AEPD (Spain) - PS/00261/2020: Difference between revisions

Latest revision as of 13:34, 16 June 2021

AEPD (Spain) - PS/00261/2020

Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 12 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	03.06.2021
Published:	07.06.2021
Fine:	26000 EUR
Parties:	RADIOTELEVISIÓN DEL PRINCIPADO DE ASTURIAS
National Case Number/Name:	PS/00261/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a
The Spanish DPA fined a company €26,000 (reduced to €19,600) for recording images of their employees' resting room and for not offering up-to-date information about the use of video surveillance at the workplace.
English Summary

Facts

Following a complaint, the Spanish DPA (AEPD) launched an investigation of a public radio-tv company that was using a video surveillance system on their premises.
The complainant alleged that the company had kept images during more than a year, as more than a year after recording them they were able to provide them to a court that asked for them.
Additionally, the AEPD noted that one of the system's cameras were pointing to the door of the employees' resting room, in order to control access to it. However, the camera also recorded images of part of the room itself, including a table and two chairs, a bulletin board, and two vending machines.
Holding

The AEPD concluded, in the first place, that even if there might had been an infringement in the storage of the images for more than a year, the violation was already prescribed, according to the former Spanish Data Protection Act, as more than two years had passed since the moment in which the controller handled the images to the court.
On the other hand, the AEPD found that the controller had violated Article 5(1)(c) GDPR when recording part of the employees' resting room. Even if the Spanish Workers' Statute allows under its Article 20(3) the employer to use different methods of control and surveillance, the Spanish Data Protection Act regulates the use of videocameras in the workplace. Its Article 89 allows for the use of videocameras, but specifically prohibits the recording of images of resting places for employees.
Therefore, the controller illegally recorded such images, and hence violated Article 5(1)(c) GDPR, for processing inadequate and irrelevant personal data of its employees.
The AEPD suggested that, if they needed to record images of the door providing access to the room, they could either move the camera, so the angle was the appropriate one, either mask the part of the image that was filming the resting room, other than the door.
The AEPD fined the controller €20,000 for the violation of Article 5(1)(c) GDPR, reduced to €16,000 due to early payment.
Additionally, the AEPD found that the informative signs regarding the video cameras were not up-to-date, as they only mentioned the former Spanish Data Protection Act. The AEPD considered that the controller had had enough time to update the signs since the publication and the entry into force of the GDPR, and that therefore the controller had violated Article 12 GDPR, by not fulfilling their information obligations.
The AEPD fined the controller €6,000 for the violation of Article 12 GDPR, reduced to €3,600 due to the recognition of responsibility and early payment.
Comment

Share your comments here!
Further Resources

Share blogs or news articles here!
English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
                                                                                1/18








     Procedure No.: PS / 00261/2020

                RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and based on
the following

                                  BACKGROUND



FIRST: A.A.A. (hereinafter, the claimant) on 01/07/2020 filed
claim before the Spanish Agency for Data Protection against RADIOTELEVISIÓN
OF THE PRINCIPALITY OF ASTURIAS, (hereinafter RTPA) with NIF A33924606 (in
ahead, the claimed one). The reasons on which the claim is based are that

preserved some images captured in February 2017, in the workplace, giving them
to the Court after more than a year later.

Along with the claim, it provides:


       -Writing of 12/29/2017 from the B.B.B. Lawyer, a person employed at the headquarters of the
complained, addressed to the complained, indicating that "during the year 2017 they have hanged and
pasquín pasquines in the headquarters of that television with injurious content ”to that person and
other members of the company, indicating that it may constitute a criminal offense ”and
makes a “request for them to proceed to locate in the recordings of the 10th

to February 15 and December 3 to 10 of this year, the author or authors of said acts
illicit, that is, those who glued or hung them on the boards and walls and even on the
depository of intimate hygiene of the women's bathroom "" before the imminent exercise of actions
criminal and labor laws on our part. "

       -Response of the claimed, dated 01/30/2018, indicating that by virtue of the

Data Protection regulations, “we cannot provide the information you request,
adding that there is no legitimate basis for this, concluding that said recordings
could be provided if required by the judicial or police authority
timely. "


       -Complaint before the Police, dated 03/03/2018, by B.B.B. of facts
happened at the headquarters of the claimed, stating that it is subject to "insults and harassment by
part of a worker, (...), designated by (...) ”, and denounces a series of damages, as well as
the exhibition of “some images on the social network, on the Facebook page *** PAGE.1,
on *** DATE.1, with comments such as "The new managers by finger ..." and that "in said

pages are insulted ”. He adds that “he receives insults in images written on stickers
placed in common work areas, access doors, bathroom doors, walls,
in the women's toilets and at home. "

      - Copy of demand to the Court by representative of B.B.B. for the crime of harassment
inside and outside the workplace and insults, against the claimant, dated 03/18/2018.

In one of the requests, RTPA is given a "copy of the recordings requested in our
letter".



