AEPD (Spain) - EXP202206735

AEPD - PS/00445/2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	10.06.2022
Decided:	19.06.2023
Published:	19.06.2023
Fine:	50,000 EUR
Parties:	GRUPO TRANSAHER, S.L.
National Case Number/Name:	PS/00445/2022
European Case Law Identifier:	n/a
Appeal:	Dismissed Internal Appeal
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Mgrd

The Spanish DPA fined a logistics company €50,000 for installing videocameras in the employees' rest area, in violation of Article 6 GDPR.

English Summary

Facts

In June 2022, the data subject filed a complaint with the Spanish DPA, claiming that GRUPO TRANSAHER, the controller, had installed surveillance cameras in workers' rest areas such as the canteen. The data subject also claimed that the informative notice regarding the cameras was not visible or did not exist.

In July 2022, the controller replied to the complaint, admitting the installation of the cameras and providing more detailed information about them.

First, the controller argued that it has a logistics park where a large number of people circulate and therefore it is necessary to ensure a high level of security, monitoring and protecting property and people in the building. For this reason, the controller considered that it was legitimate to video-surveil the entire work center, including the industrial building and the offices.

Second, with regard to the workers' rest area, it argued that it is actually a common area open 24 hours and is not intended for the exclusive rest of the workers. According to the controller, the room does not have restricted access for the exclusive use of employees, also being used by clients, customers, suppliers and freelancers.

Third, the controller pointed out that it performed a proportionality test and implemented mitigating measures such as providing informative notices, deleting the recordings after 30 days and limiting the access to the images to only 5 persons. Finally, the controller stated that in the employment contract there is a clause informing employees about the use of video surveillance systems for security purposes.

Holding

The Spanish DPA found that the use of surveillance cameras in an enclosed room, used as a canteen, was disproportionately invading the employee's privacy. The DPA highlighted that while Article 20.3 Workers' Statute Law allows the use of videocameras for labor control, this control must respect some limitations, such as the worker's dignity. Similarly, Article 89.2 LOPDGDD prohibits, in any case, the installation of image recording systems "in places intended for the rest or recreation of the workers, such as changing rooms, toilets, canteens and the like."

For these reasons, the DPA found a violation of Article 6 GDPR and fined the controller €50,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/25
 File No.: EXP202206735
RESOLUTION OF SANCTIONING PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: A.A.A. (hereinafter, the claimant), on 06/10/2022, filed
claim before the Spanish Data Protection Agency. The claim is
directed against GRUPO TRANSAHER, S.L., with NIF B78147758 (hereinafter, the party
claimed or TRANSAHER), for the installation of a video surveillance system,
located at ***ADDRESS.1, there being indications of a possible breach of the
provided in article 6 of Regulation (EU) 2016/679 (General Regulation of
Data Protection, hereinafter GDPR).
The reasons for the claim are the following:
The claiming party states that the claimed party has installed security cameras
video surveillance in rest areas for workers, such as the dining room for workers
workers. The claimant understands that it is a "camera installed
illegally that controls the workers.”
Likewise, it states that the informative posters related to security cameras
video surveillance “are not well installed or do not exist”.
Provide images of the location of a video surveillance camera in a dining room
large dimensions, in which numerous tables for four can be seen
diners, a kitchen furniture area that has eight microwaves and another
area with three vending machines (cold drinks, hot drinks and snacks). In the
photos provided, informative posters about the system of
video surveillance.
In view of the images, it can be seen that the dining room has windows to the
exterior on two of its sides, which form one of the corners of the room. in one of
These sides are located the video surveillance camera focused on the
dining room interior.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
forward LOPDGDD), said claim was transferred to the claimed party, for
to proceed with its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements established in the regulations of
Data Protection.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/25
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP), was collected on 06/14/2022 as stated in the
acknowledgment of receipt in the file.
On 07/13/2022, this Agency received a written response from the party
claimed, in which it provides complete information on its video surveillance system and
acknowledges having cameras installed in the dining room, stating in his response the
reasons that have led to its installation:
. It is a company that, due to the purpose of its business (transport and logistics), (...)
You need to have high security. It shares a logistics park (...), with
large influx of people, both workers and freelancers who provide their jobs there
services (...), ETT staff, customers and suppliers.
. Given the circumstances expressed above, and by virtue of article 20.3 of the
Workers' Statute, the entire workplace, including the industrial warehouse and
offices are video-surveilled by cameras, which only record
images, in no case audio. Its installation is proportional in terms of the
weighting of the power of direction and control of business activity and the right to
the privacy of the interested parties, who are aware of the use of their data that entails the
employment relationship, purpose and mechanisms to exercise recognized rights.
. There are signs that announce the installation of these cameras (provide photographs
about its content and location, including the badge installed in the dining room to which
refers to the claim).
. Only five people are authorized to view the images; (…).
. Images are stored for 30 days.
. The system is certified by a security company, which is also responsible for
of their review (they provide the latest technical report from February).
. It has informed the existence of the video surveillance system both to the Committee of
The company and the workers, who sign an informative clause in their contract
(model taken from SEPE), receive a welcome manual with information
relevant, which is completed in the employee portal. In this regard, provide a copy
of the document signed by the workers in which it is indicated that they remain
unequivocally informed of the "use of video surveillance systems to
business control”. This document includes a space for the worker's signature,
preceded by the following text:
"By signing this document, the worker declares that he has read and understood in all its
extension the aforementioned information that will be available at all times for consultation in the
employee portal and a copy is delivered to the interested party”.
. (…).
The defendant refers to "the camera located in the dining room", noting that
This room is an area for common use and passage open 24 hours a day, which does not
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/25
It has the purpose of the exclusive rest of the workers. (…). Does not have access
restricted to the exclusive use of employees, but is also used by customers,
providers, freelancers, service companies and ETT workers; and in it
They find 4 vending machines, 2 refrigerators, several microwaves and an oven.
It adds that they have suffered theft of products from the refrigerators, acts of vandalism in front of
to the vending machines to obtain the products without paying and in 2013 a
worker put a soft drink in the microwave causing the appliance to
set fire According to the entity, all of this entails a risk for tangible assets,
own or third parties (vending machines) and for people that the employer
has the duty to prevent and avoid, in accordance with the regulations for the prevention of
labor risks, and that can lead to civil liability of the company.
In addition, it indicates that the video surveillance area's label informs that its purposes are "to
monitor and protect the goods and people of the plant”.
The installed system complies with the proportionality judgment set by the Court
Constitutional:
. Legitimacy, as long as it is not mere suspicions about the existence of
illegal actions repeated over time, including robberies produced through
the Windows.
