AEPD (Spain) - PS/00454/2019

AEPD - PS/00454/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	01.06.2020
Fine:	0
Parties:	Spanish citizen (AAA) Spanish citizen (BBB)
National Case Number/Name:	PS/00454/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Miguel Garrido de Vega

The Spanish Data Protection Agency (AEPD) decided to impose a minor warning on a Spanish citizen (the defendant) for the non-adequate installation of a video surveillance system allegedly pointing to the common swimming pool of the housing association, and the consequent infringement of the data minimisation principle related, as per Article 5(1)(c) GDPR.

English Summary

Facts

The decision is the consequence of a complaint submitted by another Spanish citizen stating that the defendant has installed a video surveillance system allegedly pointing to the common swimming pool of the housing association; such complaint included pictures proving that the video surveillance system was installed.

Dispute

The defendant did not answer to any AEPD investigation requests, so the AEPD started the corresponding sanction procedure. The AEPD highlighted that private individuals can install video surveillance systems as long as they comply with the corresponding information obligations, but they shall preferably record their own domicile, avoiding to intimidate adjacent neighbours, and never recording freely the whole public road (such activity is reserved for the Spanish law enforcement agents).

Holding

Thus, the AEPD understood that the video surveillance system may have infringed the data minimisation principle and, after considering some circumstances [(i) the defendant is a natural person, and (ii) there is no evidence of the actual images recorded by the video surveillance system], it decided to impose a minor warning to the defendant. The AEPD also requires the defendant (i) to prove the actual images recorded by the video surveillance system, (ii) to prove the reason for the installation of the video surveillance system and (iii) to include the corresponding information poster in a visible area. Additionally, the AEPD also reminds that, in case the defendant does not comply with these requirements, this could lead to an economic sanction procedure due to a serious breach of the 73(o) of Spanish Data Protection Law (LOPDGDD).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

 Procedure No.: PS / 00454/2019938-051119

RESOLUTION OF PENALTY PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection andbased on the following

ACTS

FIRST: Mr. AAA (* hereinafter, the claimant) dated August 6, 2019filed a claim with the Spanish Data Protection Agency. Theclaim is directed against BBB with NIF *** NIF.1 (hereinafter, the claimed). Thereasons on which the claim is based are “installation of video surveillance camera”with presumed orientation towards the common pool area of ​​the community ofowners.Along with the claim he provides documentary evidence (Annex I) variousphotographs that prove the presence of a dome camera, close to the area ofurbanization pool.

SECOND: In view of the facts denounced in the complaint and the documents-cough contributed by the claimant, the General Sub-Directorate for Data Inspectionyielded to carrying out previous investigative actions to clarifyof the facts in question, by virtue of the powers of investigation granted to thesupervisory authorities in article 57.1 of Regulation (EU) 2016/679 (RegulationGeneral Data Protection, hereinafter RGPD), and in accordance with the provisions-cited in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5 ofDecember, Protection of Personal Data and guarantee of digital rights (inhereinafter LOPDGDD).As a result of the investigation actions carried out, it is foundthat the data controller is the one claimed.

THIRD: As of 09/09/19 proceeded to MOVE the complaint to thedenounced to allege what in law he deemed appropriate, without responsesome has occurred.

FOURTH: On January 13, 2020, the Director of the Spanish Agency forData Protection agreed to initiate sanctioning procedure to the claimed, by thealleged violation of Article 5.1.c) of the GDPR, typified in Article 83.5 of theRGPD.

FIFTH: Consulted the database of this Agency on 02/18/19 it has not beenreceived any reply in relation to the facts transferred.In view of everything that has been done by the Spanish Data Protection Agency in the present procedure the following are considered proven facts,

ACTS

First. On 08/06/19, a letter is received from the complainant at this Agencyby means of which it transfers as main fact the following:“Video surveillance camera installation” with alleged orientation towards thecommon pool area of ​​the community of owners.Documentary evidence that certifies the installation of device (s) inquestion, being able for the orientation to be badly installed.

Second. It is identified as the main person in charge BBB , a neighbor of thecommunity, which has not made any allegation about the facts in question.

Third. It is recorded in the computer system of this body as "Notified" the Start Agreement, without it being returned or refused.Room. There is no evidence that the system in question has the required cartel information indicating the person responsible for the treatment in a visible area.

Fifth. It has not been possible to verify what in his case is observed with the camerasobject of complaint, by not providing the reported screen print of the same.