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/18








       - Letter from the Police addressed to the Court of Instruction 4 of Gijón, reference
preliminary proceedings, abbreviated procedure XXX / 2018 of *** DATE.2, subject “giving
account of procedures entrusted in writing of your reference ", and it is indicated:" in

reply to your reference brief in which you request the viewing, analysis and report
About the recordings obtained by the RTPA recording video cameras
provided to this group by DVD disc and referring to the facts of which it understands
that Court, the following is involved:

        The DVD disc contains three avi files, named 213. sticker

       two, 213 sticker MP 4 and 213 sticker 3. All three, on the same day, *** DATE.3.

        In file 213 sticker two, “you can see that the filming begins at
       7:05, and in it you see a bearded individual in a dark jacket wearing

       a backpack on the back to access the place where there are two
       vending and a notice board and how he separates two papers by pulling one
       of them in the bin at the site and pasting the other on the bulletin board.
       announcements being evident that it is a sticker ending the filming at
       7:06. "



        In the MP 4 sticker file, filming starts at 7:21, on *** DATE.3
       "And as the same individual accesses another area where there is a board of
       ads and as soon as you enter, you begin to remove the paper that covers the adhesive

       a sticker by throwing the same in the bin and it goes board with the sticker
       sticking it, being at that moment when he arrives at the place an individual who
       see the facts and comment something with the alleged perpetrator ... "

        In file 213 sticker 3, “filming begins at 8:37 a.m. 28.

       again to the same individual referred to above how to access
       back to the area where the two vending machines and the display board are located.
       announcements and how again he places another sticker on said board where there was already
       put another one, although this time he pastes it on another document already existing in
       the board ending said recording at 8:38. "


        “Once the images indicated above have been compared with the images in the
       databases of the General Directorate of the Police, in this case the DNI of the
       denounced "indicating the name and surname of the claimant," the characteristics
       physical are very coincident, being able to treat of this person ”.


- Response of the complained party, dated 04/24/2018, to Examining Court 4
Gijón, abbreviated procedure XXX / 2018. In said letter, he forwarded "a copy of the
recordings of the day *** DATE. 3. Recordings from 3 to 12/10/2017 cannot
to contribute for not having them ”.


-Writing of the claimant, addressed to the claimed of 11/8/2019 in which stating the
conservation in time of the recordings of February 2017, asks you to explain the
reasons, considering that an “irregular treatment” has been carried out and requesting “access to
the information on the treatment of the images that the RTPA records and maintains and
about the treatment of my data ”.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/18








      SECOND: In view of the facts and the documents provided by the claimant, to the
      claimed on 03/05/2020, a copy of the claim is sent through the AEPD, so that
      send:

1. The decision made regarding this claim.
      In your response dated 06/30/2020, you state with respect to the claimant's writing of

      11/8/2019, which they answered on 01/08/2020.

      It indicates that at the time the request for information is made by the authorities,
      The obligation to delete personal data was not in force since it was collected
      which introduces Organic Law 3/2018, of 5/12, on the Protection of Personal Data and
      guarantee of digital rights (hereinafter LOPDGDD) and that “article 22.3 of the
      LOPDGDD that includes the previous obligation, allows its conservation to prove the
      commission of acts that threaten the integrity of persons, property or facilities ”.


      Provides document 1 (folio 61) in which "in relation to the query" was answered indicated
      stating that the obligation to preserve images was in accordance with the LOPD and that the images
      genes were handed over to the judicial authority.

      They indicate a link to the site where you can consult the privacy policy.

         1. In the event of the exercise of rights, accreditation of the response provided to the
      clamant.

      This question is not answered

         2. Report on the causes that have motivated the incident that has originated the claim.
        mation.

      He states that on 03/26/2018 he received a request from the Court of Instruction 4 of Gi-
      jón, procedure XXX / 2018 requesting the claimed delivery of recordings of the days

      02/10/15 and 12/10/2017, reiterated on 05/25/2018.

      By letter of 04/24/2018, they sent a copy of the recordings of the day *** DATE 3,
      but due to a technical problem whereby the images could not be displayed, so
      that in a second request of 05/25/2018 it was sent to the court on that same date
      the documentation.

      Provides document 2, which contains what has been said.

         3. Report on the measures adopted to prevent similar incidents from occurring.
      Lares, Date of implementation and controls carried out to verify their effectiveness.

      It reiterates (folio 61), that at the time the request for information was made by the
      authorities, the obligation to delete personal data was not in force since

      its capture, being the provision that establishes it, the LOPDGDD in its article 22.3.
         4. If the matter is related to video surveillance, a series of questions is requested

      on the implanted system.

      In its fourth point, it provides information about the video surveillance system.

      Document 4 contains the accreditation that “they have notified their workers about
      existence of a video surveillance zone, as well as informative posters of its location ”. In the
      photo, which does not bear the date on which it is obtained, is seen inside a building, a poster of

      C / Jorge Juan, 6 www.aepd.es
      28001 - Madrid sedeagpd.gob.es 4/18








video surveillance zone notice with reference to the 1999 LOPD, indicating the headquarters to the
to exercise rights (91).

