AEPD (Spain) - EXP202203617

AEPD - PS-00188-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 6 GDPR Article 13 GDPR Article 18(1) CE Article 22 LOPDGDD Article 89 LOPDGDD Article 89(3) LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:	18.03.2022
Decided:	09.05.2022
Published:	15.11.2022
Fine:	6000 EUR
Parties:	n/a
National Case Number/Name:	PS-00188-2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Carmen Villarroel

The Spanish DPA fined a controller €6,000 for using the audio recording option of its surveillance system to hear private conversations of its employee with a customer, which was later used for dismissing the employee.

English Summary

Facts

A company (the controller) started recording audio with their surveillance system in order to monitor an employee (data subject) after they could see in the images provided by the system that the data subject was allegedly misusing the machinery.

Allegedly, one of the conversations recorded with a customer was considered by the controller as inappropriate, which led to the dismissal of the data subject. The conversation took place outside working hours. The dismissal letter contained a reference to this conversation. The data subject, however, sued the company over the dismissal. The case ended with an agreement between both parties, where the controller accepted the dismissal to be void.

Furthermore, the data subject filed a complaint with the Spanish DPA over unlawful workplace audio surveillance.

According to the controller, the data subject had been informed that a surveillance system for performance monitoring was in place, and that such surveillance system could be recording audio. There were also two banners indicating the existence of such system. Additionally, the data subjects was given a Handbook on Surveillance Systems Usage that made reference to the audio recording functionality.

Holding

Within the procedure, the controller tried to allege that there was no proof of the existence of such conversation, and that they could not deliver it since it had been automatically deleted after 30 days, according to their standard procedure. However, the DPA considered its existence proved enough on the grounds that the controller had admitted its existence in the dismissal letter and that the controller had accepted the dismissal to be void.

According to the DPA, the data subject was not given enough information about the processing. The company alleged that such recording was mentioned in the Handbook on Surveillance Systems Usage given to the data subject, but the DPA noted that the Handbook only mentioned the possibility of activating such functionality.

According to Article 22 of the Spanish Data Protection Act (LOPDGDD), data processing by surveillance systems may be carried out with security purposes. Article 89 LOPDGGG develops the right to privacy of workers against surveillance systems and establishes that companies are entitled to use such system for monitoring and control purposes, as per the Spanish Labour law, always within the legal framework and its limits. Paragraph 2 of the same Article prohibits the use of such systems in rest or private places such as changing rooms, canteens, etc. In accordance with these provisions, the controller alleged that, since it had not installed the surveillance system in the places forbidden by Article 89(2) LOPDGDD, the installation should have been deemed valid. However, the DPA considered that the installation and usage of such system was not proportionate. The DPA made reference to Spanish Constitutional Court case law, which indicates that under Spanish Labour law workplace surveillance needs to respect the workers' dignity, and that workers have their own private sphere at the workplace. Therefore, systems that limit the workers' privacy shall be indispensable and strictly necessary for the pursued purpose. Mere utility or convenience cannot amount to strict necessity. The Court also mentioned the chilling effect that recording audio may have on workers. In this sense, the DPA linked the proportionality requisite to the minimisation principle from Article 5(2)(c) GDPR. Also, according to Article 89(3) LOPDGDD, the use of audio recording systems in the workplace shall only be permitted when the risks to the safety of installations, goods and persons are relevant and always respecting the principle of proportionality, the principle of minimum intervention and the foreseen guarantees.

The DPA concluded that the controller was not able to prove why the recording of audio was strictly necessary for the purposes of monitoring their employee. Additionally, even if the DPA did not have the recording itself as evidence, since it had been deleted, the DPA considered its existence was sufficiently proved, as stated above, and that the mere activation of the audio recording implied the collection and processing of the data subject's voice, i.e., their personal data. Therefore, the controller processed such personal data without a legitimate basis, in breach of Article 6 GDPR.

For the violation of Article 6 GDPR, the AEPD fined the controller €6,000. In order to determine the amount of the fine, the DPA took into account the following. As aggravating factors, the DPA considered the intentionality of the infringement, since the installation of the system was intentional; and the degree of responsibility of the controller, since they did not have a procedure in place related to the processing of the voice of its employees. As mitigating factors, the DPA considered the low number of affected data subjects (1); the fact that the controller is a small company (only 1 employee); and the low volume of data processed.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/23








     File No.: EXP202203617



                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following

                                   BACKGROUND



FIRST: A.A.A. (hereinafter, the claimant) on 03/18/2022 filed
claim before the Spanish Data Protection Agency. The claim is
directed against B.B.B. with NIF ***NIF.1 (hereinafter, the claimed party). The motives

on which the claim is based are the following:

The claimant states that until ***DATE.1 she was an employee of the
company of the claimed party, date on which he was notified of his dismissal
disciplinary action based on access to the content of voice recordings from the
video surveillance system that your work center has, extreme, the

audio recording by said system, of which the party was not informed
claimant, understanding that said circumstance is contrary to the regulations of
Data Protection.

It details that these recordings correspond to a conversation held with a

family on 03/02/2022, which took place inside the premises and outside working hours;
and another that he had with a client the next day, to whom he commented that one of the
machines prevented him from doing the jobs well. According to the complaining party, it is
two private conversations that were recorded by the video surveillance system,
as revealed by the party claimed in the messages sent by Whatsapp that

attached.

It adds that the information that was delivered to it on the aforementioned system of
video surveillance does not clarify whether or not the voice is recorded.

With your claim, provide the following documentation:


. WhatsApp conversation in which the claimed party alludes to the conversations
mentioned. This is a transcript of this alleged conversation collected
on a blank page with nothing to prove its authenticity.


. Image of a dismissal letter, dated ***DATE.1, stating
handwritten signature of the complaining party on the same date, as proof of its
delivery to the interested party. This letter communicates the termination of the employment relationship
for disciplinary dismissal, motivated by a "drop in work performance" and "bad
use of machinery”, verified through the recordings of 03/02/2022. It does

reference, likewise, to the recording of a conversation in which the party
complainant "complains to a client about the state of the company's machinery,
blaming it for the errors in the orders”.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/23








. "Informative manual on the use of video surveillance systems" provided by the
claimed party to the claiming party, regarding the installed video surveillance system
in the workplace where the complaining party carried out its activity as

employee, in which the handwritten signature of the complaining party is recorded. Part of the
information contained in this document is outlined in the Proven Fact
Third.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in

forward LOPDGDD), said claim was transferred to the claimed party, for
to proceed with its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements established in the regulations of
Data Protection.


