AEPD (Spain) - PS/00306/2019

AEPD - PS/00306/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	15.06.2020
Fine:	2000 EUR
Parties:	n/a
National Case Number/Name:	PS/00306/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	Miguel Garrido de Vega

15 June 2020 - The Spanish Data Protection Agency (AEPD) decided to impose a fine up to 2,000 € on Café Bar Nina (Nina CB) for the non-adequate installation of a video surveillance system pointing to a common area of a housing association without authorization, and the consequent infringement of the data minimisation principle related, as per Article 5(1)(c) GDPR.

English Summary

Facts

The decision is the consequence of a complaint submitted by a Spanish housing association stating that the defendant has installed a video surveillance system allegedly pointing, without authorization, to tenants and other individuals of the housing association; such complaint included pictures proving that the video surveillance system was installed. The defendant had already been warned by the AEPD in the past for the same fact.

Dispute

The defendant did not answer to any AEPD investigation requests (not in the past and neither now), so the AEPD started the corresponding sanction procedure with the collaboration of the police. During its investigations, the AEPD discovered that (i) there is no information poster at the premises nor information clauses on such processing activity, that (ii) there is a total of six cameras in the premises of the defendant, one of them located outdoors and pointing to a common area from which it can obtain images from the pedestrians, and that (iii) there is no authorization from the housing association (nor any explanations to its president have been given) for the installation of such video surveillance system pointing to common areas.

Holding

Thus, the AEPD understood that the video surveillance system has infringed the data minimisation principle and, after considering some circumstances [(i) the surveillance system is recording to a common area without authorization nor information poster, (ii) there is intentionality, as the defendant had been warned in the past for the same fact, (iii) the defendant is a small business with low knowledge on data protection matters], it decided to impose a fine of 2,000 € to the defendant. The AEPD also requires the defendant to correct the pointing of the video surveillance system. Additionally, the AEPD also reminds that, in case the defendant does not comply with these requirements, this could lead to new investigation and sanction procedures.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