FUNDAMENTALS OF LAW

By virtue of the powers that article 58.2 of the RGPD recognizes to each authori-control, and as established in articles 47 and 48 of the LOPDGDD, the Di-Rector of the Spanish Agency for Data Protection is competent to initiate andto solve this procedure.IIIn the present case, the complaint dated 06/08/19 is examined bygave of which the following is transferred as fact:“Video surveillance camera installation” with alleged orientation towards thecommon pool area of ​​the community of owners, creating some concernin the set of neighbors of the community.The art. 5.1 c) RGPD provides the following: The personal data will be:“Adequate, pertinent and limited to what is necessary in relation to the purposesfor which they are processed ("data minimization").It should be remembered that individuals are responsible for ensuring that systemsmore installed comply with current legislation, proving that it complies withall the requirements demanded by the regulations in force.

The installation of this type of devices must have the required informative poster, indicating the purposes and responsible for the treatment, where appropriate, of the dataof a personal nature.In any case, the cameras should preferably be oriented towards theprivate area, avoiding intimidating neighboring neighbors with this type of devices,as well as controlling their transit areas without just cause.Neither with these types of devices can you obtain image (s) of Spanishpublic, as this exclusive competence of the Security Forces and Bodiesof the State.This type of device must have a mask and privacy, and mustIn any case, this Agency can examine through the corresponding frames (fe-cha y hora) what is captured with them.IIIIn accordance with the evidence available in this proce-sanction, the person claimed is considered to have a video system-surveillance without clarifying any aspect in relation to it, and the sameHow to affect the pool area near your home and the users of the poolma.

The known facts could be a violation, attributable to theclaimed , for violation of art. 5.1 c) RGPD.The art. 83.5 RGPD provides the following: “Violations of the provisionsThe following shall be sanctioned, in accordance with section 2, with administrative fines.maximum of EUR 20 000 000 or, in the case of a company, an amount equal toequivalent to a maximum of 4% of the total annual total turnover for the financial yearprevious financial institution, opting for the largest amount:a) the basic principles for treatment, including conditions forconsent under articles 5, 6, 7 and 9;IVWithout prejudice to the provisions of article 83 of the RGPD, the aforementioned Regulation providesne in his art. 58.2 b) the possibility of sanctioning with warning, in relation to whatstated in recital 148:"In the event of a minor offense, or if the fine is likely to be imposedconstituted a disproportionate burden for a natural person, instead of san-With a fine, a warning may be imposed. You must nevertheless payspecial attention to the nature, seriousness and duration of the offense, its characterintentional, to the measures taken to mitigate the damages suffered, to the extentof responsibility or any pertinent previous infraction, to the way in which the control entity has been aware of the infringement, compliance withdays ordered against the person in charge or person in charge, to the adherence toducta and any other aggravating or mitigating circumstances. "In the present case, it is taken into account that it is an individual, as well asthat it has not been proven as of the date what is recorded in your case with the camera inmatter, for which a warning penalty is agreed.The denounced party must prove by means of reliable evidence what in theircase is observed with the camera (eg screen print), the cause / reason for the ins-felling of the system, as well as having the mandatory informative poster invisible area.It is brought to your attention that not meeting the requirements of this Agencycia, may lead to the opening of an economic sanctioning procedure.mico, for the commission of a serious infraction of article 73 letter o) LOPDGDD.The complaining party, if applicable, must proceed as follows,contact the President of the Community in order for him to contact the neighbor(a) in question, in order to make the appropriate clarifications on the system,giving a reliable delivery of a copy of this resolution ad-ministerial (eg via mail, certified mail, etc.), if after a reasonable time thedenounced persists in his attitude of non-collaboration can present new Denun-cia to this Agency through the President, who will give rise to asanctioning procedure for repeated non-compliance with the requirements of thisorganism.Therefore, in accordance with the applicable legislation and the criteria ofgraduation of sanctions whose existence has been proven,the Director of the Spanish Agency for Data Protection RESOLVES:

FIRST: IMPOSE Mr BBB , with NIF *** NIF.1 , for a violation of Article5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a penalty of warning.

SECOND: NOTIFY this resolution to Mr BBB and INFORM the results of the proceedings to the complainant Mr AAA In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once the interested parties have been notified.Against this resolution, which ends the administrative procedure pursuant to art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPA-CAP, interested parties may file, optionally, appeal for reversal beforethe Director of the Spanish Agency for Data Protection within a month tocount from the day after notification of this resolution or directly resort-administrative litigation before the Administrative Litigation Chamber of theNational Agency, in accordance with the provisions of article 25 and section 5 of thefourth additional provision of Law 29/1998, of July 13, regulating the JurisContentious-administrative diction, within two months from the dayguide to the notification of this act, as provided in article 46.1 of the aforementionedLaw.

Mar España Martí Director of the Spanish Agency for Data Protection