. Suitable for the purpose intended by the company, to determine who or
who are the authors of said damages, as well as the protection of the goods
your own as well as those you have on deposit.
. Necessary, since the recording would serve as proof of such irregularities and not
there is another type of less intrusive means to achieve the aforementioned purpose
. Proportionality, since the recording of images was limited to the area
previously informed and visualizes the company utilities, vending machines and
windows, as it is a transit area with a large number of
people.
According to the defendant, the latest jurisprudential doctrine states that the
installation of cameras is lawful and does not violate any fundamental right when the
workers have been expressly informed of the installation of the system
surveillance and their location for security reasons, an expression that
includes surveillance of illegal acts by workers and third parties and, in
Ultimately, the safety of the workplace.
But, in addition, it also considers it lawful, even if it is not previously reported to the
worker, if the installation of the camera is carried out due to suspicion of
irregular behavior and is placed in full view of the workers, although
they are not warned of their possible use for disciplinary purposes, since they understand that
in the workplace, the consent of the worker for the treatment
by the company of your personal data goes into the background, since the
Consent is understood to be implicit in the business relationship, provided that the
processing of said data is necessary for the maintenance and fulfillment of the
contract signed by the parties and the fundamental rights of the person are not infringed
worker.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/25
Provide a photograph of the informative poster used, which is in accordance with the regulations of
data protection, and photographs with the locations of several of those exposed, one
of them in the dining room.
He also provided images (more than 100) over the field of view of the cameras
installed, as displayed on the monitors. (…).
One of the images provided corresponds to the camera object of the claim, the
installed in the dining room. The information provided by this image is detailed in the
Fact Proven Third.
THIRD: On 08/19/2022, in accordance with article 65 of the LOPDGDD,
The claim presented by the complaining party was admitted for processing.
FOURTH: On 10/24/2022, by the General Subdirectorate of Data Inspection
information related to the claimed party is accessed in “Axesor” (“Informe
monitors"). (…).
FIFTH: On 10/31/2022, the Director of the Spanish Agency for the Protection of
Datos agreed to initiate disciplinary proceedings against the claimed party, in accordance with the
provided in articles 63 and 64 of the LPACAP, for the alleged violation of article
6 of the GDPR, typified in article 83.5.a) of the aforementioned Regulation; and qualified as
very serious for the purposes of prescription in article 72.1.b) of the LOPDGDD.
In the opening agreement it was determined that the sanction that could correspond,
attention to the existing evidence at the time of opening and without prejudice to the
resulting from the instruction, would amount to a total of 50,000 euros (fifty thousand
euro).
Likewise, it was warned that the accused infringement, if confirmed, may lead to the
imposition of measures, according to article 58.2 d) of the GDPR.
SIXTH: Notified the aforementioned start agreement in accordance with the rules established in
the LPACAP, the claimed party presented a pleading in which it requests the
procedure file based on the following considerations:
. In advance, it informs that it has learned the identity of the complaining party with
the notification of initiation of the procedure (…).
. For the rest, it ratifies the allegations that it revealed during the procedure
transfer of the claim, outlined in the Second Antecedent, reiterating that
the video surveillance area is signposted; that the
workers; that it is not a camera for the control of the workers, but
which is located in an area of common use and passage to which not only
those access; and that its purpose is to protect the health and safety of
workers, as well as material and business assets, as evidenced by the acts
of vandalism suffered by vending machines, a circumstance that has not been
valued by the Agency.
Warns that, contrary to what is indicated in the initiation agreement, the claimed party does
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/25
He provided a photograph of the camera located in the passageway that adjoins the dining room.
Provide again this photograph corresponding to the image captured by the camera
in question. In this image it can be seen that the camera captures the entire room,
including the tables arranged in the dining room, which appear in the image
shaded with a mask. The image shows the vending machines and all the
space that separates them from the tables (the detail about the space captured consists of
outlined in the Third Proven Fact).
On this last question, he cites two precedents, marked with the numbers
E/09297/2018 and E/01760/2017, referring to the installation of cameras in areas of
rest oriented to the goods that are intended to be protected, in which the Agency
resolved the file of proceedings.
Also in relation to the possibility of installing cameras to protect heritage
business when irregularities have been committed or there are suspicions of it, cites
the party claimed the Judgment no. 630/2016 of the Supreme Court and Judgment of
10/17/2019 of the European Court of Human Rights.
. Finally, the TRANSAHER entity reiterates that it has complied with the judgment of
proportionality set by the Constitutional Court and ends by invoking the Judgment
num. 1190/2021, of the Social Chamber of the Superior Court of Justice of the Islands
Canary Islands in which it is expressed:
“It is recognized, however, that a minor portion of the camera's field of view
corresponded to a place of recreation for working people, but obviously not
All places of recreation can have the same consideration (waiting rooms,
parking, dining rooms in relation to others such as showers, changing rooms, etc.). So there could be
a need to monitor those places and even people's belongings
workers. This should lead us, in the appellant's opinion, to apply in this case the principle
of proportionality in relation to the principle of minimization of the data referred to”.
SEVENTH: On 03/06/2023, a resolution proposal was formulated in the sense of
that the claimed party be penalized for a violation of article 6 of the GDPR,
typified in article 83.5.a) of the same Regulation, and qualified for the purposes of
prescription as very serious in article 72.1.b) of the LOPDGDD, with a fine of
50,000 euros (fifty thousand euros).
Likewise, it was proposed that the claimed party be required so that, within the term
determined, adopt the necessary measures to adapt its performance to the
personal data protection regulations, with the scope expressed in the
Legal basis VII of the proposed resolution.
Notification of this resolution proposal was delivered to the claimed party in
the same date of 03/06/2023 through the Enabled Electronic Address service
Sole (DEHÚ), being granted a term to formulate allegations.
EIGHTH: On 03/10/2023, a letter from the party
claimant in which he states "that, having made the company available to the
claimant as well as the lawyers all the documentation that accredits the exposed
in the allegations made by the company, by means of the present proceed to
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
6/25
waive any compensation that may correspond to him for the processing of the
file..., as well as to request the filing of the file".
NINTH: On 03/17/2023, a written statement of allegations to the proposal for
resolution in which the claimed party reiterates and ratifies its previous allegations and
request the procedure file again. In this writing, the defendant
reveals the following:
. The area between the vending machines and the dining room is a transit area, which is
It is communicated by two doors that communicate different spaces of the ship
industrial. (...) (provides a plan that marks the area of passage to which
referred to by the defendant).
According to the defendant, "it is a transit area that crosses an area of tables
intended for the dining room, but in no case can it be considered that all the
This space is a place of rest, since many people pass through this area
(…). The orientation of the camera requires the need to ensure, in addition to what
Exposed below, the access from the street to the interior of the enclosure”.