 Procedure Nº: PS / 00306/2019938-051119RESOLUTION OF PENALTY PROCEDUREOf the procedure instructed by the Spanish Agency for Data Protection andbased on the followingACTSFIRST: On 10/15/2018 it had entry into this Spanish Agency ofData Protection a document submitted by COM. OF PROP. RESIDENTIALCAMPUS *** NUMBERS. 1 (* hereinafter, the claimant), by means of which he formulatesclaim against CAFE BAR NINA (Nina Cb), (hereinafter, the claimed), by theinstallation of a video surveillance system installed in Soportales *** ADDRESS.1 ,there being indications of a possible breach of the provisions of art. 5.1 c)RGPD.The reasons underlying the claim and, where appropriate, the documentscontributed by the claimant are the following:“Presence of camera not authorized by the Community of owners thatcould affect the rights of tenants and third parties without just cause ”(folio nº 1).Documentary evidence (Doc. Nº1) that accredits the installation of thevideo surveillance camera on top of a pillar allegedly oriented towards the areaof access to your establishment.SECOND: Prior to the admission of this claim to be processed,transferred the claimed, in accordance with the provisions of article 65.4 the LawOrganic 3/2018, of December 5, Protection of Personal Data and guarantee ofdigital rights (hereinafter LOPDGDD). The result of this action isdescribed below."No reply has been received in this regard"THIRD: The claim was admitted for processing by resolution dated11/06/2018.FOURTH: Consulted the database of this organism there is a precedent associatedrelated to the procedure with reference number *** REFERENCE. 1 , which ended withthe following pronouncement:"APPRECIATE ( *** REFERENCE.1 ) to Ms. AAA and D. BBB as responsibleof the video surveillance system installed in the establishment called “ BARNINA ”located at *** ADDRESS.1 , in accordance with the provisions of article 45.6 ofC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/8the LOPD, in relation to the complaint for violation of article 6.1 of the LOPD, typifiedas serious in article 44.3.b) of the aforementioned Organic Law ”FIFTH: Consulted the database of this organism on date 20/01/20 does not appearany allegation in relation to the facts transferred by this body.SIXTH: On 01/20/20, the collaboration of the Forces andState Security Corps (National Police-Granada) so that transferred to theplace of the facts, prove them, as well as if the establishment showsactivity, making all the necessary inquiries about it.SEVENTH: On 02/13/20, the Office of the Police-Unit General Directorate was receivedTerritorial Private Security - (Granada) that travels to the scenenoting the following:-That the owner of the Cafeteria "Nina" is the Sociedad Hermanos Molina SLwith contact email *** EMAIL. 1-That there is no informative poster, stating the owner “thatIt has recently carried out reforms and it does not know where it has left it. ”-That there is no form available to customers in the event thatthese require it.-That the premises have a total of six cameras, two outdoor that collectaccess to the business, although the one located on the left outside if taken asreference the exit from the premises does not work due to a technical problem (frames 1 andtwo).-That inside the premises there are four cameras working, aimed atthe entrance, bar, kitchen and tables (Frames 3,4 and 5).Of the actions practiced in the present procedure and of the documentationworking in the file, the following have been accredited:PROVEN FACTSFirst. On 10/15/18, a claim against the establishment was received at this Agency.lie Café Bar Nina, motivated by the installation of a camera that could bePoorly oriented, affecting the right of third parties without just cause.Second. There is no evidence that it has the required informative poster indicating-Since it is a video-monitored area, informing the person responsible for thesystem, an aspect verified by the acting force displaced to the scene.Third. It is an established fact that there is no information form (s) availablesition of any client of the establishment that may require it.Fourth. According to the evidence provided, the camera is oriented in such a way thatMite capture image (data) of third parties without just cause.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/8The outer camera affects a transit area, allowing images to be obtained.of pedestrians, lacking an informative poster where the end is indicateddata processing and the controller.Fifth. There is a previous statement from this body *** REFERENCE. 1 inwhere the denounced entity was received, without any responsehas given for this purpose.Sixth. After consulting the database of this Agency (01/20/20) the notification iselectronic, although the term for access to it has expired, thecontent of the same by the denounced party, no explanation has been given in this regard.Seventh. There is no authorization from the Community of owners for the installationof the outer chamber, in common elements of this, nor has an explanation been accreditedsome to the President of the aforementioned community.Eighth. It is proven that the hotel establishment maintains its activity, inthe address provided, there being no just cause for not receiving the notificationscations of this Agency.FUNDAMENTALS OF LAWIBy virtue of the powers that article 58.2 of Regulation (EU) 2016/679(General Data Protection Regulation, hereinafter RGPD), recognizes eachControl Authority, and as established in articles 47, 48.1, 64.2 and 68.1 of theLOPDGDD, the Director of the Spanish Agency for Data Protection is competentyou to start and solve this procedure.IIIn the present case, we proceed to examine the claim dated 10/15/2018 bymeans of which the following is transferred as the main fact.“Installation of cameras in the garage without having the proper authorization” (folioNo. 1).The events described above may affect thecontent of art.5.1 c) RGPD. "The personal data will be:c) adequate, pertinent and limited to what is necessary in relation to the purposes forthose that are processed ("data minimization").It should be remembered that individuals can install video surveillance camerasalthough they assume the responsibilities that they comply with the provisionscurrent in the matter.