The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP), was collected on 03/30/2022 as stated in the
acknowledgment of receipt in the file.

On 04/08/2022, this Agency received a written response in which the

Respondent party states the following:

“. The person responsible for the treatment of the video surveillance system; B.B.B., with NIF… and
Contact email…
. The cameras installed in the premises of ***ADDRESS.1, have a security camera

video surveillance that is activated by stopping movement. This camera points to
a particular angle where the cash register is. It also has two
photodetectors located inside the premises. One of them above the camera
video surveillance with the same viewing angle as the video surveillance camera and the
second photodetector points to the rear of the premises. Both photodetectors only

activate when the alarm does and take three photos, these three photos
They can also be requested by the person in charge of the cameras to the person in charge of
treatment of the cameras, through the application.

Annex I: Photographs of these devices (camera and photodetectors) are attached together with
video surveillance posters, as well as photographs of the mobile screen used to

the vision of the images in the mobile application.

Photographs of the two posters in the premises that warn of the existence of
video surveillance area, these signs are located next to the cameras. in the same
It is appreciated expressly and clearly according to the RGPD and LOPDGDD, the

necessary information about who is responsible and the processing of your data,
what are the rights they can exercise and where to go to do so.

In the images of Annex I you can see the posters next to the cameras.


There are no monitors where captured images are shown and can be accessible
since these are only available in the mobile application provided by the
"Securitas Direct" treatment manager, to the mobile application is only authorized
your access the person responsible for the images, B.B.B..

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/23









Currently the company does not have workers on its account, therefore, there is no
authorized personnel in the establishment, nor are the cameras seen by the clientele,

given that they are only accessible by the mobile application that the person in charge of
treatment of the camera and the photodetectors puts at the disposal with a user and
password.

Documents are attached that prove that the worker A.A.A. with NIF ***NIF.2
who terminated his employment contract with the person in charge on ***DATE.1, knew the

existence of video surveillance cameras for labor control.

On ***DATE.2, the former worker was informed that a system had been installed
of video surveillance inside the premises and that this may be used to carry out a
Control of work performance of company workers. Said statement

is known and signed by it. In addition, you are given for more information a
Informative Manual on the use of video surveillance systems, also informed and
signed by the former and only worker.

The present document has as objective the knowledge of the installation and use of
video surveillance systems, derived from the need to carry out a control in the

accesses, as well as to the interior, in order to guarantee the security of the goods and
people.

The use of cameras or video cameras for security purposes implies the capture,
recording and storage of images that may contain character data

staff. Capture or recording may consist of an imaging system
associated or not with voice capture. This is how the staff is made aware through the
Information manual on the use of video surveillance systems.

Annex II: Information manual on the use of video surveillance systems and clause

informative, where the knowledge of these systems by the staff is accredited.

. The installation, maintenance and management of video surveillance and cameras have been
contracted and performed with the SECURITAS DIRECT Treatment Manager
SPAIN SAU…


Annex III: copy of the contract signed with the security company and technical report
of the video surveillance system.

. The video surveillance system records the images and keeps them for the period of
three days.


. Report on whether the video surveillance system installed in the establishment has
sound capture, as well as image.

The video surveillance system does have sound capture, in addition to capturing

of image. According to the Workers' Statute, the employer can establish the
surveillance and control measures that it deems most appropriate to verify the
fulfillment by the worker of his labor obligations and duties.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/23








The video surveillance system takes into account the requirements of the LOPDGDD and the
GDPR; Principle of proportionality and the regulations on personal privacy.
Coinciding in their assessments of the business need to act in accordance with

the minimum intervention criteria, its maximum expression being the judgment of
proportionality, adequacy and balance.

The company established the measures it considered most appropriate for surveillance and
control to verify compliance by the worker with his obligations and
job duties.


Therefore, the same, taking as evidence the video surveillance cameras of the
and based on their right to take appropriate measures to control
labor;


On date ***DATE.1 communicates the termination of the employment relationship with A.A.A.,
through disciplinary dismissal given the reasons founded on a drop in
work performance where it is suspected and accredited through security cameras
video surveillance that the worker left tasks or orders unfulfilled.

In addition, it is demonstrated through the capture of the image a misuse of the

machinery, causing loss of material and time to the company.

As a result of poor work performance and in protection of business assets
it is decided to carry out a more exhaustive monitoring of the worker.


In the following days and given the previous suspicions, the audio is activated
of the camera, in which it is observed that the former worker misuses the
machinery... In the following days another fact is observed, the worker complains to
the clientele on the machinery of the company, blaming the errors on it and
causing discredit and possible economic losses to the company.


According to the events that occurred and the well-founded suspicions, the
resource used as a measure of control within the framework of the right to privacy
staff that would be limited to:

a) The suitability of the recording for the purpose intended by the company - verify

if the worker actually committed the suspected irregularities and if so
take appropriate disciplinary action.
b) The need for the measure -since the recording would serve as proof of such
irregularities.
c) The proportionality of the control - temporarily, while demonstrating the

facts.

In short, this control function would be within the established legal limits.
in the art. 89.3 LOPDGDD, since it arises from a situation of suspicion
well-founded, that the means used is presented as the only viable one to carry out the

investigation necessary to guarantee a reliable result”.

Ends the claimed part citing article 89.3 of the LOPDGDD.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/23








Provide a copy of a document delivered to the claimant on ***DATE.2
(it has his handwritten signature and the indicated date, also handwritten), with the label
"Inform workers about the installation of cameras (Labor Control)". Part

of the information contained in this document is outlined in the Proven Fact
Third.

THIRD: On April 13, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the claimant party was admitted for processing.


FOURTH: On May 9, 2022, the Director of the Spanish Agency for
Data Protection agreed to initiate disciplinary proceedings against the claimed party,
pursuant to the provisions of articles 63 and 64 of the LPACAP, for the alleged
infringement of article 6 of Regulation (EU) 2016/679 (General Regulation of
Data Protection, hereinafter GDPR), typified in article 83.5.a) of the aforementioned

Regulation; and classified as very serious for prescription purposes in article
72.1.b) of the LOPDGDD.