It indicates that the purpose “is to guarantee the safety of people, goods and facilities.
tions ”, the system“ does not record worker rest places, nor is it disproportionate to
the end pursued. "

It states that they have 16 analog composite video security cameras that are

centralizes in two recording systems. It does not indicate the distribution that corresponds to the space
outside and how many inside. “The internal cameras of the fixed building and the external ones have
They have the ability to move but are not operational. "

As document 5, they provide screenshots of the areas recorded by each video camera.
mara, without explaining the correlation of each camera, its situation and each focus obtained and
the part in question, seeing, in addition to common areas of passage, among others, what
could be:

        - A CH 10 garage.

        - In the image of CH7, you can see chairs and a photocopier and clothes hanging on a rack,
being able to be a work zone.

        - In the image of CH14, you can see a space with a table and chair and two machines of the

that could be sandwich, coffee, etc., and next to what could be a notice board
glazed ignoring what is exposed.

        - In the image of CH16, a space separating offices, with sheets and lists ex-
put, not knowing what space it would be and what it focuses on.

In total, 9 images of interior have been provided, plus one called “test 1” that
know what space it would be. It is unknown what happens with the rest of the cameras, and may not
all images have been provided.

The external shot of the CAM02 is also unknown, being able to appreciate from the shot of
behind, a large parking space for vehicles. It is ignored if it is from the closed area,

allowing them to be identified, both by their registration, and if anyone goes up or down
of them, or any pedestrian that passes through that area. It is unknown if it also exists
Informative poster in that car park, if it is owned by the claimed one.

From the outside they provide another image, ignoring whether they have sent all the outside images
they have.

 It states that they signed a security and surveillance service contract for the headquarters with
SABICO SEGURIDAD SA. They provide a copy of the same, documents of legal conditions of
contracting of the service (folios 113 to 140), and techniques (141 to 144), its object being the

vice of surveillance and security of the building, the interior area for parking and the
roads delimited by the perimeter fence. Access is not mentioned in any of the documents
SABICO staff to data from the video surveillance system.

The space in which the images are displayed and the recording system used are not detailed.
The operation implies, nor the people who have access to them, nor what is the protocol
image recording request or who can request it




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/18








They provide a copy in document 7 of the record of treatment activities called activities
video surveillance that regulates the management of video surveillance services of the different
facilities.

THIRD: On 08/13/2020, the claim was accepted for processing.



FOURTH: In accordance with Law 8/2014, of 07/17, on the second restructuring of the sector
Autonomous public, Autonomous Community of the Principality of Asturias «BOPA» no. 171,
of 07/24/2014 «BOE» no. 253, of 10/18/2014, Radio and television of the Principality of Asturias,
SAU, is a public limited company whose capital stock belongs entirely to the Principality of

Asturias, its corporate purpose being “the provision of the public service of audiovisual communication
sual in the terms established in this law, as well as those other necessary activities
arias for the exercise of their public service functions or that are related to the
audiovisual communication ”.

Radiotelevisión del Principado de Asturias, SAU, will be governed by this law, its
development and its bylaws; by audiovisual legislation, by regulatory standards
of the autonomous public companies in what is applicable and, in the absence of the previous

later normative, by the mercantile legislation. (Article 6).

FIFTH: On 10/16/2020, it is agreed by the Director of the AEPD
       "FIRST: INITIATE SANCTIONING PROCEDURE for RADIOTELEVISIÓN OF

PRINCIPALITY OF ASTURIAS, with NIF A33924606, for the alleged violation of the
articles:

-5.1c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 04/27/2016
regarding the protection of natural persons with regard to data processing

personal data and the free circulation of these data (hereinafter, RGPD); as he points out
Article 83.5 a) of the RGPD.

-12 of the RGPD, in relation to 22 of the LOPDGDD, as indicated in article 83.5.b)
of the RGPD. "


       FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1/10,
of the Common Administrative Procedure of Public Administrations, sanctions
that may correspond would be an administrative fine. "



It was indicated IN THE BASIS OF LAW V:

       "The alleged infringements of the RGPD for which the complainant is held responsible have
to consider:

       -For the violation of article 5.1 c) the nature of the space of
entertainment that can be captured by the camera in which the images are taken (83.2.a), and
quality that is accredited 83.2.b).


       Without prejudice to what results from the instruction of this procedure, the
amount of this alleged infringement in 20,000 euros.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/18








        In the infringement of article 12 of the RGPD, the duration of the infringement in relation to
the date of entry into force of the LOPGDD (83.2.a), so without prejudice to what results
After the instruction of this procedure, the amount is quantified at 6,000 euros. "


SIXTH: On 10/19/2010 the notification is accepted.

-On 3/11/2020, the last day of the ten-day period provided for allegations, we received
ben allegations of the claimed.

1-Provides a payment of 3,600 euros, additional concept “reductions for responsi-
liability and voluntary payment ”, adding that“ it recognizes its responsibility and proceeds to

voluntary payment waiving any action in contentious-administrative way "



2-On the violation of article 5.1.c) of the RGPD, for the alleged capture of images of
space used for rest, coffee area, shows:

-The camera that has captured the images through which the procedure has been opened is not-
They are intended to capture the vending area but the door that is in the image,
as a means of securing your facilities. "This door allows access to one of the
patios of the claimed to the interior "

"At the exit door to the outside there is a sign that announces exit", which can be seen in the
frontal shot. To the left of the image shot, there is a corridor that ends

in offices. It considers that it is an area that requires special vigilance because it is an en-
trada.