Based on this, it is contrary to the assessment of the AEPD, in that the
field of vision of the camera belongs to the dining room. considers it inevitable that
said area remains within the field of view of the camera due to the need to
Secure access to the transit area.
And he adds that, "despite being an area that must inevitably cross all the
people who access the dining room to make use of the room, it is also
inevitable that they cross the rest of the halls of the ship and the workplace
video surveillance to reach the dining room. Therefore, this area should be considered a
exclusive area of passage and no viewing of any sensitive area of the personnel for not
be a place intended for rest, since the area intended for rest has already been
is entirely masked, scrupulously complying with the privacy
from the workers".
On the other hand, it indicates that the AEPD has not taken into account that the machines of
vending suffer constant acts of vandalism, as evidenced in the
actions, and that it is essential to protect tangible and business assets, as well as
such as the health and safety of workers, in an area with a high influx of
people who access the different rooms from outside through the area
in question 24 hours a day.
It reiterates that the present case conforms to what is indicated in the resolution of the file
number E/09297/2017, according to which the installation of cameras in a transit area
that could be considered a break for the AEPD is exceptional and
It is considered legal if the taking of images of the goods that may suffer damage is limited.
threats.
He wonders what less intrusive means he could have used to prove the damage
caused to the vending machines or the theft of products without payment from the
price; once again alleges that it has complied with the proportionality judgment established by the
Constitutional Court; and mentions, with respect to suitability, the Judgment
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
7/25
432/2022, of the Contentious Administrative Chamber of the National Court of
01/31/2022.
Likewise, it states that the complaining party has informed the
company that has requested the AEPD to file the proceedings, after examining the
documentation that proves the allegations of the claimed party.
The defendant concludes that the video surveillance of the area is not capricious, but
that it is a justified installation whose image capture field
only includes the assets of the company's patrimony as well as the security of
the people who make up the workplace, leaving out of the field of vision the
tables, guaranteeing the privacy of the workers, so it cannot be seen
conduct that violates a fundamental right; that the AEPD does not have in
note that there are informative posters and all security measures have been taken.
information to workers; (…); and that the recordings are not preserved
time of the legally established, (...).
Regarding the graduation of the proposed sanction, it alleges that it is proportionate
considering that the privacy of workers in the table area is protected
intended for a dining room, the recording is deleted in accordance with the legal provisions
(…).
With its allegations, the claimed party provides a floor plan in which the
locate the dining room (…).
Of the actions carried out in this procedure and of the documentation
in the file, the following have been accredited:
PROVEN FACTS
FIRST: The claimed party, dedicated to transport and logistics, develops its
economic activity in facilities located at ***ADDRESS.1. according to
manifested by the claimed party, the influx of people to these facilities is high,
whether they are workers (...), freelancers who provide their services there (...), staff from
ETT, customers and suppliers.
SECOND: The facilities described in the previous Proven Fact have
a video surveillance system for which the claimed party is responsible.
THIRD: Of the many cameras that the security system has,
video surveillance installed by the claimed party in its premises located in
***ADDRESS.1, one of them is located in a dining room used by
workers of the claimed party and other persons who access the
facilities. It is a large room and has numerous tables
for four people, a kitchen furniture area that has eight
microwave and another area with several vending machines (cold drinks, drinks
hot drinks and snacks). The dining room has exterior windows on two of its sides,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
8/25
in one of which the focused video surveillance camera is located
into the dining room.
The field of view of this camera captures the entire room. On the left side of the
image you can see the vending machines and on the right the tables located
next to the windows that face the outside, although the area where the tables are located is
is protected by a mask that covers the exact limit of the space that
occupy the tables. Between both areas (vending machines and dining tables)
there is a wide space, about two meters wide and from end to end of the
stay, which is fully captured by the camera in question. The space that
separates the vending machine area and the tables belongs entirely to the interior
of the dining room, which must inevitably cross all the people who
They access the dining room to make use of the room.
FUNDAMENTALS OF LAW
Yo
Competence
In accordance with the powers that article 58.2 of the GDPR grants to each authority of
control and as established in articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD,
The Director of the Agency is competent to initiate and resolve this procedure
Spanish Data Protection.
Likewise, article 63.2 of the LOPDGDD determines that: "Procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures”.
II
Withdrawal of the complaining party
The claiming party has stated that the claimed party has made available
the documentation that proves their allegations and that, based on this, requests the
file the procedure, waiving any compensation that may
correspond.
This claim must be rejected, considering that the complaining party is not
interested party in the procedure, which prevents him from intervening in it. Besides,
The purpose of these proceedings is not aimed at recognizing a right of the
claiming party to be indemnified, but to determine the possible existence of a
infringing conduct by the claimed party and the consequences that derive from it.
Said request must also be rejected, even if the writing was taken
presented by the complaining party as a withdrawal of their claim. Proceeds
point out in this regard what is established in article 63.1 of the LPACAP, according to which “the
procedures of a sanctioning nature will always be initiated ex officio by agreement
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
9/25
of the competent body", establishing in article 68 of the LOPDGDD that
corresponds to the "Presidency of the Spanish Data Protection Agency,
when appropriate, issue an agreement to start the procedure for the exercise of the
sanctioning power”. Thus, for the claiming party to withdraw their claim is
irrelevant and does not imply the filing or completion of the disciplinary procedure
initiated, since it begins and is processed in all its phases ex officio.
II
The image is a personal data
The physical image of a person, according to article 4.1 of the GDPR, is data
personnel and their protection, therefore, is the subject of said Regulation. In article 4.2
of the GDPR defines the concept of "processing" of personal data.
The images generated by a system of cameras or camcorders are data of
personal nature, so its treatment is subject to the protection regulations
of data.
It is, therefore, pertinent to analyze whether the processing of personal data (image of the
natural persons) carried out through the denounced video surveillance system is
in accordance with the provisions of the GDPR.
IV.
Infringement. Regulatory framework
Article 6.1 of the GDPR establishes the assumptions that allow the use of
processing of personal data.
"1. Processing will only be lawful if at least one of the following conditions is met:
a) the interested party gave his consent for the processing of his personal data for one or
various specific purposes;
b) the treatment is necessary for the execution of a contract in which the interested party is a party
or for the application at his request of pre-contractual measures;
c) the processing is necessary for compliance with a legal obligation applicable to the
responsible for the treatment;
d) the processing is necessary to protect the vital interests of the data subject or of another person
physical;
e) the processing is necessary for the fulfillment of a task carried out in the public interest
or in the exercise of public powers conferred on the data controller;
f) the treatment is necessary for the satisfaction of legitimate interests pursued by the user.
responsible for the treatment or by a third party, provided that such interests are not
the interests or fundamental rights and freedoms of the data subject prevail
require the protection of personal data, in particular when the data subject is a child.