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/8Only the community of owners, once the correspondingagreement in the Board of Owners, by a simple majority of those present, mayagree on the installation of a video surveillance system with security cameras inthe common areas of a building (garages, parking, storage rooms, portals ...), at the same timethat the installation of this security camera system will be subject to theobligations implied by the LOPDGDD and RGPD (Duty to Report, principle ofproactive liability, Registration of Treatment Activities etc)Sometimes the protection of private spaces is only possible ifcameras are located in spaces such as facades. Sometimes it is also necessaryario capture the entrances, doors or entrances, so that, although the camera iseven inside the building, it is impossible not to register a minimum part and im-dispensable of the public road, which inevitably is captured.For this exception on the protection of private spaces to be appliedcable, there should be no alternative installation possibility. In these cases, theresponsible for the treatment carried out through cameras will adapt the use of thelation, so that the impact on the rights of third parties (pedestrians) is minimalas possible. In no case will the use of surveillance practices beyond theenvironment object of the installation, not being able to affect the public spaces surroundingdantes, adjoining buildings and vehicles other than those that access the guarded space.IIIIn accordance with the aforementioned, the treatment of images through a systemsubject of video surveillance, to be in accordance with current regulations, you must comply with thefollowing requirements:- Respect the principle of proportionality.- When the system is connected to an alarm center, it can only beinstalled by a private security company that meets the contemplated requirements-two in article 5 of Law 5/2014 on Private Security, of April 4.- Camcorders cannot capture images of people who areoutside the private space where the video surveillance system is installed, sinceImage processing in public places can only be carried out, except thatGovernment authorization concur, by the Security Forces and Bodies. Neitherspaces owned by third parties may be captured or recorded without the consent oftheir owners, or, where appropriate, the people who are in them.This rule admits some exceptions since, on some occasions, for thetection of private spaces, where cameras have been installed on facades or in theindoor, it may be necessary to ensure the security purpose of recordinga portion of the public highway. In other words, the cameras and video cameras installed withSecurity authorities will not be able to obtain images of public roads unless it is impossibledispensable for this purpose, or it is impossible to avoid it due to the location ofthose and, extraordinarily, the minimum space for said end will also be collected.quality. Therefore, cameras could exceptionally capture the smallest portion-mind necessary for the intended security purpose.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/8- The duty to inform those affected as provided in the articles must be fulfilled.12 and 13 of the RGPD, resulting from application -in not contradicting the provisions of thesaid Regulation-, the way provided for in article 3 of Instruction 1/2006, of 8November, from the Spanish Agency for Data Protection, on the Treatmentof Personal Data for Surveillance Purposes through Camera or Video Systemsof cameras.Specifically, at least a different distinction must be placed in the video-monitored areas.informative sign located in a sufficiently visible place, both in open spacesas closed, which will identify, at least, the existence of a treatment, theidentity of the person responsible and the possibility of exercising the rights provided for in saidprecepts. Likewise, the information must be kept available to those affectedto which the aforementioned GDPR refers.- The person responsible must keep a record of treatment activitiesmade under your responsibility in which the information you make is includedReference article 30.1 of the RGPD.- The installed cameras cannot obtain images of private space ofthird and / or public space without duly accredited justified cause, nor canaffect the privacy of passers-by who pass freely through the area. It is not per-therefore, the placement of cameras towards the private property of neighbors withthe purpose of intimidating them or affecting their private environment without just cause.- In no case will the use of surveillance practices be accepted beyond thelathe object of the installation and in particular, not being able to affect public spacesSurrounding buildings, adjoining buildings, and vehicles other than those that access the spacemonitored.In relation to the above, to facilitate the consultation of those interested, the AgencySpanish data protection company offers through its website[https://www.aepd.es] access to personal data protection legislation, including the RGPD and the LOPDGDD (section “Reports and resolutions” / “nor-mativa ”), as well as the Guide on the use of video cameras for security and otheras well as the Guide for the fulfillment of the duty to inform (both availablebles in the section "Guides and tools").It is also of interest, in case of low data processingrisk, the free tool Facilitates (in the “Guides and tools” section), whichby means of specific questions, it allows assessing the situation of the person responsiblepect of the processing of personal data that it carries out, and where appropriate, generating di-verses documents, informative and contractual clauses, as well as an annex withGuidance security measures considered minimal.IVThe corrective powers available to the Spanish Protection AgencyData, as the control authority, are established in article 58.2 of the RGPD. In-Among them are the power to sanction with warning -article 58.2 b) -,C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/8the power to impose an administrative fine pursuant to article 83 of the GDPR-article 58.2 i) -, or the power to order the controller or data controllerthat the processing operations comply with the provisions of the GDPR, whenproceed, in a certain way and within a specified period -article 58. 