-The room in which the images are partly collected, destined for the rest area of
employees is the only place they have available for it. When the facilities are
delivered, "a video surveillance camera system was already included"

-It understands the measure as the most proportional for the surveillance of the entrances to the facilities.
relationships with these cameras since other options such as placement of a security guard
it would be much more disproportionate in terms of cost.

-It provides an image that is captured with the camera (CH 14) the room, rest area, with
two machines, chairs and table, the door leading to the front patio. It can be seen in the left area

I want a coffee machine and next to it a bigger one for sandwiches and other products. On
the left area of the machines, a board apparently could be a notice board, closed
do, and a table with two chairs. There is a certain free space between the chairs and the machines,
as well as in the center of the room where the employees can be, for example,
standing drinking coffee and chatting.

 -Details a four-point relationship of the complete image as it has been collected up to now.

gives, to break down its structure and vision. From the front, point one and two, exit sign at
middle of the door that leads to the exit, two, the area of the corridor that starts on the left
of the door leads to offices (it is not appreciated that the corridor continues on the right side of the
door and in fact in the sketch that provides this is confirmed)

Recognize that the camera is oriented so that it takes a total view to capture
people entering through the door and down the hall. "One more orientation to
right would cause added difficulty to control inputs and outputs ”Compare a model

space indicated with number three, right part, with four, on the left, partial photo
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/18








grouping table, chair, plank and a machine, indicating that the current approach is proportionate
nal.

In the sketch that it provides, it can be seen that this room or space is entered through a corridor
or “central zone”, and it is possible to travel to, passing through the space, towards the dispatch area.
cho mentioned.

Add:

1- “Article 20.3 of Royal Legislative Decree 2/2015, of 10/23, which approves the

Consolidated text of the Workers' Statute Law establishes that the employer may
shall implement the necessary security and control measures to guarantee compliance with
compliance with the standards in its facilities. These measures include the installation
surveillance cameras. "

 2- “The use of the camera in the area is proportional and justified in order to comply with the
corporate surveillance and control obligations recognized in article 20.3 of the text
recast of the Workers' Statute, in connection with articles 33 and 38 of the Constitution

Spanish title. "


SEVENTH: On the date the proposal for resolution of the literal is issued:


"That by the Director of the Spanish Agency for Data Protection:

a) RADIOTELEVISIÓN DEL PRINCIPADO DE ASTURIAS is sanctioned, with NIF
A33924606, for a violation of article 5.1.c) of the RGPD, in accordance with article

83.5 of the RGPD, with a fine of 20,000 euros.

b) Declare completed the procedure in the part that affects the infringement attributed to
RADIOTELEVISIÓN OF THE PRINCIPALITY OF ASTURIAS by article 12 of the RGPD. "



                                    PROVEN FACTS



1) The respondent has video surveillance cameras installed inside her building, without
   pacity of movement, fixed. The purpose of the cameras installed inside is to

   security of the facilities and assets of the center. In general the images capture
   common and transit spaces of the building.



2) In the transfer of the claim, June 2020, the claimed provides photograph of images
   obtained inside your establishment, appearing at the entrance on a column
   a poster warning of the video surveillance zone The poster bears a legend of the Organic Law
   ca 15/99 and that you can exercise your rights before the complained party.

3) The image taken by the CH 14 camera can also be seen. Although it does not provide a photo of where-
   of the camera is placed, it is in a space or room of passage and that it is used

   as a rest area for employees. It is seen, according to the image captured by the camera,
   on the left a table with two chairs, on the right of the table, a notice board near
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/18








   rrado, and to your right a coffee machine. Next to this, a double-sized machine
   No more than the previous one, for sandwiches, drinks and so on. Between the table and the machines and in the
   central area of the room also forms a space that is focused and captured

   For the camera. This camera, according to the one claimed, is intended to focus on the
   entrance that will be about 8 meters in front of the focus of the camera. The camera is picking up
   all this frontal space, plus the space outlined above in the area of dis-
   canso, which is a large and important area of rest area for employees.
   two.

4) The complained party has a contract with the security company SABICO, to monitor
   building security, facility alarm system, and CCTV system

   in 24-hour shifts. There is no indication that he has access to the images or that there were any
   ministered the video surveillance system.


                            FOUNDATIONS OF LAW

                                             I


By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of the
Spanish Data Protection Agency is competent to resolve this procedure.



                                            II

Regarding the obligation to preserve images for a period not exceeding 30 days, the
(RGPD), in its recital 39, announces the need to “ensure that it is limited to a
strict minimum ”the period of conservation of personal data, which in turn
must be “adequate, relevant and limited to what is necessary for the purposes for which

be treated ”. Article 22.3 of the LOPDGDD specifies - regarding the treatments with
video surveillance purposes– that “the data will be deleted within a maximum period of one month
since its recruitment ”.