In the opening agreement it was determined that the sanction that could correspond,
attention to the existing evidence at the time of opening and without prejudice to the
that results from the instruction, would amount to a total of 6,000 euros.


Likewise, it was warned that the imputed infractions, if confirmed, may
entail the imposition of measures, according to the aforementioned article 58.2 d) of the GDPR.

FIFTH: Notified of the aforementioned start-up agreement in accordance with the rules established in

the LPACAP, the claimed party presented a pleading in which it requests the
procedure file based on the following considerations:

1. In response to what was stated by the complaining party regarding the ignorance of the
recording system, points out that in the conciliation document signed by the

admits the conversations held with the client and the knowledge about the
installation of the video and voice system.

In this regard, it clarifies that, in accordance with article 89 of the LOPDGDD, in no
case the audio and image recording was made in places intended for rest
or in places where private conversations would take place that could violate the

worker's right to privacy.

2. Understand that speaking ill of the company with a client can have consequences
negative, with economic repercussions and prestige in the company.


Therefore, in his opinion, two legally protected principles come into conflict: the
right of the worker protected by article 18.1 CE and the duties of good faith and loyalty
between the employer and the staff. Labor legislation protects that the worker
expose your complaints within the company, but another matter is to confuse the
freedom of opinion of the worker with the right to insult or use expressions

vexatious, insulting and undermining the image of the company.
These conversations are recognized in the conciliation document signed by the
employee.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/23








3. Nor was it necessary for complaints to be made directly to customers,
that harms the organization, influencing its success.


In this sense, the defendant considers that the power of direction of the
entrepreneur is essential for the smooth running of the organization, and
attributes the possibility of adopting surveillance and control measures such as recording,
This being proportional to the purpose and adjusted to the provisions of article 20.3 of the
Workers' Statute and article 89.3 of the LOPDGDD, which admits the
recording as an appropriate and proportionate measure in justified cases.


Regarding the tests, the following stands out:

. Voice recordings cannot be provided because they have been deleted after 30 days,
under applicable law. The defendant considers that this is essential in terms of this

proceedings.

. In contrast to what was expressed by the AEPD in the opening agreement, in relation to the
"Informative manual on the use of video surveillance systems", which the authority of
control does not consider conclusive in terms of information on voice pickup,
should take into account what was expressed by the complaining party in the act of

conciliation admitting that he was aware of the use of cameras with voice recording.

4. The question raised in this file has to do with the use of the
recordings obtained by the video surveillance cameras of a company for the
adoption of disciplinary dismissals, having informed the workers about the

facility and its control purpose. You understand that said recording does not constitute a
violation of data protection, since the worker knew the facility
of the chamber, was in a conspicuous place, such circumstances being known by the
hardworking, who knew the use that was going to be given to her.


The Judgment of the TC under number 39/2016, resolves a case in which a
worker had been disciplinary dismissed. In this case they have not been used.
cameras or video, since the claimed party has recognized the inappropriateness
of dismissal.

It goes on to add that in the aforementioned Judgment “the worker who had presented

the demand for dismissal, seeking its annulment for violating the honor, privacy
and dignity or, secondarily, its unfairness, the dismissal was declared
appropriate, and in supplication it was confirmed considering that the installation of the
cameras covered the trial of proportionality to justify its legality and not
violation of fundamental rights.


In amparo, the TC denies the amparo taking into account that the camera was located
in the place where the labor provision was developed, focusing directly on the
box, considering that it has been adequately weighted that the installation and employment
of means of capturing and recording images by the company have respected the

right to personal privacy since the installation was a justified measure.

What is decisive is therefore compliance by the employer with the legal provisions in
data protection and worker information that justifies the use of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/23








recordings to prove the origin of the dismissal.


It is therefore essential the duty of information that in this case is recognized.

The requested party provides the following documentation:

. It provides a document that the claimed party calls the “Conciliation Document”,

although it is not the conciliation act. Actually, it is a document prepared
by the claimant, in which there is a stamp of the General Directorate of
Employment and Training of the Principality of Asturias and a handwritten indication with the
text “Presented in the conciliation act. ***DATE.3…” and two signatures that are not
identify.


In this document, regarding the reasons for the dismissal, the claimant states:

“The referenced voice recordings coming from a security camera
security installed inside the company, are proof of my despair at not being able to
do my job well because of the lack of training in this regard”.

“That same camera records the conversation with a client who told me that I was

much more competent than the other girl… and I commented to her… that she couldn't perform some
works correctly because of one of the company machines.”

In said document, the claimant requests compensation "for violation of
fundamental rights for making audio recordings from cameras
installed in the workplace.


. Decree of the Labor Court ***JUZGADO.1, dated 06/01/2021, in which the
approves the conciliation reached between the parties. This Decree indicates that the
claimant filed a dismissal claim against the claimed party on the date
***DATE.4, and that the claimed party acknowledges the unfairness of the dismissal.


SIXTH: On 06/27/2022, a resolution proposal was formulated in the sense
Next:

1. That the claimed party be penalized for a violation of Article 6 of the GDPR,

typified in Article 83.5.a) of the GDPR, and classified as very serious for the purposes of
prescription in article 72.1.b) of the LOPDGDD, with a fine of 6,000 euros (six
a thousand euros).

2. That the claimed party be imposed, within the term to be determined, the adoption of

the necessary measures to adapt their actions to the regulations for the protection of
personal data, with the scope expressed in the Fundamentals of Law of the
resolution proposal.

SEVENTH: On 08/08/2022, a written statement of allegations to the proposal of

resolution prepared by the claimed party, in which, basically, it reproduces the
arguments set forth in their allegations at the opening of the proceeding, some of
literally, to request the file of the procedure again. Besides what
expressed in his allegations at the opening of the proceeding, the defendant
makes the following considerations:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/23









. None of the data that is said to be captured by the audio has been used, beyond
from a conversation with a client, which was learned through other means.


. The reference to the conversation is only credited by a whatsapp. However, bliss
conversation could not be heard by anyone, so it does not exist to the
effects of the procedure. The conversation was obtained by the interlocutor (the client),
who was the one who communicated its content. The fact that the conversation
appears in the dismissal letter does not presuppose that it was known

by an audio recording and since this recording does not exist, you cannot continue
maintaining that it was captured by the cameras. Nor has the complaining party
heard or seen the recording because it does not exist.

. The procedure does not prove that there was an audio recording containing

personal information.

