responsibility and a voluntary payment.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Spanish original for more details.

1/12936-031219Procedure Nº: PS/00397/2019RESOLUTION R/00028/2020 OF TERMINATION OF PROCEEDINGS FOR PAYMENT IN THE PS/00397/2019 sanctioning procedure, instructed by the Spanish Agency of Data Protection to ZHANG BORDETA 2006, S.L, In view of the complaint submitted by D.G. GUARDIA CIVIL - PUESTO DE TÁREGA, and on the basis of the following, FIRST BACKGROUND: On 19 November 2019, the Director of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against ZHANGBORDETA 2006, S.L.  (hereinafter, the claimed), by means of the Agreement that transcribes:<948-230919Procedure nº:PS/00397/2019Agreement to initiate sanctioning proceedingsof the actions carried out by the Spanish Data Protection Agency, and based on the followingFIRSTBACKGROUND:On June 4, 2019, a document presented by D.G. GUARDIA CIVIL - PUESTO DETÁREGA(*from now on, the claimant), by means of which he makes a claim against ZHANG BORDETA 2006, S.L. with NIF B25616962 (from now on, the claimed), for the installation of a video surveillance system installed in AVENIDA ARTESA 27,C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
2/12BORDELA, LLEIDA, there being indications of a possible breach of the provisions of art. 5.1 c) RGPD.The reasons for the claim and, where appropriate, the documents submitted by the claimant are the following: "Disproportionate recording of public roads, lacking informative deformulation inside the establishment" (page nº 1).SECOND: Prior to the admission of this claim, the claimant was transferred, in accordance with the provisions of Article 65.4 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD). The result of this action is described below: As stated on the official signs, the installation company is HIPERTEC and its telephone number is 973 238677. The company has two businesses together, a shop and a bar-restaurant. The restaurant has a bar detail, where you can see the employees and the cash registers. The other one focuses on the outside terrace, with hardly any visibility beyond it. Another with a general view of the restaurant's dining room and another general view of the bar and tables of the bar. The shop has 3 cameras, one with a general view of the shop from the back to the door, another on the side of the shop near the entrance and another in the area of the checkout and counter. C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
FOURTH: There is a previous complaint associated to the one denounced in the operating system of this Agency, in E/07286/2018, where you were widely informed about the regulations on data protection, warning you about not obtaining images of the public thoroughfare, as well as the obligation to have a form available for customers. C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
4/12RIGHT FOUNDATIONS By virtue of the powers that Article 58.2 of Regulation (EU) 2016/679 (General Regulation on Data Protection, hereinafter RGPD), recognizes each Control Authority, and in accordance with the provisions of Articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Agency for Data Protection is competent to initiate and resolve this procedure.IIIn the present case, we proceed to examine the complaint dated 04/06/19 in which the following is transferred as the main fact: "Disproportionate recording of the public thoroughfare, lacking informative deformulation inside the establishment" (sheet no. 1). The described conduct was framed in the content of the art. 5.1 c) RGPD, which states the following: "The personal data will be:c) adequate, pertinent and limited to what is necessary in relation to the purposes for which they are treated ("minimization of data"); From the images provided, it is noted that images of the public steel were obtained, outside the cases permitted by law, as they exceed the rights of an individual when installing this type of device: C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
5/12 "The documents formalised by the civil servants who are recognised as authorities and in which, observing the corresponding legal requirements, the facts established by them are recorded, shall be proof of the same, unless the contrary is accredited". The installation of security camera(s) in private spaces may not obtain images of public spaces.For the control and protection of the establishment it is only necessary to use interior cameras, and it is not possible to control the public space attached to the establishment, even if it has tables for the customers. When the system is connected to an alarm centre, it can only be installed by a private security company that meets the requirements set out in Article 5 of Law 5/2014 on Private Security, of 4 April. This rule admits some exceptions since, on some occasions, for the protection of private spaces, where cameras have been installed on facades or in the home, the owner of the space must give his or her consent. www.aepd.es28001 - Madridsedeagpd.gob.es
6/12the interior, it may be necessary to record a portion of the public road to guarantee the security purpose. In other words, the cameras and camcorders installed in the security confines will not be able to obtain images of the public thoroughfare unless it is indispensable for this purpose, or it is impossible to avoid it due to the location of the cameras and, extraordinarily, the minimum space for this purpose will also be collected.   Therefore, the cameras may exceptionally capture the minimum necessary portion for the intended security purpose. The duty to inform the affected parties provided for in Articles 12 and 13 of the RGPD must be complied with, resulting in the application - not contradicting the provisions of the aforementioned Regulation - of the method provided for in Article 3 of Instruction 1/2006, of 8 November, of the Spanish Data Protection Agency, on the Processing of Personal Data for Surveillance Purposes through Camera or Video Camera Systems. Specifically, in the video-surveillance areas, at least an information sign must be placed in a sufficiently visible place, both in open and closed spaces, which will identify, at least, the existence of a treatment, the identity of the person responsible and the possibility of exercising the rights provided for in said precepts.  Likewise, the information referred to in the mentioned RGPD must be kept at the disposal of those affected. The responsible must keep a record of the activities of the treatments carried out under his/her responsibility, including the information referred to in article 30.1 of the RGPD. Therefore, it is not permitted to place cameras on the private property of neighbours with the aim of intimidating them or affecting their private sphere without justified cause. In no case will the use of surveillance practices be permitted beyond the environment that is the object of the installation and in particular, they may not affect the surrounding public spaces, adjacent buildings and vehicles other than those that access the space under surveillance. C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