With the application of the RGPD since 05/25/2018, it should be considered that most of

Instruction 1/2006 of 8/11, of the Spanish Agency for Data Protection, on the treatment of
data collection for surveillance purposes, BOE 12/12/2006, entry into force 13,
has been displaced, since its content, such as legitimation or
the rights of people, is displaced by what is established in this regard by the norm
European.


In addition to being the same conservation period, at the time the events occur,
if the aforementioned provision on the preservation of images was applicable.

With the RGPD, the obligation to register files referred to in the Instruction disappears.
1/2006, it may be considered that the provisions of article 6 of the citation remain in force.

gives instruction that regulates the conservation period, and that refers to the occurrence of the
cancellation of images within a maximum period of one month.

On the other hand, an interpretation in accordance with the RGPD, since it does not contemplate the cancellation
but deletion, supposes that this conservation period of a maximum of one month does not

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/18








will be of cancellation but of suppression, except in those cases in which they must
Serve to prove the commission of acts that threaten the integrity of persons,
goods or facilities. The AEPD, in 2019, in its Guide on the use of video cameras to

security and other purposes, has specified that the period of one month indicated in said Ins-
truction is, effectively, suppression.

However, if during the legitimate treatment (within the month from its capture)
observes that the images can “prove the commission of acts that violate the
integrity of people, goods or facilities ”, there is a duty to communicate the existence

of the recording "within a maximum period of 72 hours" and its delivery to the authorities (art. 22.3
LOPDGDD). Consequently, the images would be treated already within the framework of the
respective judicial procedure, police investigation or administrative procedure
sanctioner.


Regarding the images captured on *** DATE. 3, they were provided in 2018 to the Court,
then if they contain personal data as indicated in the police report, they are

deduces that they have been kept longer than the expected time, without explaining a reasonable cause,
as the aforementioned regulations were applicable.

Considered a possible serious infraction contained in article 44.3.b) of the LOPOD,
as treatment at the time, without legal basis provided for in article 6.1 and 6.2 of the LOPD,
said infringement would entail a limitation period of two years from the date on which the
that can be understood as committed (article 47.1. and 2 LOPD).


Taking into account the statements given in relation to the transfer by the claimed “… the

04/24/2018 sent a copy of the recordings of the day *** DATE 3, but due to a
technical problem for which the images could not be displayed, so in a second
Requirement of 05/25/2018 the documentation was sent to the court on that same date. ”,
and the letter of *** DATE.2 from the Police addressed to the investigating court 4 of Gijón, which
provided by the claimant, the alleged infringement would have ceased to be committed when it ceases to

the preservation of the images is known or accredited, that is, when they are handed over to the judge.
do, counting as the date April, May 2018. Therefore, in April-May 2020, (with the additions
two of the suspension of pandemic terms inclusive, the violation of possession and conservation
images beyond the established deadline cannot be presumed if there is no evidence
It would be decisive, and would be prescribed when the agreement begins.


                                            III


On the legitimation of the implementation of the video surveillance system in the company
claimed, as claimed, would be Royal Legislative Decree 1/1995, of 03/24, which
approves the revised text of the Workers 'Statute Law (LET) Workers' Statute
Workers, note that its article 20.3 states:

  "3. The employer may adopt the measures he deems most appropriate for monitoring and

control to verify compliance by the worker of their obligations and duties
labor, keeping in their adoption and application the consideration due to their dignity and
taking into account, where appropriate, the real capacity of workers with disabilities. "



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/18








The proportionality alleged in relation to said article does not apply to the present case,
where the purpose of the installation and collection of the images is the pure security of

facilities, that no foreign element enters through the door that focuses the access, that
it cannot be confused with the control of the fulfillment of labor obligations. The
proportionality will have to be assessed between said purpose that is not related to the
labor control purposes as reiterated by the one claimed.


Not being its purpose that of labor control, it follows that it is not necessary to inform the
employees for this purpose, but if it is to be reported in general, and for the public

whether or not they are employees who circulate in said spaces. In this sense, both the LOPD and
the RGPD and the LOPDGDD establish how to do it, proving that the claimed
paid the amount of the fine for said offense.



                                               IV


Article 22 of the LOPDGDD indicates:


  1. Natural or legal persons, public or private, may carry out the treatment
of images through camera or video camera systems in order to preserve
the safety of people and property, as well as its facilities.


  3. The data will be deleted within a maximum period of one month from its capture, except
when they had to be conserved to prove the commission of acts that attempt against
the integrity of people, property or facilities. In this case, the images must be
made available to the competent authority within a maximum period of seventy-two
hours since the existence of the recording was known.


  The blocking obligation provided for in article will not apply to these treatments.
32 of this organic law.

  4. The duty of information provided for in article 12 of Regulation (EU) 2016/679 is
will understand fulfilled by placing an information device in place

sufficiently visible identifying, at least, the existence of the treatment, the identity of the
responsible and the possibility of exercising the rights provided in articles 15 to 22 of the
Regulation (EU) 2016/679. A code may also be included in the information device
connection or internet address to this information.