. The dismissal was unfair and it is not true that it was caused by the content of the
voice recordings from the video surveillance system, it was only one of the
essential aspects contained in the dismissal letter.


. “…audio basically refers to the sound emitted by the machine to accredit the
bad manipulation of the same, which will be accredited at the time by means of the
timely expert evidence.

. The instructor follows the dictation of the complaint, despite the fact that the complaining party knew

the recording system.

. The AEPD is intervening in a labor conflict without any justification and without
Clarify which protected data has been violated.


. Had the recording existed, its purpose would have been to obtain the sound of the
machines due to their mishandling.

. No audio has been used for the adoption of a disciplinary dismissal.



Of the actions carried out in this procedure and of the documentation
in the file, the following have been accredited:


                                PROVEN FACTS



1. The claimed party is responsible for the video surveillance system installed in the
place where it develops its economic activity, ***ADDRESS.1.


2. The complaining party provided services as an employee of the responding party. Such
Services were provided in the premises where the system is installed.
video surveillance outlined in the First Proven Fact.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/23








3. In relation to the video surveillance system outlined in the Proven Fact
First, the Respondent provided the Complainant with two documents

notices with the labels “Inform workers about the installation of
cameras (Labor Control)” and “Informative Manual on the use of security systems
video surveillance".

In the first of them, which was delivered to the claimant on ***DATE.2,

the installation of the surveillance camera is communicated "for the purposes: to guarantee
the safety of workers, customers, users and all those who
attend the interior of the company's facilities and to carry out a control of
work performance of the workers of the company, during the development of the
characteristic functions of his position. In the same document it is added "that the

information obtained and stored by recording system will be used
exclusively for the purposes of prevention, security, work performance control and
protection of people and goods that are in the establishment or installation
subject to protection”.


The document "Informative Manual on the use of video surveillance systems", in the
containing the handwritten signature of the complaining party, includes, among other things, the
following information:

“The use of cameras or camcorders for security purposes, implies in any case the
capture, recording and storage of images that may contain character data
staff.
Capture or recording may consist of an image system, associated or not with the

voice pickup.
Both the physical image and the voice of people constitute personal data…”.

. The claimed party, in its response to the claim transfer process,
stated to this AEPD that the video surveillance system described in the Fact

Tested First it has sound capture, as well as image capture.

In this same response, the claimed party refers to the recording of a
conversation held by the complaining party with "the clientele".


. Dated ***DATE.1, the complaining party served the complaining party with a letter
through which the termination of the employment relationship is communicated (dismissal letter).


                           FUNDAMENTALS OF LAW


                                            Yo
                                     Competition

In accordance with the powers that article 58.2 of Regulation (EU) 2016/679

(General Data Protection Regulation, hereinafter GDPR), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
LOPDGDD, is competent to initiate and resolve this procedure the Director of the
Spanish Data Protection Agency.


Likewise, article 63.2 of the LOPDGDD determines that: "Procedures
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/23








processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions

regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures”.


                                            II

                        The image and voice are personal data

The physical image and voice of a person, according to article 4.1 of the GDPR, are a
Personal data and its protection, therefore, is the subject of said Regulation. In the article
4.2 of the GDPR defines the concept of "processing" of personal data.


The images and voice captured by a system of cameras or video cameras are data
of a personal nature, so its treatment is subject to the regulations of
Data Protection.


It is, therefore, pertinent to analyze whether the processing of personal data (image and voice
of the complaining party, who served as an employee in the company of the complaining party
claimed, and of the natural persons who come as clients to the establishment of
said company, open to the public) carried out through the system of
denounced video surveillance is in accordance with the provisions of the GDPR.



                                            II
                                        Infringement


Article 6.1 of the GDPR establishes the assumptions that allow the use of
processing of personal data.

The permanent implantation of a system of video cameras for reasons of
security has a legitimate basis in the LOPDGDD, the explanatory statement of which indicates:


“Together with these assumptions, others are included, such as video surveillance… in which the legality of the
treatment comes from the existence of a public interest, in the terms established in the
Article 6.1.e) of Regulation (EU) 2016/679”.

Regarding treatment for video surveillance purposes, article 22 of the LOPDGDD
establishes that natural or legal persons, public or private, may carry out

carry out the treatment of images through systems of cameras or video cameras
in order to preserve the safety of people and property, as well as their
installations.

This same article 22, in its section 8, provides that "The treatment by the

Employer data obtained through camera or video camera systems will be
submits to the provisions of article 89 of this organic law”.

On the legitimacy for the implementation of video surveillance systems in the field
labor, Royal Legislative Decree 1/1995, of 03/24, is taken into account, which approves

the revised text of the Workers' Statute Law (LET), whose article 20.3
notes:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/23










"3. The employer may adopt the measures he deems most appropriate for surveillance and control
to verify compliance by the worker with his labor obligations and duties,
keeping in their adoption and application due consideration to their dignity and taking into account
account, where appropriate, the real capacity of workers with disabilities.

The permitted surveillance and control measures include the installation of

security cameras, although these systems should always respond at first
of proportionality, that is, the use of video cameras must be proportional to the purpose
pursued, this is to guarantee the security and the fulfillment of the obligations and
job duties.


Article 89 of the LOPDPGDD, referring specifically to the "right to privacy
against the use of video surveillance and sound recording devices in the place
work" and the processing of personal data obtained with camera systems or
video cameras for the exercise of control functions of the workers, allows

that employers can process the images obtained through security systems
cameras or camcorders for the exercise of the functions of control of the
workers or public employees provided for, respectively, in article 20.3
of the Workers' Statute and in the civil service legislation, provided that

These functions are exercised within its legal framework and with the limits inherent to the
same.

In relation to sound recording, the aforementioned article 89 of the LOPDGDD

sets the following:

"two. In no case will the installation of sound recording systems or
video surveillance in places intended for the rest or recreation of workers or
public employees, such as locker rooms, toilets, dining rooms and the like.
3. The use of systems similar to those referred to in the previous sections for the
sound recording in the workplace will be allowed only when relevant

risks to the safety of facilities, goods and people derived from the activity
that it takes place in the workplace and always respecting the principle of proportionality,
the minimum intervention and the guarantees provided for in the previous sections. the deletion
of the sounds preserved by these recording systems will be made according to the
provided in section 3 of article 22 of this law”.

