AEPD (Spain) - PS/00027/2019: Difference between revisions
No edit summary |
No edit summary |
||
| Line 74: | Line 74: | ||
|Party_Name_1=Anoymous | |Party_Name_1=Anoymous | ||
|Party_Link_1= | |Party_Link_1= | ||
|Party_Name_2= | |Party_Name_2=Ministry for Internal affairs | ||
|Party_Link_2= | |Party_Link_2= | ||
|Party_Name_3= | |Party_Name_3= | ||
Revision as of 16:08, 11 March 2020
| AEPD - PS/00027/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(b) GDPR Article 83(5) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | n/a |
| Published: | 6. 3.2020 |
| Fine: | None |
| Parties: | Anoymous Ministry for Internal affairs |
| National Case Number/Name: | PS/00027/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in es) |
| Initial Contributor: | n/a |
The APED issued a reprimand to the Ministry of internal affairs due to their misuse of surveillance cameras. The controller did not inform about the specific purposes of the surveillances cameras processing employees’ personal data and, thus, breach the principle of purpose limitation. .
English Summary
Facts
Prior to the entry in force of the GDPR, a police inspector requested a copy of the surveillance cameras in a police station. Although the cameras were installed for the “security and protection” of the detainees and the police station, he requested the copy to check if one of the police officers followed his instruction: to wear the regulatory uniform. While, there was no proof that disciplinary procedure has been initiated, the copy of the images has been delivered.
The employee filed a complaint with the AEPD.
Dispute
The question was whether the information on the use of surveillance cameras for “security and protection” was sufficient to cover employees’ surveillance.
Holding
The AEPD ruled that the use of the surveillance video was against the principle of purpose limitation, Article 5(1)(b) GDPR.
Indeed, the controller carried out a disciplinary control though surveillance cameras and did not inform the affected data subjects accordingly. Insofar the data subjects have not been properly informed of the surveillance specific purpose, the controller could not have legitimated the processing disputed on the consent.
The APED ruled that it constituted a misused of the system and as mentioned in another court case-law, “it was necessary to expressly, precisely, clearly and unequivocally inform the workers of the monitoring purpose with a prior notice” and that “it should specify the characteristics and scope of the data processing to be carried out, i.e. in which cases the recordings could be examined, for how long and for what purposes, explaining in particular that they could be used to impose disciplinary measures for breaches of the employment contract”.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.
to be completed