  In any case, the data controller must keep at the disposal of the
affected the information referred to in the aforementioned regulation.

  7. What is regulated in this article is understood without prejudice to the provisions of the Law
5/2014, of April 4, on Private Security and its development provisions. "








C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/18









The permanent implementation of a system that allows continuous monitoring through

of video cameras for security reasons has a legitimate basis in the LOPDGDD, whose
explanatory memorandum indicates:

"Along with these assumptions are collected others, such as video surveillance, files of

advertising exclusion or internal complaint systems in which the legality of the treatment
comes from the existence of a public interest, in the terms established in the article
6.1.e) of Regulation (EU) 2016/679 "

It should be remembered that article 6.1.e) of the RGPD states;



     1. The treatment will only be lawful if at least one of the following is met
terms:

      e) the treatment is necessary for the fulfillment of a mission carried out in the interest
  public or in the exercise of public powers conferred on the data controller; "



Article 89 that refers to the treatment of images obtained with a camera system
or video cameras, for the exercise of control functions of workers or employees
public, which is not the case under examination, it adds, in section 2:


  "two. In no case will the installation of sound recording systems or
video surveillance in places intended for the rest or recreation of workers or
public employees, such as changing rooms, toilets, dining rooms and the like. "


This means that neither the installation intended expressly for said
purpose, nor the deviation from another lawful purpose that partially incurs in said prohibition as in
this case, which with a legitimate purpose, is focusing on the space or area mentioned,
when it is proven that this is not at all necessary, and the purpose of

security by strictly focusing on the target of the door.






















C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/18









Without prejudice to the obligations of information to people who may transit through
said spaces, it is a public space. Therefore, the focus of the camera should

focus on monitoring the concrete and specific areas of particularized risk,
confined and limited to what is necessary in order not to affect the space available to
employees.

The possible and continuous monitoring through video of the employees in the
Rest is exceptionally justified for express, motivated and justified reasons.


Logically, in the areas where employees rest, relax or have a coffee there are
genuine and reasonable expectations for your privacy to be respected.

The sacrifice or limitation of this right of the employees must obey some

motivated and duly explicit reasons. However, in this case, the conflict of
interests of the right to security of the company's facilities for the
conservation of its facilities and assets can be combined with the rights of the
employees to their privacy. In this case it is appreciated that they could coexist, the camera
focusing on the security objective centered on the access door, if it is adjusted and reduces the
excess data collection that invades part of the rest area, adjusting it to the

purpose that is sought without hindering its objective.

It is estimated that when the defendant compares the spaces indicated in the image, numbered
randoing parts of the space, it does not take into account that in addition to the part itself that is already
In the image, (chairs, tables, machines and notice board), there is a space in front of the

machines and to the right of the chairs whose capture could also be avoided so as not to invade
the reserve of the area, so that by partially limiting the effects of the focus would preserve
a higher degree of privacy reserve in that area. It would not only make them not see each other
chairs, table, bulletin board and machines, but that area of space that is not pre-
I decided to focus, to focus on the target

The image to be obtained must be in front of the door, specifying well a cam-
focus bio so that it only points at the rectangle on the front of the door, which is

the objective to achieve, entrances and exits, so that you can see who can enter,
leave. This can be done in a number of ways, not to mention that the camera can be placed
car in another area, such as more forward, in the middle of the room, changing
the capture space or putting a mask on the left side of it.


The general principles applicable to the treatment and recording of images by the

video surveillance, at the date of the claim, were contained in the LOPD, and are the same
that are contained in the GDPR.











C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/18









According to the claimed, the purpose of the collection of images is security, not
it seeks to control employees. Faced with this, it should be noted that the treatment of

data must be limited and adjusted to the purpose for which it is established, it must not be processed
when the purpose is incompatible, or must be treated in its fair terms, making it compatible
other rights that concur when the purpose is not ceased to be obtained with it. Either
should be treated with such extensive data collection, that they are not considered necessary,
adequate or accurate for the purpose.


Along with this, there are general limitations that prohibit capture in spaces not only
private, but intimate of the employees such as the locker room, dining room,
or break room.


This ultimately implies the commission for the claimed of an infringement of article 5.1.c)
of the RGPD, which indicates: “1. The personal data will be:


       c) adequate, relevant and limited to what is necessary in relation to the purposes for which
that are processed ("data minimization"); "


The respondent must weigh, in each case, between the intended purpose and the possible affectation.
the right to honor, self-image and privacy for the use of the video camera.
nity of people. In this case, it did not consider the space shared by the employees
in a time of non-provision of services and the lack of suitability of the chamber they serve
The security of the facilities is capturing images of a large part of the space

destined for the rest of the staff, thus proving the infringement charged.