On the other hand, it is interesting to note that, according to the doctrine of the Constitutional Court, the

recording conversations between workers or between them and customers is not justified
for the verification of compliance by the worker with his obligations or duties.
In a Judgment dated 04/10/2000 (2000/98), issued in rec. num. 4015/1996, it
declares the following:


In this sense, it must be taken into account that the managerial power of the employer,
essential for the smooth running of the productive organization and expressly recognized
in the art. 20 LET, attributes to the employer, among other powers, that of adopting the measures that
deems more appropriate surveillance and control to verify the worker's compliance with
their labor obligations (art. 20.3 LET). But this faculty must be produced in any case,
As is logical, within due respect for the dignity of the worker, as we expressly
It is reminded by the labor regulations (arts. 4.2.e and 20.3 LET)...


... it should be remembered that the jurisprudence of this Court has repeatedly insisted on the
full effectiveness of the fundamental rights of the worker in the framework of the relationship
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/23









labor, since this cannot imply in any way the deprivation of such rights for
those who serve in productive organizations... Consequently, and as
This Court has also affirmed, the exercise of such rights only admits

limitations or sacrifices to the extent that it develops within an organization
which reflects other constitutionally recognized rights in arts. 38 and 33 CE and that
It imposes, according to the assumptions, the necessary adaptability for the exercise of all of them...

For this reason, the premise from which the Judgment under appeal starts, consisting of
affirm that the workplace is not by definition a space in which the

workers' right to privacy, in such a way that the conversations that
maintain workers with each other and with customers in the performance of their work activity
They are not covered by art. 18.1 EC and there is no reason why the company cannot
know the content of those, since the aforementioned right is exercised in the field of
private sphere of the worker, that in the workplace it must be understood limited to the
places of rest or recreation, changing rooms, toilets or the like, but not to those

places where work is carried out...

…Such a statement is rejectable, since it cannot be ruled out that also in those
places of the company where the work activity is carried out may produce
illegitimate interference by the employer in the right to privacy of the
workers, such as the recording of conversations between a worker and a

client, or between the workers themselves, in which issues unrelated to the relationship are addressed
that are integrated into what we have called the sphere of development of the
individual (SSTC 231/1988, of December 2, FJ 4 and 197/1991, of October 17, FJ 3, by
all). In short, it will be necessary to attend not only to the place in the workplace where they are installed
by the company audiovisual control systems, but also to other elements of judgment (if

the installation is done or not indiscriminately and massively, if the systems are visible or have
been installed surreptitiously, the real purpose pursued with the installation of such
systems, if there are security reasons, by the type of activity that takes place in the
workplace in question, which justifies the implementation of such means of control, etc.)
to elucidate in each specific case whether these means of surveillance and control respect the right
to the privacy of workers. Certainly, the installation of such means in places of

rest or recreation, changing rooms, toilets, dining rooms and the like is, a fortiori, harmful
in any case, the right to privacy of workers, without further consideration, for
obvious reasons... But this does not mean that this injury cannot occur in those places
where the work activity is carried out, if any of the circumstances set out that
allows classifying business action as an illegitimate intrusion into the right to privacy
from the workers. It will be necessary, then, to attend to the concurrent circumstances in the supposed

concrete to determine whether or not there is a violation of art. 18.1 EC.

…its limitation [of the fundamental rights of the worker] by the powers
business can only derive well from the fact that the very nature of work
contracted involves the restriction of the right (SSTC 99/1994, FJ 7, and 106/1996, FJ 4), either
an accredited business need or interest, without its mere invocation being sufficient to

sacrifice the fundamental right of the worker (SSTC 99/1994, FJ 7, 6/1995, FJ 3 and 136/1996,
FJ 7)…

These limitations or modulations must be the indispensable and strictly
necessary to satisfy a business interest deserving of guardianship and protection, in a manner

that if there are other possibilities of satisfying said interest that are less aggressive and affect the
right in question, it will be necessary to use the latter and not those more aggressive and
affective. It is, ultimately, the application of the principle of proportionality...

The question to be resolved is, therefore, whether the installation of microphones that allow the recording of
conversations of workers and customers in certain areas... fits in the assumption

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/23








that occupies us with the essential requirements of respect for the right to privacy. To the
In this regard, we must begin by pointing out that it is indisputable that the installation of devices

for capturing and recording sound in two specific areas... it is not without utility for the
business organization, especially if one takes into account that these are two areas in which
economic transactions of some importance take place. Now, the mere utility
or convenience for the company does not simply legitimize the installation of hearing aids and
recording, given that the company already had other security systems than the
Hearing system is intended to complement…

In summary, the implementation of the audition and recording system has not been in this case

in accordance with the principles of proportionality and minimum intervention that govern modulation
of fundamental rights due to the requirements of the interest of the organization
business, since the purpose pursued (to provide extra security, especially in the face of
eventual customer claims) is disproportionate to the sacrifice that
implies the right to privacy of workers (and even customers...). This system
allows you to capture private comments, both from customers and workers...,
comments completely unrelated to business interest and therefore irrelevant from the
perspective of control of labor obligations, being able, however, to have

negative consequences for workers who, in any case, will feel constrained
to make any type of personal comment given the conviction that they are going to be
heard and recorded by the company. It is, in short, an illegitimate interference in the
right to privacy enshrined in art. 18.1 CE, since there is no definitive argument that
authorize the company to listen and record the private conversations that the workers…
keep with each other or with customers.”


On the other hand, the processing of personal data is subject to the rest of the
principles of treatment contained in article 5 of the GDPR. We will highlight the
principle of data minimization contained in article 5.1.c) of the GDPR that
provides that personal data shall be "adequate, relevant and limited to what is
necessary in relation to the purposes for which they are processed”.


This means that in a specific treatment only the data can be processed
timely personal, that come to the case and that are strictly necessary
to fulfill the purpose for which they are processed. Treatment must be adjusted and

proportional to the purpose to which it is directed. The relevance in the treatment of
data must occur both at the time of data collection and at the time of
subsequent treatment carried out on them.


In accordance with the above, the processing of excessive data must be restricted or
proceed to their deletion.

The application of the principle of data minimization to the case examined entails
that the installed camera or camcorder system cannot obtain images

affecting the privacy of employees, making it disproportionate to capture
images in private spaces, such as changing rooms, lockers or rest areas
of workers.