The provisions of letter f) of the first paragraph shall not apply to the treatment carried out by
public authorities in the exercise of their functions.
The permanent implantation of a system of video cameras for reasons of
security has a legitimate basis in the LOPDGDD, the explanatory statement of which indicates:
“Together with these assumptions, others are included, such as video surveillance… in which the legality of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
10/25
treatment comes from the existence of a public interest, in the terms established in the
Article 6.1.e) of Regulation (EU) 2016/679”.
Regarding treatment for video surveillance purposes, article 22 of the LOPDGDD
establishes that natural or legal persons, public or private, may carry out
carry out the treatment of images through systems of cameras or video cameras
in order to preserve the safety of people and property, as well as their
facilities.
This same article 22, in its section 8, provides that "The treatment by the
Employer data obtained through camera or video camera systems will be
submits to the provisions of article 89 of this organic law”.
This article 89 of the LOPDGDD, referring to the "Right to privacy against the use of
video surveillance and sound recording devices in the workplace”.
sets the following:
"1. Employers may process the images obtained through camera systems or
video cameras for the exercise of control functions by workers or employees
provided for, respectively, in article 20.3 of the Workers' Statute and in the
public function legislation, provided that these functions are exercised within its framework
law and with the limits inherent to it. Employers must inform
previously, and expressly, clearly and concisely, to the workers or public employees and, in
your case, your representatives, about this measure.
In the event that the flagrant commission of an illegal act has been captured by the
workers or public employees, the duty to inform will be understood fulfilled when
at least the device referred to in article 22.4 of this organic law exists.
2. In no case will the installation of sound recording systems or
video surveillance in places intended for the rest or recreation of workers or
public employees, such as locker rooms, toilets, dining rooms and the like.
3. The use of systems similar to those referred to in the previous sections for the
sound recording in the workplace will be allowed only when relevant
risks to the safety of facilities, goods and people derived from the activity
that it takes place in the workplace and always respecting the principle of proportionality,
the minimum intervention and the guarantees provided for in the previous sections. the deletion
of the sounds preserved by these recording systems will be made according to the
provided in section 3 of article 22 of this law”.
On the legitimacy for the implementation of video surveillance systems in the field
labor, Royal Legislative Decree 1/1995, of 03/24, is taken into account, which approves
the revised text of the Workers' Statute Law (LET), whose article 20.3
notes:
"3. The employer may adopt the measures he deems most appropriate for surveillance and control
to verify compliance by the worker with his labor obligations and duties,
keeping in their adoption and application due consideration to their dignity and taking into account
account, where appropriate, the real capacity of workers with disabilities.
The Constitutional Court, in Judgment 98/2000, of 04/10/2000, highlights in its
legal basis 6 that “The jurisprudence of this Court has insisted
repeatedly in the full effectiveness of the fundamental rights of the worker
within the framework of the employment relationship, since this cannot imply in any way the
deprivation of such rights for those who serve in organizations
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
11/25
productive, which are not alien to constitutional principles and rights. Without
However, the mere manifestation of the exercise of the power of control by the
employer so that the right of the worker is sacrificed. These limitations
business must be those indispensable and strictly necessary to
satisfy a business interest deserving of guardianship and protection, so that if
there are other less aggressive and affective possibilities of satisfying said interest
of the law in question, it will be necessary to use the latter and not those more
aggressive and affective. It is, ultimately, the application of the principle of
proportionality”.
To check whether a restrictive measure of a fundamental right passes the trial
of proportionality it is necessary to verify if it meets the three requirements or conditions
following:
. If such a measure is likely to achieve the proposed objective (judgment of suitability);
. If necessary, in the sense that there is no other more moderate measure for the
achievement of such purpose with equal effectiveness (judgment of necessity);
. If it is weighted or balanced, because it derives more benefits or
advantages for the general interest than damages to other goods or values in conflict
(judgment of proportionality).
Thus, among the surveillance and control measures admitted in the workplace are included
the installation of security cameras, although these systems must respond
always to the principle of proportionality, that is, the use of video cameras must be
proportional to the purpose pursued, this is to guarantee the security and compliance with the
job obligations and duties.
In short, even though article 20.3 of the Workers' Statute authorizes the
employer to adopt the measures he deems most appropriate for surveillance and control
to verify compliance by the worker with his obligations and duties
labor rights, this adoption must necessarily take into account the rights
workers, respecting the rights to privacy and the right
fundamental to data protection.
Under the terms of the aforementioned article 89 of the LOPDPGDD, it is allowed that
Employers can process the images obtained through camera systems or
video cameras for the exercise of control functions of workers
provided for in article 20.3 of the Workers' Statute "provided that these
functions are exercised within its legal framework and with the limits inherent to it.
In accordance with the foregoing, employers must inform in advance,
and expressly, clearly and concisely, to the workers and, where appropriate, to their
representatives, about this measure (article 89.1 of the LOPDGDD).
Therefore, the treatment must be adjusted and proportional to the purpose for which it is carried out.
directs. The relevance in the treatment of the data must occur both in the
time of data collection as well as in the subsequent treatment that is carried out
of them, so that the system of cameras or video cameras installed does not
may obtain images affecting the privacy of employees, resulting in
disproportionate to capture images in private spaces, such as changing rooms,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
12/25
lockers or worker rest areas.
This is expressly established in the aforementioned article 89 of the LOPDGDD in relation to
with the installation of video surveillance systems:
"2. In no case will the installation of sound recording systems or
video surveillance in places intended for the rest or recreation of workers or
public employees, such as locker rooms, toilets, dining rooms and the like.
According to this article, surveillance in workplaces should not include places
reserved for the private use of employees or that are not intended for carrying out
of work tasks (such as toilets, showers, changing rooms, dining rooms or work areas).
rest).
V
Video surveillance obligations
In accordance with the foregoing, the processing of images through a system
video surveillance, to comply with current regulations, must comply with the
following requirements:
1.- Individuals or legal entities, public or private, can establish a system
video surveillance in order to preserve the safety of people and property,
as well as its facilities.
It must be assessed whether the intended purpose can be achieved in another less
intrusive to the rights and freedoms of citizens. Personal data only
should be processed if the purpose of the processing cannot reasonably be achieved by
other means, recital 39 of the GDPR.
2.- The images obtained cannot be used for a subsequent purpose
incompatible with the one that motivated the installation of the video surveillance system.
3.- The duty to inform those affected provided for in articles 12 must be fulfilled
and 13 of the GDPR, and 22 of the LOPDGDD, in the terms already indicated.
4.- Images of the public thoroughfare cannot be captured, since the treatment of
images in public places, unless there is government authorization, only
It can be carried out by the Security Forces and Bodies.