                                               V

As for the informative poster, the one provided, still referred to the regulations that were no longer
in force since the LOPDGDD, so it is not considered updated in content and form,
considering that the poster that contributes in June 2020 when the RGPD entered into force in
2018, being published in 20016, having enough time to vary that information

What is the commission of an infraction of article 12 of the RGPD

       "1. The person responsible for the treatment will take the appropriate measures to facilitate the

interested party all information indicated in articles 13 and 14, as well as any
communication in accordance with articles 15 to 22 and 34 regarding the treatment, in the form
concise, transparent, intelligible and easily accessible, with a clear and simple language, in
particular any information specifically directed at a child. The information will be
provided in writing or by other means, including, if applicable, by electronic means.
When requested by the interested party, the information may be provided verbally provided that

prove the identity of the data subject by other means.

       2. The person responsible for the treatment will facilitate the exercise of their rights to the interested party.
pursuant to articles 15 to 22. In the cases referred to in article 11, paragraph 2, the
responsible will not refuse to act at the request of the interested party in order to exercise their
rights under Articles 15 to 22, unless you can show that you are not in
conditions of identifying the interested party.

       3. The person responsible for the treatment will provide the interested party with information regarding their

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/18








proceedings on the basis of a request pursuant to Articles 15 to 22, and, in
In any case, within one month of receipt of the request. Said term
it may be extended for another two months if necessary, taking into account the complexity and

the number of requests. The person in charge will inform the interested party of any of said
extensions within one month from receipt of the request, indicating the
reasons for procrastination. When the interested party submits the request by electronic means, the
Information will be provided by electronic means whenever possible, unless the
interested party request that it be provided in another way.

        4. If the person responsible for the treatment does not comply with the request of the interested party,
will inform without delay, and no later than one month after receipt of the request, of

the reasons for their failure to act and the possibility of filing a claim before a
control authority and to exercise legal actions.

        5. The information provided by virtue of articles 13 and 14 as well as all
communication and any action carried out by virtue of articles 15 to 22 and 34 will be
free title. When the requests are manifestly unfounded or excessive,
especially due to its repetitive nature, the data controller may:

        a) charge a reasonable fee based on the administrative costs incurred
to facilitate information or communication or perform the requested action, or

        b) refuse to act on the request.

        The data controller will bear the burden of proving the character
manifestly unfounded or excessive of the request.

        6. Without prejudice to the provisions of article 11, when the person responsible for the

treatment has reasonable doubts in relation to the identity of the natural person who
makes the request referred to in articles 15 to 21, you may request that the
additional information necessary to confirm the identity of the interested party.

        7. The information that must be provided to the interested parties by virtue of articles 13
and 14 may be transmitted in combination with standard icons to provide
easily visible, intelligible and clearly legible an adequate overview
of the planned treatment. The icons that are presented in electronic format will be legible

mechanically."

In relation to the 22 of the LOPDGDD which indicates: Treatments for video surveillance purposes ”:

  "4. The duty of information provided for in article 12 of Regulation (EU) 2016/679 is
will understand fulfilled by placing an informational device in place
sufficiently visible identifying, at least, the existence of the treatment, the identity of the
responsible and the possibility of exercising the rights provided in articles 15 to 22 of the

Regulation (EU) 2016/679. A code may also be included in the information device
connection or internet address to this information.

  In any case, the data controller must keep at the disposal of the
the information referred to in the aforementioned regulation is affected. "


                                               SAW


Article 58.2 of the RGPD indicates:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/18








"two. Each supervisory authority shall have all the following corrective powers indicated-
two below:


  d) order the person in charge of the treatment that the treatment operations
  comply with the provisions of this Regulation, where appropriate, of a certain
  nothing way and within a specified time;

  i) impose an administrative fine in accordance with article 83, in addition to or instead of the
measures mentioned in this section, according to the circumstances of each case

particular;"

Article 83.5 a) and b) of the RGPD considers that the violation of “the basic principles for

the treatment, including the conditions for consent in accordance with articles 5, 6,
7 and 9 "and those of the" rights of the interested parties under articles 12 to 22 "are
punishable, in accordance with section 5 of the aforementioned article 83 of the aforementioned
Regulation, with administrative fines of € 20,000,000 maximum or, in the case of
a company, of an amount equivalent to a maximum of 4% of the total turnover

annual global of the previous financial year, opting for the highest amount. "

                                               VII


Regarding the amount of the administrative fine sanctions that would proceed to impose,
It must comply with the provisions of articles 83.1 and 83.2 of the RGPD, precepts that
point out:

        "1 Each supervisory authority shall guarantee that the imposition of fines
administrative regulations pursuant to this article for infractions of this Regulation
indicated in sections 4, 5 and 6 are in each individual case effective, proportionate and

deterrents. "
        “2 Administrative fines will be imposed, depending on the circumstances of
each individual case, as an additional or substitute for the measures contemplated in the

Article 58, paragraph 2, letters a) to h) and j). When deciding to impose an administrative fine
and its amount in each individual case will be duly taken into account:

        a) the nature, severity and duration of the offense, taking into account the
nature, scope or purpose of the processing operation in question as well as the
number of interested parties affected and the level of damages they have suffered;

        b) intentionality or negligence in the infringement;
        c) any measure taken by the controller or processor to

mitigate the damages and losses suffered by the interested parties;
        d) the degree of responsibility of the person in charge or the person in charge of the treatment,

taking into account the technical or organizational measures that have been applied by virtue of the
articles 25 and 32;

        e) any previous infringement committed by the person in charge or the person in charge of the
treatment;
        f) the degree of cooperation with the supervisory authority in order to remedy

the infringement and mitigate the possible adverse effects of the infringement;