                                             IV.
                       Video surveillance obligations

In accordance with the foregoing, the processing of images through a system

video surveillance, to comply with current regulations, must comply with the
following requirements:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/23









1.- Individuals or legal entities, public or private, can establish a system
video surveillance in order to preserve the safety of people and property,

as well as its facilities.

It must be assessed whether the intended purpose can be achieved in another less
intrusive to the rights and freedoms of citizens. Personal data only
should be processed if the purpose of the processing cannot reasonably be achieved by
other means, recital 39 of the GDPR.


2.- The images obtained cannot be used for a subsequent purpose
incompatible with the one that motivated the installation of the video surveillance system.

3.- The duty to inform those affected provided for in articles

12 and 13 of the GDPR, and 22 of the LOPDGDD.

In this sense, article 22 of the LOPDGDD provides in relation to video surveillance
a “layered information” system.

The first layer must refer, at least, to the existence of the treatment

(video surveillance), the identity of the person responsible, the possibility of exercising the rights
provided for in articles 15 to 22 of the GDPR and where to obtain more information about the
processing of personal data.

This information will be contained in a device placed in a sufficiently

visible and must be provided in advance.

Second layer information should be easily available in one place
accessible to the affected person, whether it is an information sheet at a reception, cashier, etc…,
placed in a visible public space or in a web address, and must refer to the

other elements of article 13 of the GDPR.

4.- Images of the public thoroughfare cannot be captured, since the treatment of
images in public places, unless there is government authorization, only
It can be carried out by the Security Forces and Bodies.


On some occasions, for the protection of private spaces, where
cameras installed on facades or inside, may be necessary to ensure the
security purpose the recording of a portion of the public thoroughfare.

That is, cameras and camcorders installed for security purposes may not

obtain images of public roads unless it is essential for said purpose, or
it is impossible to avoid it due to their location. And in such a case
extraordinary, the cameras will only be able to capture the minimum portion necessary to
preserve the safety of people and property, as well as its facilities.


Installed cameras cannot get images from third-party proprietary space
and/or public space without duly accredited justified cause, nor can they affect
the privacy of passers-by who move freely through the area.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/23








It is not allowed, therefore, the placement of cameras towards the private property of
neighbors with the purpose of intimidating them or affecting their private sphere without cause
justified.


In no case will the use of surveillance practices beyond the environment be admitted.
object of the installation and in particular, not being able to affect public spaces
surroundings, adjoining buildings and vehicles other than those that access the space
guarded.


Images cannot be captured or recorded in spaces owned by third parties without the
consent of their owners, or, where appropriate, of the people who are in them
find.

It is disproportionate to capture images in private spaces, such as

changing rooms, lockers or rest areas for workers.

5.- The images may be kept for a maximum period of one month, except in
those cases in which they must be kept to prove the commission of acts
that threaten the integrity of people, property or facilities.


In this second case, they must be made available to the authority
competent authority within a maximum period of 72 hours from the knowledge of the
recording existence.

6.- The controller must keep a record of processing activities

carried out under his responsibility in which the information to which he makes
reference article 30.1 of the GDPR.

7.- The person in charge must carry out a risk analysis or, where appropriate, an evaluation
of impact on data protection, to detect those derived from the implementation

of the video surveillance system, assess them and, where appropriate, adopt security measures.
appropriate security.

8.- When a security breach occurs that affects the processing of
cameras for security purposes, whenever there is a risk to the rights and
freedoms of natural persons, you must notify the AEPD within a maximum period of

72 hours.

A security breach is understood to be the destruction, loss or accidental alteration or
unlawful transfer of personal data, stored or otherwise processed, or the
communication or unauthorized access to said data.


9.- When the system is connected to an alarm center, it can only be
installed by a qualified private security company
contemplated in article 5 of Law 5/2014 on Private Security, of April 4.


The Spanish Data Protection Agency offers through its website
[https://www.aepd.es] access to:

    . the legislation on the protection of personal data, including the GDPR

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/23








    and the LOPDGDD (section "Reports and resolutions" / "regulations"),
    . the Guide on the use of video cameras for security and other purposes,

    . the Guide for compliance with the duty to inform (both available at the
    section "Guides and tools").

It is also of interest, in case of carrying out low-risk data processing, the
free tool Facilitates (in the "Guides and tools" section) that, through

specific questions, allows to assess the situation of the person in charge with respect to the
processing of personal data that it carries out, and where appropriate, generate various
documents, informative and contractual clauses, as well as an annex with measures
indicative security considered minimum.



                                            V
                                administrative infraction

The claim is based on the alleged illegality of the installed video surveillance system

by the claimed party in the premises where it carries out its business activity, in
related to sound recording.

It is not disputed in this case the fact that the claimed party is the owner and
responsible for the reported video surveillance system and, therefore, the person responsible for

the data processing involved in the use of said system. And neither does he
fact that among the data processing carried out is the collection and
storage of personal data relating to the voice of employees and customers.

It is proven in the proceedings, likewise, that said installation is carried out with

safety and labor control purposes.

For this reason, on ***DATE.2, the claimed party communicated to the party
claimant the installation of the surveillance camera “for the purposes: to guarantee the
safety of workers, customers, users and all those who

attend the interior of the company's facilities and to carry out a control of
work performance of the workers of the company, during the development of the
characteristic functions of his position. In the same document delivered to the party
claimant, in which his handwritten signature and the indicated date appear, also
handwritten, it is added "that the information obtained and stored through the

recording will be used exclusively for purposes of prevention, security, control of
work performance and protection of people and goods that are in the
establishment or installation subject to protection”.

It is on record that the claimant was provided with a document labeled "Manual

information on the use of video surveillance systems”, which includes, among other things, the
following information:

“The use of cameras or camcorders for security purposes, implies in any case the
capture, recording and storage of images that may contain character data
staff.
Capture or recording may consist of an image system, associated or not with the
voice pickup.

Both the physical image and the voice of people constitute personal data…”.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/23









This is the only information provided to the complaining party about the recording of

sounds, which is not conclusively presented (“may consist”; “associated or not”)
so that the interested party can be certain about the capture and recording of
personal data related to the voice of the workers.


In its statement of allegations at the opening of the proceeding, the claimed party indicates
that the complaining party admits having been aware of the installation of the system
of video and voice in the document that it provides with said allegations and that
called “Reconciliation Document”. However, in this document, prepared
by the complaining party, it only refers to the recording of a

conversation with a client through the aforementioned system, but it does not refer
any to the specific fact of having had prior and certain knowledge of the installation
of a sound recording system.