On some occasions, for the protection of private spaces, where
cameras installed on facades or inside, may be necessary to ensure the
security purpose the recording of a portion of the public thoroughfare.
That is, cameras and camcorders installed for security purposes may not be
obtain images of public roads unless it is essential for said purpose, or
it is impossible to avoid it due to their location. And in such a case
extraordinary, the cameras will only be able to capture the minimum portion necessary to
preserve the safety of people and property, as well as its facilities.
Installed cameras cannot get images from third-party proprietary space
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
13/25
and/or public space without duly accredited justified cause, nor can they affect
the privacy of passers-by who move freely through the area.
It is not allowed, therefore, the placement of cameras towards the private property of
neighbors with the purpose of intimidating them or affecting their private sphere without cause
justified.
In no case will the use of surveillance practices beyond the environment be admitted.
object of the installation and in particular, not being able to affect public spaces
surroundings, adjoining buildings and vehicles other than those that access the space
guarded.
Images cannot be captured or recorded in spaces owned by third parties without the
consent of their owners, or, where appropriate, of the people who are in them
find.
It is disproportionate to capture images in private spaces, such as
changing rooms, lockers or rest areas for workers.
5.- The images may be kept for a maximum period of one month, except in
those cases in which they must be kept to prove the commission of acts
that threaten the integrity of people, property or facilities.
In this second case, they must be made available to the authority
competent authority within a maximum period of 72 hours from the knowledge of the
recording existence.
6.- The controller must keep a record of processing activities
carried out under his responsibility in which the information to which he makes
reference article 30.1 of the GDPR.
7.- The person in charge must carry out a risk analysis or, where appropriate, an evaluation
of impact on data protection, to detect those derived from the implementation
of the video surveillance system, assess them and, where appropriate, adopt security measures.
appropriate security.
8.- When a security breach occurs that affects the processing of
cameras for security purposes, whenever there is a risk to the rights and
freedoms of natural persons, you must notify the AEPD within a maximum period of
72 hours.
A security breach is understood to be the destruction, loss or accidental alteration or
unlawful transfer of personal data, stored or otherwise processed, or the
communication or unauthorized access to said data.
9.- When the system is connected to an alarm center, it can only be
installed by a qualified private security company
contemplated in article 5 of Law 5/2014 on Private Security, of April 4.
The Spanish Data Protection Agency offers through its website
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
14/25
[https://www.aepd.es] access to:
. the legislation on the protection of personal data, including the GDPR
and the LOPDGDD (section "Reports and resolutions" / "regulations"),
. the Guide on the use of video cameras for security and other purposes,
. the Guide for compliance with the duty to inform (both available at the
section "Guides and tools").
It is also of interest, in case of carrying out low-risk data processing, the
free tool "Facilita" (in the "Guides and tools" section), which, through
specific questions, allows to assess the situation of the person in charge with respect to the
processing of personal data that it carries out, and where appropriate, generate various
documents, informative and contractual clauses, as well as an annex with measures
indicative security considered minimum.
SAW
Administrative offense. Classification and qualification of the infraction.
The claim is based on the alleged illegality of the video surveillance camera
installed in the area set up as a workers' canteen, in the
Dependencies of the requested entity located at ***ADDRESS.1.
It is not disputed in this case the fact that the claimed party is the owner and
responsible for the reported video surveillance system and, therefore, the person responsible for
the data processing involved in the use of said system. And neither does he
fact that among the data processing carried out is the collection and
storage of personal data relating to the image of employees and others
affected within the area indicated above. The capture of these
images has been recognized by the claimed party.
It is proven in the proceedings, likewise, that said installation is carried out with
security and business control purposes.
When carrying out the collection and use of the images obtained in the dining room enabled
for personnel, the claimed part does not take into account the limits set forth in the
Article 20.3 of the Workers' Statute Law (LET), which admits the recording
of images for the exercise of labor control functions when those functions
respect the legal framework and the limits inherent to it, such as respect for the
worker's dignity; nor the provisions of article 89.2 of the LOPDGDD,
which prohibits, in any case, the installation of image recording systems or
video surveillance "in places intended for the rest or recreation of
workers..., such as locker rooms, toilets, dining rooms and the like”.
Consequently, in this case, the general prohibition that establishes
article 89.2 of the LOPDGDD, on the capture of images in an area of
staff dining room.
The claimed party does not dispute that the area captured by the camera that motivates the
performances is intended for dining room and that it is used for this purpose by
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
15/25
your employees. But he has indicated that the dining room in question is not a zone of
exclusive access for employees, but rather an area with a large influx of people, of
common use by workers, freelancers who provide their services there (...),
ETT staff, customers and providers; that does not have, ultimately, the end of
exclusive rest of workers
In this regard, it should be noted, on the one hand, that it is the aforementioned standard that
assigns to dining rooms the classification of "places for rest or
recreation of the workers" and, on the other hand, that the fact that the dining room
is used by people other than the company's own workers
excludes or diminishes the aforementioned legal coverage, to the extent that such circumstances
do not exclude the classification of this room as a rest area for workers.
In addition, for the purposes at hand, this Agency understands that some of the
affected groups or categories indicated by the claimed party may be included in
the concept of workers, there being no reason to exclude from the protection
established in article 89.2 of the LOPDGDD to self-employed workers and
ETT personnel who provide services in the dependencies of the claimed party.
And not only that. It is also understood that the capture of images that
made by the camera installed in the aforementioned dining room and that the intended purpose could
be obtained in a less intrusive way, without implying an intrusion into privacy
of the people affected.
As stated in the Third Proven Fact, the dining room in which the
video surveillance camera is a large room, which has
numerous tables for four people, a kitchen furniture area that
It has eight microwaves and another area with several vending machines (drinks
cold drinks, hot drinks and snacks).
Likewise, according to the image provided to the proceedings by the claimed party itself,
It is clear that the field of vision of said camera captures the entire room, although the area
location of the tables is protected by a mask that covers the limit
exactly how much space they occupy.
However, between the tables, which occupy the right side of the dining room on the
image taken by the camera, and the vending machines, located at one end of
In the room, on the left side of the image, there is a wide space, about two
meters wide and from end to end of the room, which is fully captured
by the camera in question without restriction of any kind. This space that separates the
area with vending machines and tables belongs entirely to the interior of the
dining room, which is inevitably crossed by all the people who
They access the dining room to make use of the room.
Capturing this space between the tables and the vending machines does not meet the
trial of proportionality, considering the purpose pursued by the claimed party
with the installation of the camera in the dining room, so that this measure must
qualify as restrictive of the rights of those affected.