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/18








        g) the categories of personal data affected by the infringement;

        h) the way in which the supervisory authority learned of the infringement, in
in particular if the person in charge or the person in charge notified the infringement and, if so, in what
measure;

        i) when the measures indicated in article 58, paragraph 2, have been ordered
previously against the person in charge or the person in charge in relation to the same
subject, compliance with said measures;

        j) adherence to codes of conduct under Article 40 or to mechanisms of
certification approved in accordance with Article 42, and

        k) any other aggravating or mitigating factor applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or indirectly,
through the offense. "

        In relation to section k) of article 83.2 of the RGPD, the LOPDGDD, article 76,
"Sanctions and corrective measures", provides:

        "two. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679
The following may also be taken into account:

a) The continuing nature of the offense.

b) The linking of the offender's activity with the performance of personal data processing
sonal.

c) The benefits obtained as a result of the commission of the offense.
d) The possibility that the affected person's conduct could have led to the commission of the
infringement.

e) The existence of a merger by absorption process after the commission of the infringement.
This cannot be attributed to the absorbing entity.

f) Affecting the rights of minors.

g) Have, when not mandatory, a data protection officer.

h) The submission by the person in charge or in charge, on a voluntary basis, to mecha-
nisms for alternative conflict resolution, in those cases in which there are
controversies between those and any interested party. "

The alleged infringements of the RGPD for which the complained party is held responsible must be
siderar:

For the violation of article 5.1 c) of the RGPD, the nature of the space is taken into account
entertainment that can be captured by the camera in which the images are taken (83.2.a), and the
intentionality that is credited 83.2.b), with a penalty of 20,000 euros.

The defendant paid after the resolution proposal, the amount mentioned with the reduction
20%, 16,000 euros (sixteen thousand euros) indicated in article 85 of the LPACAP,
which states: "Termination of sanctioning procedures"

"1. Once a sanctioning procedure has been initiated, if the offender acknowledges his responsibility,
It will resolve the procedure with the imposition of the appropriate sanction.

2. When the penalty is solely of a pecuniary nature or it is possible to impose a penalty

pecuniary and other non-pecuniary status but the inadmissibility of the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 17/18








second, the voluntary payment by the alleged perpetrator, at any time prior to the
resolution, will imply the termination of the procedure, except in relation to the replacement of
the altered situation or the determination of compensation for damages caused by

sados by the commission of the offense.

3. In both cases, when the sanction is solely of a pecuniary nature, the body
competent to resolve the procedure will apply reductions of at least 20% on
the amount of the proposed sanction, these being cumulative with each other. The aforementioned reductions
They must be determined in the notice of initiation of the procedure and its effect.

tivity will be conditional on the withdrawal or waiver of any action or appeal in progress.
administrative against the sanction.

The percentage of reduction foreseen in this section may be increased by regulation.
mind."



In the infringement of article 12 of the RGPD, the duration of the infringement in relation to the fe-
date of entry into force of the LOPGDD (83.2.a), was quantified in the initiation agreement in
6,000 euros. This amount was paid with the benefit of the double discount of 20%, in the
deadline for allegations, acknowledging their responsibility and paying it.



Therefore, in accordance with the applicable legislation and the graduation criteria assessed
of the sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency


RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00261/2020, in accordance
with the provisions of article 85 of the LPACAP.


SECOND: NOTIFY this resolution to RADIOTELEVISIÓN DEL PRINCIPADO
OF ASTURIAS.

THIRD: In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 85.3 of the LPACAP, the
Interested parties may directly file an administrative contentious appeal before the Chamber
of the Contentious-administrative of the National Court, in accordance with the provisions of the

Article 25 and section 5 of the fourth additional provision of Law 29/1998, of 07/13,
regulator of the Contentious-administrative Jurisdiction, within a period of two months from
from the day following the notification of this act, as provided in article 46.1 of
the referred Law.


Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, you may
provisionally suspend the final administrative resolution if the interested party manifests
his intention to file a contentious-administrative appeal. If this is the case, the
The interested party must formally communicate this fact by writing to the Agency
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 18/18









Spanish Data Protection, presenting it through the Electronic Registry of the

Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the
remaining records provided for in art. 16.4 of the LPACAP. You must also transfer to the
Agency the documentation that proves the effective filing of the contentious appeal-

administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following notification
of this resolution, would terminate the precautionary suspension.



                                                                                               938-131120
Mar Spain Martí
Director of the Spanish Agency for Data Protection




















































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
@@ Line 50: / Line 50: @@
 }}
-The Spanish DPA fined a company €26,000 (reduced to €19,600) for recording images of their employees' resting room and for not offering up-to-date information about the use of video surveillance in the workplace.
+The Spanish DPA fined a company €26,000 (reduced to €19,600) for recording images of their employees' resting room and for not offering up-to-date information about the use of video surveillance at the workplace.
 == English Summary ==