7/12In relation to the above, to facilitate consultation by interested parties, the Spanish Data Protection Agency offers through its website [https://www.aepd.es] access to legislation on personal data protection, including the RGPD and the LOPDGDD (section "Reports and resolutions" / "regulations"), as well as the Guide on the use of video cameras for security and other purposes, as well as the Guide for compliance with the duty to inform (both available in the section "Guides and tools"). Also of interest, in the case of processing of low risk data, the free tool Facilita (in the section "Guides and Tools"), which by means of some specific questions, allows the situation of the person responsible to be assessed with regard to the processing of personal data that he/she carries out, and where appropriate, generates various documents, informative and contractual clauses, as well as an annex with security measures considered to be minimum.IVThe complaint is based on the Complaint filed with this body by the State Security Forces and Corps, which states that the cameras installed in the establishment "capture the public sidewalk" without justified cause.Article 83.5 RGPD provides: 'Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of not more than EUR 20 000 000 or, in the case of an undertaking, of not more than 4 % of the total annual turnover for the preceding financial year, whichever is the greater...)".When motivating the sanction, the following are taken into account:-the nature of the infraction, as it is obtaining images of passers-by permanently, outside the permitted cases (art. 83.2ª) RGPD).C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
8/12- The negligence of the infringement, having been widely informed by this Agency of the measures that it should comply with, showing a total passivity when it comes to adjusting the system to the regulations in force (art. 83.2 b) RGPD). Based on the above, it is considered correct to propose a sanction in the amount of 6.This is without prejudice to the possibility of proving the removal of the exterior chamber, of the talmanera that does not capture public space, and only the interior of its establishment can be controlled, excluding the "reserved" areas.An information form must be available to the client(s) who may request it, and a copy must be kept at the disposal of the Security Forces and Bodies that may require it during inspections of the establishment (e.g. you can download it free of charge from the website of this AEPD www.aepd.es).We warn you that failure to comply with the requirements of this body may be considered an administrative offence in accordance with the provisions of the RGPD, classified as an infringement in its Article 83.5 and 83.6, and such conduct may give rise to the opening of a subsequent administrative sanctioning procedure. Therefore, in accordance with the above, the Director of the Spanish Data Protection Agency agrees:FIRST: TO INITIATE PENALTY PROCEEDINGS against the company ZHANGBORDETA 2006, S.L., with NIF B25616962, for the presumed infraction of art. 5.1 c) RGPD, by having a video-surveillance camera that records the public sidewalk, an infraction typified in art. 83.5 a) RGPD, being punishable in accordance with art. 58.2 RGPD.C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
9/12SECOND: NAME A.A.A. as instructor, and secretary, if appropriate, to B.B.B., indicating that any of them may be challenged, where appropriate, in accordance with Articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP).THIRD: TO INCORPORATE into the sanctioning file, for evidentiary purposes, the claimant's complaint and its documentation, as well as the documents obtained and generated by the General Sub-directorate of Data Inspection, all of them part of the administrative file.FOURTH: THAT for the purposes set forth in art. 64.2 b) of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations (LPACAP, hereinafter), the sanction that may correspond would be 6,000 Euros (Six thousand Euros), without prejudice to what may result from the investigation. Likewise, the infraction charged, if confirmed, could lead to the imposition of measures in accordance with what is established in the mentioned article 58.2 d) of the RGPD.FIFTH: TO NOTIFY the present agreement to the entity ZHANG BORDETA 2006, S.L., giving it a period of ten working days to formulate the allegations and present the proofs that it considers convenient.  In your written delegation you must provide your NIF and the number of the procedure that appears in the heading of this document. If in the stipulated term you do not make any allegations, this agreement of initiation could be considered as a proposal of resolution, according to the established in the article 64.2.f) of the LPACAP. The sanctioning procedure will have a maximum duration of nine months from the date of the initiation agreement or, as the case may be, the draft initiation agreement. After that period, the proceedings will be terminated and, consequently, the proceedings will be closed, in accordance with Article 64 of the LOPDGDD. In accordance with Article 85 of the LPACAP, if the sanction to be imposed is a fine, it may recognize its responsibility within the period granted for the formulation of arguments to the present agreement to initiate the proceedings, which will be accompanied by a reduction of 20% of the sanction to be imposed in the present procedure. With the application of this reduction, the sanction would be C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
10/12 set at 4,800 Euros (Four Thousand Eight Hundred Euros), the procedure being resolved with the imposition of this sanction. Similarly, at any time prior to the resolution of this procedure, the user may carry out the voluntary payment of the proposed sanction, which will mean a reduction of 20% of its amount.   With the application of this reduction, the sanction would be established at 4,800 Euros (Four Thousand Eight Hundred Euros) and its payment would imply the termination of the procedure. The reduction for the voluntary payment of the sanction is cumulative to the one that corresponds to apply for the recognition of the responsibility, as long as this recognition of the responsibility is shown within the time limit granted to formulate arguments at the opening of the procedure. If both reductions were to be applied, the amount of the sanction would be established at 3,600 euros (three thousand six hundred euros). In any case, the effectiveness of either of the two aforementioned reductions will be conditioned by the withdrawal or renunciation of any action or appeal in administrative proceedings against the sanction.In the event that you choose to proceed with the voluntary payment of any of the amounts indicated above, you must make it effective by depositing it in the account nº ES00 0000 0000 0000 0000 opened in the name of the Spanish Data Protection Agency at the CAIXABANK, S.A. Bank, indicating in the concept the reference number of the procedure that appears in the heading of this document and the reason for the reduction of the amount to which it applies. Finally, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP, no administrative appeal is possible against this act. Mar España MartíDirectora de la Agencia Española de Protección de Datos C/ Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es