The claimed party, in its response to the claim transfer process and in the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
16/25
brief of allegations at the opening of the procedure, states that, by virtue of the
Article 20.3 of the Workers' Statute, the installation of a system of
video surveillance throughout the workplace is proportional, in terms of the
weighting of the power of direction and control of business activity and the right to
the privacy of the interested parties.
The defendant also considers that the use made of the
video surveillance pursues a legitimate objective, such as the protection of your assets, in
specifically the vending machines, which have suffered various acts of vandalism and theft; and
that said use is considered lawful by our jurisprudential doctrine for
situations as indicated; and that it complies with the judgment of proportionality established by the
Constitutional Court, understanding that the thefts and damages that have been occurring
in vending machines legitimize the installation of the camera, that this installation
is suitable to determine the authors of the damages, necessary to provide the
relevant and proportional evidence, given that the images are limited to the area
previously informed and only visualizes the company's tools, the aforementioned machines
of vending and the windows, in an area of passage with great concurrence of people.
However, as indicated above, this Agency does not share the
conclusion of the claimed party and understands that the data processing carried out is
beyond what is strictly necessary, judging by the detail displayed by the camera.
This capture is not limited to exclusively controlling the people who make use of
vending machines, but it reaches all the people who access the
dining room, whether or not they use said machines. The judgment of necessity implies that
there is another more moderate measure for the achievement of purpose with equal effectiveness.
If the purpose of installing the camera was the protection of property
assets of the company and vending machines, the field of vision captured by
said chamber should have been limited to the minimum necessary to guarantee this protection
or to obtain the intended results regarding the removal of items
property of the claimed party or the commission of unlawful acts against the property.
The Constitutional Court Judgment 119/2022, of September 29, admits these
recordings when there are indications of the commission of illegal acts, but always
that there is no other less invasive way to confirm the illegality of the conduct of the
worker and resting places are respected. In this Judgment it is declared:
"Consequently, in the general framework of monitoring compliance with an employment contract,
and for these purposes alone, the employer may install a video surveillance system. Installation
and use of the system will not require the consent of the workers, but it does require a duty of
inform them in advance and expressly about its existence and purpose. The
location of the cameras must respect the privacy of the places intended for
rest or recreation, or that have a reserved character. However, the use of
the images captured to verify or prove the flagrant commission of an illegal act
will require the prior duty of information, which may be understood to have been fulfilled when the
placed in a visible place an informative sign of the existence of the system, of its
responsible and its purpose.
(…)
In the specific circumstances of the case, it can be stated that the installation of the
video surveillance and the consequent use of the captured images was a measure
justified, suitable, necessary and proportionate.
(i) The measure was justified, because there were sufficient indicative suspicions of a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
17/25
irregular behavior of the worker —already described— that had to be verified.
(ii) The measure can be considered suitable for the intended purpose, which was none other
that the verification of the eventual illegality of the conduct, which was confirmed precisely
by viewing the images.
(iii) The measure was necessary, since it does not seem that any other less
invasive and equally effective to prove the labor infringement. Any other measure would
warned the worker, thus making the company's actions useless.
(iv) Finally, the measure can be considered proportionate. At this point you have to
weigh various elements of judgement. So, first of all, the cameras were not installed
in places of rest, leisure or of a reserved nature, where there is an expectation
reasonable privacy, but were installed in work areas open to the attention
to the public. Second, the cameras were not installed surreptitiously, but rather
They were located in visible places, both for the workers of the establishment and
For the general public. Third, the cameras were not used on a regular basis.
generalized or indefinite, or to carry out a prospective investigation, but to
verify the possible existence of irregular conduct detected the day before. Therefore, the
degree of interference in the sphere of privacy of the worker (art. 18.1 CE), in terms of
space and time, cannot be considered unbalanced in relation to the rights and
interests of the company in the detection and punishment of conduct that violates the
contractual good faith, within the framework of the exercise of the rights to private property and
freedom of enterprise, recognized in arts. 33 and 38 CE, respectively”.
The defendant also alleges that the area between the vending machines and the
dining room is a "passage area", communicated with other spaces of the industrial warehouse
through two doors (one next to the vending machines and the other at the back of the room,
according to the field of vision of the video surveillance camera object of the actions).
(…). According to the plan provided to the actions, it is verified that the two doors
communicate with other closed spaces that can be accessed, in both cases,
to the stairs of the building.
For this reason, and considering the many people who pass through this area that crosses the
space in which the dining tables are located, understands that it cannot
be considered a space intended for rest or that the field of vision of the
camera belongs to the dining room. And add that the orientation of the camera
requires ensuring access from the street to the interior of the enclosure and the entrances to the
passage area.
This Agency understands, however, that the space in question belongs
entirely inside a closed room for dining room. Furthermore, the part
claimed does not justify that the security of the building requires the control of that supposed
"passage area" and that the same security and control cannot be obtained without this
additional camera installed in the dining room, making use only of the system installed in
the areas where the capture of images is allowed. (...) (...).
The claimed entity itself admits in its statement of allegations that the persons
Those who access the dining room go through "the rest of the corridors of the ship and the place of
video-monitored work to reach the dining room”.
With this statement, the claimed party also intends to assimilate the capture of
images of the worker in the controversial area, which belongs to the interior of the room
dining room, with the capture of images in the rooms or contiguous spaces that
The people who make use of it must cross to reach the dining room. Is
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
18/25
as much as saying that, being possible to capture images of the people who are going
to the dining room through different parts of the building, it is also possible to capture
images inside the dining room, except in the space occupied by the tables
strictly delimited, as if the privacy of the person should only be protected
when you use one of the tables. However, it is clear both spaces are not
assimilable, and that the norm protects the space destined to rest in its entirety
and not just a part of it, at the convenience of the responsible entity.
Consequently, in this case, it can be understood disproportionate and illegal the
capture of images referred to in the claim that gives rise to this
sanctioning procedure. It is noted that recording images on the
indicated area is an intrusion into the privacy of people.
The approach and conclusion expressed in this act do not contradict what
indicated in the precedents of this Agency invoked by the claimed party, nor the
Sentences alluded to in his brief of allegations.
The defendant cites the precedents indicated with the numbers E/09297/2018 and E/
01760/2017, indicating that they refer to the installation of cameras in areas of
rest oriented to the goods that it is intended to protect, which is considered lawful
said installation if the capture of images is limited to the goods that can suffer
threats and that this Agency resolved the filing of the proceedings.
In the resolution issued in the first of them, number E/09297/2018, archived
the actions because the assumption refers to a simulated camera. are exposed,
However, in said resolution, the criteria that enable the installation of a
video surveillance camera in places of rest for the protection of assets, and
on the legitimate basis of the treatment the following is indicated:
"a) If there are acts of vandalism, the taking of images of the part of the goods should be limited.
that may suffer such threats, not being provided that a dome-type camera monitors
the entire area. If it were decided to install, the assets to be protected could be moved to another location
in the least invasive space for people.
b) The collection of images, if said purpose is accredited, would have to be very limited to those
assets that have suffered such actions, without the belief or
expectation that they may suffer acts of vandalism”.