In addition, the claimed party does not provide sufficient justification for these treatments.
of data (sound recording), limiting itself to presenting the capture of sounds
as the exercise of the employer's right to "establish the measures that he deems
more timely monitoring and control to verify compliance by the worker
of their labor obligations and duties”.


The claimed party does not take into account the limits set forth in article 20.3 of the Law
the Workers' Statute (LET); what is established in article 89.3 of the
LOPDGDD, which admits the recording of sounds only when they are
relevant risks and respecting the principles of proportionality and intervention

minimal; nor the doctrine of the Constitutional Court, already expressed, according to which the
recording conversations between workers or between them and customers is not justified
for the verification of compliance by the worker with his obligations or duties.


In response to the allegations made by the defendant regarding the
possibilities in terms of adopting surveillance measures attributed to the
entrepreneur his power of direction, it is interesting to highlight some of the aspects
declared in the Judgment of the Constitutional Court dated 04/10/2000, reviewed
in the Foundation of Law III:


"...this power must occur in any case, as is logical, with due respect for the
dignity of the worker, as the labor regulations expressly remind us (arts. 4.2.e and
20.3 LET)…”.

"It must therefore be rejected... that the conversations that the workers maintain with each other and
with clients in the performance of their work activity are not covered by art.
18.1…”.


“…its limitation [of the fundamental rights of the worker] by the powers
business can only derive well from the fact that the very nature of work
contracted involves the restriction of the right (SSTC 99/1994, FJ 7, and 106/1996, FJ 4), either
an accredited business need or interest, without its mere invocation being sufficient to
sacrifice the fundamental right of the worker (SSTC 99/1994, FJ 7, 6/1995, FJ 3 and 136/1996,
FJ 7)…

These limitations or modulations must be the indispensable and strictly
necessary…”.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/23









“…the mere utility or convenience for the company does not simply legitimize the installation of the
listening and recording equipment, given that the company already had other
security systems that the hearing system intends to complement…”.

The claimed party states that the images captured by the

video surveillance made it possible to demonstrate that the complaining party misused
the company's machinery and caused loss of material and time, which led to
interest in activating sound recording for further monitoring
exhaustive to the claimant, as a company worker.


It does not explain, on the other hand, what the recording of conversations between the
complaining party and clients, in order to prove those circumstances, which do not
contribute the mere recording of images, so that it is not sufficiently estimated
substantiated the activation of the sound recording system referred to in the
claimed part. This is in the event that the events occur as indicated.
by the defendant, who has not provided any evidence in this regard. What does exist is

that there was a recording of a conversation between the complaining party and a
client.

Nor has it provided any proof of the circumstances that
allegedly determined the collection of voice data from the complaining party. Neither

Even such circumstances were asserted against the claim for dismissal
unfair.

Faced with the opening of the procedure, the defendant emphasizes, on the other hand, that
the audio recording was carried out in accordance with the provisions of article 89

of the LOPDGDD given that said recording was not made in places intended for
rest or in places where private conversations took place. However, not
takes into account the claimed party that this article, beyond the prohibition of
use these video surveillance and sound recording systems in "places
intended for the rest or recreation of workers or public employees,
such as changing rooms, toilets, dining rooms and the like”, expressly and with character

In general, it establishes the submission of such systems to the legal framework and with the limits
inherent to it, already indicated above (those provided for in article 20.3 of
the Workers' Statute Law (LET); what is established in article 89.3 of the
LOPDGDD; and the doctrine of the Constitutional Court, which does not admit the recording of
conversations between workers and customers to verify compliance by

the worker of his obligations or duties). This implies that it cannot be understood
as legitimate, without further condition, any system that does not include those spaces,
as claimed by the defendant.

Also in his statement of allegations at the opening of the proceeding, the party

claimed invokes a Constitutional Court Judgment 39/2016, of
03/03/2016, in which the amparo appeal filed by a person is dismissed
who was dismissed based on images captured by a security camera
video surveillance. It is, however, a case in which audio is not captured and in
which duly justified the proportionality of the measure adopted by the
employer, taking into account the concurrent circumstances in the analyzed case (“the

filming was confined to the observation of the space in which the box was located
register, examining its handling by the employees having been warned from
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/23








substantial mismatches in its accounting some time ago”).

Subsequently, in its pleadings to the resolution proposal, the party

The defendant denies that there is any audio recording, despite the fact that in its
earlier writings acknowledged such existence and that the repeated audio recording
is expressly cited in the dismissal letter provided to the proceedings by the party
claimant.

Specifically, in its response to the transfer process, the defendant

admits that the system has audio capture and that this option was activated
to follow up on the complaining party. In the same writing it is done
reference to the complaints that the complaining party expresses to the clientele about the state
of the machinery (after warning about the misuse of the machinery that performs the
complaining party and admitting the activation of the audio, it is indicated: "In the following days

another fact is observed, the worker complains to the clientele about the machinery of the
business…").

The mere fact of activating the sound recording already implies in itself a collection
of personal data related to the voice of the complaining party that requires a database
legitimate to carry it out.


In addition, in the dismissal letter prepared by the claimed party it is indicated
expressly the following:

"4. Finally, also discovered in the recordings reviewed yesterday, it was

listen to a conversation on March 4, 2022, in which you complain to a
client about the state of the machinery…”.

Consequently, in this case, voice capture is understood to be disproportionate.
both of the complaining party and of clients of the claimed party for the function of

intended video surveillance, for the control of compliance by the complaining party of
their job obligations and duties. It is taken into account that the voice recording
It represents a further intrusion into privacy.

Lastly, it should be noted that this conclusion is in no way affected by the fact that the party
claimed will accept as unfair the dismissal of the claiming party, without making

worth repeat recording. The determining factor for the purposes of this proceeding
is that the processing of the complaining party's voice data was carried out by the
claimed party without any legal basis that legitimizes said data processing.

Therefore, it is considered that the claimed party carried out data processing without

have a legitimate basis, contrary to the provisions of article 6 of the GDPR, which
that supposes the commission of an infraction typified in article 83.5 of the RGPD, which
provides the following:

Violations of the following provisions will be sanctioned, in accordance with the

paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/23









a) the basic principles for the treatment, including the conditions for the
consent in accordance with articles 5, 6, 7 and 9;”.