2d) -.In accordance with the provisions of article 83.2 of the RGPD, the measure provided for in articleArticle 58.2 d) of said Regulation is compatible with the sanction consisting of a fineadministrative.VIn accordance with the evidence available in this proce-sanction, it is considered that the exposed facts do not comply with the establisheddo in art. 5.1 c) RGPD for what could be the typical infringement commission-gives in article 83.5 of the RGPD, which provides the following:"Violations of the following provisions will be sanctioned, in accordance withparagraph 2, with administrative fines of not more than EUR 20 000 000 or,dose of a company, an amount equivalent to a maximum of 4% of the volumetotal global annual business for the previous financial year, opting for theyor amount:a) the basic principles for treatment, including the conditions forsentiment under articles 5, 6, 7 and 9;The reported entity has installed a video surveillance camera in an areaof transit, affecting the rights of third parties, despite the various requirementseffected, lacking the establishment of the informative poster and the correspondingteeth forms available to customers.The installed system processes personal data of third parties, without having a formany available to whoever may request it, not stating the purpose of the worktreatment, nor the person in charge to whom you can go.When motivating the sanction, the following is taken into account:-the nature of the offense when having a video surveillance device,controlling a small space in a transit area, without having an informative signmativo (art. 83.2a) GDPR).-intentionality, given that there is a previous procedure associated with theannounced where it had been Perceived, being published inthe BOE (art. 83.2 b) RGPD).In the present case, it is taken into account that it is a small establishmentneighborhood, as well as the limited knowledge on the subject at hand indata protection matter, all of which justify imposing a sanctionencrypted in the amount of € 2,000, a penalty that is adjusted to the installation by anatural person of this type of devices.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/8It is noted that not meeting the requirements of this body may beconsidered an administrative offense in accordance with the provisions of the RGPD,typified as an offense in its article 83.5 and 83.6, being able to motivate such conduct theopening of a further sanctioning administrative procedure.This does not prevent the specific deficiencies from being corrected simultaneously.tated by the State Security Forces and Corps, providing all the documentationnecessary support for this purpose.Therefore, in accordance with the applicable legislation and the criteria ofgraduation of sanctions whose existence has been proven,the Director of the Spanish Agency for Data Protection RESOLVES:FIRST: IMPOSE CAFE BAR NINA (Nina Cb), for a violation of the article5.1.c) of the RGPD, typified in article 83.5 of the RGPD, a fine of € 2000 (Two ThousandEuros), being punishable in accordance with article 58.2 GDPR.SECOND: NOTIFY this resolution to CAFE BAR NINA (Nina Cb), and IN-FORMING the result of the proceedings to the complaining party COM. OF PROP.RESIDENTIAL CAMPUS *** NUMBERS . 1 ).THIRD: Warn the sanctioned that they must make effective the sanction imposed aonce this resolution is executive, in accordance with the provisions of theart. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co-of Public Administrations (hereinafter LPACAP), within the void payment termluntary established in art. 68 of the General Collection Regulation, approvedby Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,December 17, by entering, indicating the NIF of the sanctioned and the numberof procedure that appears in the heading of this document, in the accountrestricted number ES00 0000 0000 0000 0000 0000 , opened in the name of the Spanish AgencyData Protection Law at Banco CAIXABANK, SA Otherwise, it is pro-will yield to its collection in the executive period.Notification received and once executive, if the date of enforcement isbetween the 1st and 15th of each month, both inclusive, the deadline for making theVoluntary payment will be until the 20th of the following month or immediately the next business day, and ifis between the 16th and last day of each month, both inclusive, the term of thePayment will be until the 5th of the second following month or immediately following business.In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once the interested parties have been notified.Against this resolution, which ends the administrative procedure pursuant to art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPA-CAP, interested parties may file, optionally, appeal for reversal beforethe Director of the Spanish Agency for Data Protection within a month tocount from the day after notification of this resolution or directly resort-administrative litigation before the Administrative Litigation Chamber of theC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 8
8/8National Agency, in accordance with the provisions of article 25 and section 5 of thefourth additional provision of Law 29/1998, of July 13, regulating the Juris-Contentious-administrative diction, within two months from the dayguide to the notification of this act, as provided in article 46.1 of the aforementionedLaw.Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPA-CAP, the firm resolution may be provisionally suspended in administrative proceedings if theinterested party expresses his intention to file a contentious-administrative appeal.If this is the case, the interested party must formally communicate this fact throughbrief addressed to the Spanish Agency for Data Protection, presenting it throughof the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web /], or through any of the remaining records provided in art. 16.4 of thetada Law 39/2015, of October 1. You must also transfer the document to the Agencycertification that proves the effective filing of the contentious-administrative appeal. Yesthe Agency was not aware of the filing of the contentious-administrative appealadministrative within two months from the day after notification of theSentence resolution, would terminate the precautionary suspension.

Mar España Martí
Director of the Spanish Agency for Data Protection