In the same way, the resolution to file the proceedings adopted in the
E/01760/2017, referring to a case of installation of cameras for the protection of
vending machines in worker rest areas, declares the following:
"In the present case, from the photographic documentation provided by the denounced entity,
It follows that there are cameras installed in the vending area, the purpose of which is to prevent
violent acts are committed against vending machines, indicating that some of them
these machines are located in break rooms used by truckers coming
to pick up the products while they wait for the trucks to be loaded. of the pictures
provided, it can be deduced that said cameras are oriented to vending machines,
which would only allow to capture the people who used said machines, having to
considered, that as long as they are kept in these conditions and location, there would be a
proportional treatment that would justify its installation, according to the intended purpose, being the
the minimum area captured for the intended purpose”.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
19/25
Also in relation to the possibility of installing cameras to protect heritage
business when irregularities have been committed or there are suspicions of it, cites
the party claimed the Judgment no. 630/2016 of the Supreme Court and Judgment of
10/17/2019 of the European Court of Human Rights, but the case analyzed
It does not deal with the recording of private areas, but work areas.
The defendant also cites Judgment no. 1190/2021, of the Social Chamber
of the Superior Court of Justice of the Canary Islands, but it does so by highlighting the
allegations of the recurring entity in that case and not what was declared by the Court.
And Judgment 432/2022, of the Administrative Litigation Chamber of the Court
National of 01/31/2022, which is not related to the present case as it refers to
to the installation of cameras inside a house.
Lastly, contrary to what was stated by the defendant, it should be clarified that this
Agency if it has taken into account the existence of informative posters or the non-existence
conservation of the images longer than the established time, although it is
circumstances that do not modify the conclusions presented. If confirmed
the non-existence of informative posters, which was the object of the claim, would have
motivated the imputation of an infraction for breach of the duty to inform in
personal data protection matter.
Consequently, by virtue of the foregoing, it is considered that the facts
exposed violate what is established in article 6 of the GDPR, for which they suppose the
commission of an offense classified in article 83.5 of the GDPR, which gives rise to the
application of the corrective powers that article 58 of the aforementioned Regulation grants to
the Spanish Data Protection Agency. This article 83.5.a) of the GDPR provides
the next:
Violations of the following provisions will be penalized, in accordance with section
2, with administrative fines of maximum EUR 20,000,000 or, in the case of a company,
of an amount equivalent to a maximum of 4% of the total global annual turnover of the
previous financial year, opting for the highest amount:
a) the basic principles for treatment, including the conditions for consent to
tenor of articles 5, 6, 7 and 9;”.
For the purposes of the limitation period for infringements, the infringement indicated in the
previous paragraph is considered very serious in accordance with article 72.1 of the LOPDGDD,
which states that:
"Based on what is established in article 83.5 of Regulation (EU) 2016/679, they are considered
very serious and will prescribe after three years the infractions that suppose a violation
substance of the articles mentioned therein and, in particular, the following:
(…)
b) The processing of personal data without the fulfillment of any of the legal conditions of the
treatment established in article 6 of Regulation (EU) 2016/679”.
VII
Sanction
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
20/25
Article 58.2 of the GDPR establishes:
"Each control authority will have all the following corrective powers indicated to
continuation:
(...)
d) order the person in charge or in charge of processing that the processing operations be
conform to the provisions of this Regulation, where appropriate, of a given
manner and within a specified period;
(...)
i) impose an administrative fine in accordance with article 83, in addition to or instead of the
measures mentioned in this section, according to the circumstances of each case
particular".
According to the provisions of article 83.2 of the GDPR, the measure provided for in article
58.2.d) of the aforementioned Regulation is compatible with the sanction consisting of a fine
administrative.
Regarding the infringement of article 6 of the GDPR, based on the facts
exposed, it is considered that the sanction that would correspond to be imposed is a fine
administrative.
The fine imposed must be, in each individual case, effective, proportionate
and dissuasive, in accordance with the provisions of article 83.1 of the GDPR. Thus
considers, in advance, the status of a large company of the claimed party and
its volume of business (it is stated in the proceedings that (...).
In order to determine the administrative fine to be imposed, the
provisions of article 83.2 of the GDPR, which states the following:
"2. Administrative fines will be imposed, depending on the circumstances of each case.
individually, in addition to or in lieu of the measures contemplated in article 58,
section 2, letters a) to h) and j). When deciding to impose an administrative fine and its amount
in each individual case due account shall be taken of:
a) the nature, seriousness and duration of the offence, taking into account the nature,
scope or purpose of the processing operation in question as well as the number of
affected stakeholders and the level of damages they have suffered;
b) intentionality or negligence in the infringement;
c) any measure taken by the controller or processor to alleviate the
damages suffered by the interested parties;
d) the degree of responsibility of the controller or processor, taking into account
of the technical or organizational measures that have been applied by virtue of articles 25 and 32;
e) any previous infringement committed by the controller or processor;
 f) the degree of cooperation with the supervisory authority in order to remedy the
infringement and mitigate the potential adverse effects of the infringement;
g) the categories of personal data affected by the infringement;
h) the way in which the supervisory authority became aware of the infringement, in particular if the
Controller or processor notified the infringement and, if so, to what extent;
i) when the measures indicated in article 58, paragraph 2, have been ordered
previously against the person in charge or the person in charge in relation to the same
matter, compliance with said measures;
j) adherence to codes of conduct under article 40 or certification mechanisms
approved under article 42, and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
21/25
k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as
financial benefits obtained or losses avoided, directly or indirectly, through
the offence”.
For its part, article 76 "Sanctions and corrective measures" of the LOPDGDD,
Regarding section k) of the aforementioned article 83.2 GDPR, it provides:
"1. The sanctions provided for in sections 4, 5 and 6 of article 83 of Regulation (EU)
2016/679 will be applied taking into account the graduation criteria established in the
section 2 of said article.
2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679 also
may be taken into account:
a) The continuing nature of the offence.
b) Linking the offender's activity with data processing
personal.
c) The benefits obtained as a consequence of the commission of the infraction.
d) The possibility that the conduct of the affected party could have led to the commission of the
infringement.
e) The existence of a merger process by absorption subsequent to the commission of the infraction,
that cannot be attributed to the absorbing entity.
f) The affectation of the rights of minors.
g) Have, when it is not mandatory, a data protection delegate.
h) Submission by the person responsible or in charge, on a voluntary basis, to
alternative conflict resolution mechanisms, in those cases in which there are
disputes between those and any interested party”.