For the purposes of the limitation period for infringements, the infringement indicated in the
previous paragraph is considered very serious in accordance with article 72.1.b) of the LOPDGDD,
which states that:

"Based on what is established in article 83.5 of Regulation (EU) 2016/679,

are considered very serious and will prescribe after three years the infractions that
a substantial violation of the articles mentioned therein and, in particular, the
following:

b) The processing of personal data without the fulfillment of any of the conditions of

legality of the treatment established in article 6 of Regulation (EU) 2016/679”.


                                           SAW
                                        Sanction


Article 58.2 of the GDPR establishes:

"Each control authority will have all the following corrective powers
indicated below:
(...)

d) order the person in charge or person in charge of treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate,
in a certain way and within a specified period;
(...)
i) impose an administrative fine in accordance with article 83, in addition to or instead of

the measures mentioned in this paragraph, according to the circumstances of each
particular case".

According to the provisions of article 83.2 of the GDPR, the measure provided for in article
58.2.d) of the aforementioned Regulation is compatible with the sanction consisting of a fine
administrative.


With regard to violations of Article 6 of the GDPR, based on the facts
exposed and without prejudice to what results from the instruction of the procedure, it is
considers that the sanction that should be imposed is an administrative fine.


The fine imposed must be, in each individual case, effective, proportionate
and dissuasive, in accordance with the provisions of article 83.1 of the GDPR.

In order to determine the administrative fine to be imposed, the
provisions of article 83.2 of the GDPR and article 76 of the LOPDGDD, regarding the

section k) of the aforementioned article 83.2 GDPR.

The following graduation criteria are considered concurrent as aggravating factors:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/23








. Article 83.2.b) of the GDPR: "b) intentionality or negligence in the infringement".

The installation of an audio recording system and its use to record the

conversations that the complaining party could have had with other people
It is done at the initiative of the claimed party, intentionally.

. Article 83.2.d) of the GDPR: "d) the degree of responsibility of the controller or the
processor, taking into account the technical or organizational measures that
applied by virtue of articles 25 and 32”.


The claimed party does not have adequate procedures in place for action in
the collection and processing of personal data, in what refers to the
collection and processing of personal data relating to the voice of the employee
in your company, so that the violation is not the result of an anomaly in the

operation of these procedures but a defect in the management system of the
personal data designed by the person in charge.

Likewise, the following circumstances are considered mitigating:

. Article 83.2.a) of the GDPR: "a) the nature, seriousness and duration of the infringement,

taking into account the nature, scope or purpose of the processing operation
in question as well as the number of interested parties affected and the level of damage and
damages they have suffered”.

    . The number of interested parties: the use of the video surveillance system to

    labor control affects only the complaining party, as it is the only
    a worker of the company at the time the events take place.

. Article 76.2.b) of the LOPDGDD: "b) The link between the offender's activity and the
processing of personal data”.


The scarce connection of the claimed party with the performance of treatment of
personal data, considering the activity carried out.

. Article 83.2.k) of the GDPR: "k) any other aggravating or mitigating factor applicable to
the circumstances of the case, such as the financial benefits obtained or the losses

avoided, directly or indirectly, through the infringement”.

    . The status of microenterprise of the claimed party, which develops its activity
    business as private
    . The low volume of data and processing that constitutes the object of the

    proceedings.

Considering the exposed factors, the valuation reached by the fine for the
Violation of article 6 of the GDPR is 6,000 euros (six thousand euros).


It should be noted that the defendant has not made any claim against
the factors and graduation criteria set forth.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/23








                                          VII
                                       Measures


Considering the declared infringement, it is appropriate to impose the person responsible (the party
claimed) the adoption of appropriate measures to adjust its performance to the
regulations mentioned in this act, in accordance with the provisions of the aforementioned article
58.2 d) of the GDPR, according to which each control authority may “order the
controller or processor that the processing operations are
comply with the provisions of this Regulation, where appropriate, in a

certain manner and within a specified period…”.

The text of the resolution establishes which have been the infractions committed and
the facts that have given rise to the violation of the regulations for the protection of
data, from which it is clearly inferred what are the measures to adopt, without prejudice

that the type of procedures, mechanisms or concrete instruments for
implement them corresponds to the sanctioned party, since it is responsible for the
treatment who fully knows its organization and has to decide, based on the
proactive responsibility and risk approach, how to comply with the GDPR and the
LOPDGDD.


However, in this case, regardless of the foregoing, it is agreed to require the
responsible so that, within the period indicated in the operative part, it proves that
proceeded to suppress the capture of sounds by the object video surveillance system
of the performances.


It is noted that not meeting the requirements of this body may be
considered as an administrative offense in accordance with the provisions of the GDPR,
classified as an infraction in its article 83.5 and 83.6, being able to motivate such conduct the
opening of a subsequent administrative sanctioning procedure.



Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been accredited,
the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE B.B.B., with NIF ***NIF.1, for a violation of Article 6 of the

GDPR, typified in Article 83.5.a) of the GDPR, and classified as very serious to
effects of prescription in article 72.1.b) of the LOPDGDD, a fine of 6,000
euros (six thousand euros).

SECOND: REQUEST B.B.B., within a month, counted from the

notification of this resolution, adapt its action to the regulations of
protection of personal data, with the scope expressed in the Basis of
Law VII, and justify before this Spanish Data Protection Agency the
attention to this requirement.


THIRD: NOTIFY this resolution to B.B.B..

FOURTH: Warn the sanctioned party that he must enforce the sanction imposed
Once this resolution is enforceable, in accordance with the provisions of Article

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 23/23








art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved

by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of its income, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, open in the name of the Agency
Spanish Data Protection Agency at the bank CAIXABANK, S.A.. In the event
Otherwise, it will proceed to its collection in the executive period.


Once the notification has been received and once executed, if the execution date is
between the 1st and 15th of each month, both inclusive, the term to make the payment
voluntary will be until the 20th day of the following or immediately following business month, and if
between the 16th and the last day of each month, both inclusive, the payment term

It will be until the 5th of the second following or immediately following business month.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.

Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reversal before the
Director of the Spanish Agency for Data Protection within a period of one month from
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the

National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.


Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through

of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal

contentious-administrative proceedings within a period of two months from the day following the
Notification of this resolution would terminate the precautionary suspension.
                                                                                938-120722
Mar Spain Marti
Director of the Spanish Data Protection Agency






C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es