In the present case, the criteria of
following graduation:
. Article 83.2.a) of the GDPR: "a) the nature, seriousness and duration of the
infringement, taking into account the nature, scope or purpose of the operation
treatment in question as well as the number of interested parties affected and the
level of damages they have suffered”.
. The number of interested parties: the use of the video surveillance camera that
has determined the infringement does not affect only the party complained of. The
claimed entity itself has stated that the dining room in which said
camera is located in a place with a large influx of people,
among its workers (...), freelancers who provide their services there (...),
ETT staff, clients and suppliers.
. Article 83.2.b) of the GDPR: "b) intentionality or negligence in the infringement".
The negligence appreciated in the installation of a video surveillance camera that
allows the collection of images in a private space intended for the rest of
workers, expressly prohibited by the applicable regulations. To this
In this regard, the statement of the National Court Judgment is taken into account
of 10/17/2007 (rec. 63/2006) that, based on the fact that these are entities whose
activity involves continuous data processing, indicates that "...the
The Supreme Court has understood that there is imprudence whenever
disregards a legal duty of care, that is, when the offender does not
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
22/25
behave with the required diligence. And in the assessment of the degree of diligence has
to weigh especially the professionalism or not of the subject, and there is no doubt
that, in the case now examined, when the appellant's activity is
constant and abundant handling of personal data must be insisted on the
rigor and exquisite care to comply with the legal provisions in this regard”.
It is a company that performs personal data processing in a
systematic and continuous in the area in which the events occurred and that
must exercise extreme care in complying with its obligations in terms of
Data Protection.
. Article 83.2.g) of the GDPR: "the categories of personal data
affected by the infringement”;
Although "Special categories of personal data" have not been affected,
as defined by the GDPR in article 9, the personal data to which they refer
the actions (image of the interested parties) has a particularly
sensitive, since it allows the prompt identification of the interested parties and increases
risks to your privacy.
. Article 76.2.b) of the LOPDGDD: "b) Linking the offender's activity
with the processing of personal data”.
The high connection of the claimed party with the performance of the processing of
personal data in the workplace that are the subject of the procedure. This
circumstance determines a greater degree of demand and professionalism and,
consequently, of the responsibility of the claimed party in relation to the
data processing.
It is also considered that the circumstances concur as mitigating
following:
. Article 83.2.d) of the GDPR: "d) the degree of responsibility of the controller or the
processor, taking into account technical or organizational measures
that they have applied by virtue of articles 25 and 32”.
The requested entity has a complex video surveillance system and has
implemented adequate procedures for action in the collection and treatment
of the personal data contained in said system, not having
Appreciated in the actions other defects other than the declared infringement.
Considering the exposed factors, the valuation reached by the fine for the
violation of article 6 of the GDPR is 50,000 euros (fifty thousand euros).
The claimed party considers this sanction disproportionate, alleging that it protects
the privacy of the workers in the area of tables set aside for the dining room, which
recording is deleted in accordance with the legal provisions (...).
But these circumstances do not modify the responsibility for the facts that have
determined the sanctioned offense. It has already been assessed as mitigating that the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
23/25
video surveillance system is complex, without any other defects that
the determinants of the declared infringement. In addition, the non-conservation of the
recordings or the non-use of images outside the provisions of the standard are
circumstances that, if not present, would be the reason for new infractions.
VIII
Measures of adaptation to the regulations
Once the infringement is confirmed, it is appropriate to impose on the person responsible the adoption of measures
adequate to adjust their performance to the regulations mentioned in this act, in order to
In accordance with the provisions of the aforementioned article 58.2 d) of the GDPR, according to which each
The supervisory authority may “order the person in charge or in charge of the treatment to
processing operations comply with the provisions of this
Regulation, where appropriate, in a certain way and within a time limit
specified…".
The text of this agreement establishes which have been the infractions
allegedly committed and the facts that give rise to the violation of the regulations
of data protection, from which it is clearly inferred what are the measures to
adopt, notwithstanding that the type of procedures, mechanisms or instruments
specific measures to implement them correspond to the sanctioned party, since it is the
controller who fully knows his organization and has to decide,
based on proactive responsibility and the risk approach, how to comply with the
GDPR and the LOPDGDD.
However, in this case, regardless of the foregoing, it is appropriate to require the
responsible entity so that, within the term indicated in the operative part,
abolish the capture of images by the video surveillance system object of the
actions in the area for the workers' canteen, with the scope
expressed in this act. You must remove the video surveillance camera installed in the
employee dining area.
It is noted that not meeting the requirements of this body may be
considered as an administrative offense in accordance with the provisions of the GDPR,
classified as an infraction in its article 83.5 and 83.6, being able to motivate such conduct the
opening of a subsequent administrative sanctioning procedure.
Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been accredited,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: IMPOSE GRUPO TRANSAHER, S.L., with NIF B78147758, for a
infringement of article 6 of the GDPR, typified in article 83.5.a) of the same
Regulation, and classified as very serious for the purposes of prescription in article
72.1.b) of the LOPDGDD, a fine of 50,000 euros (fifty thousand euros).
SECOND: That by the Director of the Spanish Data Protection Agency
orders GRUPO TRANSAHER, S.L., within a period of one month from the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
24/25
notification of this act, adopt the necessary measures to adapt its
performance of the personal data protection regulations, with the scope expressed
in the Foundation of Law VIII of this resolution. Within the same period indicated,
TRANSAHER GROUP, S.L. must inform and justify before this Agency the
compliance with the imposed measures.
THIRD: NOTIFY this resolution to GRUPO TRANSAHER, S.L.
FOURTH: Warn the sanctioned party that he must enforce the sanction imposed
Once this resolution is enforceable, in accordance with the provisions of Article
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of its income, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted IBAN number: ES00 0000 0000 0000 0000 0000 (BIC/SWIFT Code:
XXXXXXXXXXXX), opened on behalf of the Spanish Agency for Data Protection in
the banking entity CAIXABANK, S.A. Otherwise, it will proceed to its
collection in executive period.
Once the notification has been received and once executed, if the execution date is
between the 1st and 15th of each month, both inclusive, the term to make the payment
voluntary will be until the 20th day of the following or immediately following business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediately following business month.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.
Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reversal before the
Director of the Spanish Agency for Data Protection within a period of one month from
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.
Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronicaweb/], or through any of the other registries provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
25/25
documentation proving the effective filing of the contentious-administrative appeal. If the Agency was not aware of the filing of the appeal
contentious-administrative proceedings within a period of two months from the day following the
Notification of this resolution would terminate the precautionary suspension.
938-181022
Mar Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es