AEPD (Spain) - PS/00436/2021

AEPD - PS-00436-2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 13(1) GDPR Article 13(2) GDPR Article 22.4 LOPDGDD (Processing for video surveillance purposes) Spanish Law on the Common Administrative Procedure of Public Administrations
Type:	Complaint
Outcome:	Rejected
Started:	21.04.2021
Decided:
Published:	28.06.2022
Fine:	n/a
Parties:	A.A.A. (Complainant) B.B.B. (Controller, Local Pub)
National Case Number/Name:	PS-00436-2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	MW

The Spanish DPA declined to sanction a local pub for failing to post signage warning of video surveillance. The pub's signs had been stolen and replaced at least three times, including once on the same day the complaint was filed.

English Summary

Facts

The controller was a local pub with surveillance cameras on its exterior. The complainant alleged that the controller had these cameras installed for "many months" without putting up signs that warned passersby and disclosed the contact details of the controller. The controller had been the subject of previous claims for the same alleged violation.

The controller responded that the complaint was filed by the same neighbor who had filed the first complaint, and it was filed the same day their GDPR-compliant signs had been stolen. The signs had been stolen three times. Because of the minimal value of the signs (roughly €7), the controller had not filed a police report, but they provided invoices from the copy shop where they had replacements printed.

Holding

The DPA noted that, in cases of video surveillance, Article 22.4 LOPDGDD provides that the duty of disclosure in Article 12 GDPR may be fulfilled by placing a sign near surveillance cameras that identifies the existence of data processing, the identity of the controller, and the possibility of exercising the rights forseen in Articles 15 to 22 GDPR. Failure to provide this information constitutes a "serious infraction" per Article 83.5 GDPR.

However, the DPA held that the controller could not be sanctioned per Article 28.1 of Law 40/2015, of October 1, on the Regime Legal of the Public Sector (Responsibility), which requires that only parties responsible for an adiminstrative infraction by way of fraud or negligence be subject to sanction. The DPA reasoned that because the controller had failed to comply only as a result of repeated acts of vandalism and had quickly acted to remedy the infraction after each incident, there was no fraud or negligence on the part of the controller.

Comment

This case is the result of either a series of improbable coincidences or a very creative and motivated vandal.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/7
 File No.: PS/00436/2021
RESOLUTION OF PUNISHMENT PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: On 04/21/2021, it had entry in this Spanish Agency of
Data Protection a document presented by A.A.A. (hereinafter the part
claimant), through which he makes a claim against B.B.B. (PUB ***PUB.1) with
NIF ***NIF.1 (hereinafter, the claimed party), due to a possible breach of the
provided in the data protection regulations.
The claim indicates the following, in relation to the data protection regulations
Personal data:
“The local Pub ***PUB.1 located on the street..., has installed two security cameras
surveillance on the facade of the building for many months. not on the facade
It has no sign that warns of the installation of the cameras on public roads.
[...]
Together with the claim, it provides two photographs dated March 4 and April 8 and 9,
2021 where you can see that in the upper part of the facade of the establishment
there are two cameras.
SECOND: These facts have already been the subject of a claim before this Agency,
processing file E/05824/2020 and, subsequently, PS/00353/2020 in the
that the file of actions was determined when the claimed person accredited the existence of
Informative posters at the entrance of the access door to the premises.
Prior to admitting this claim for processing, the Agency requested the
requested to provide, on the one hand, current photographs of the poster or posters
information on the video-monitored area and their location, both on the facade
outside as elsewhere; and, on the other hand, a responsible declaration in which
manifest the existence of the aforementioned cartels. The request for information was
notified on 06/15/2021, as stated in the Delivery Notice issued by Correos,
without this Agency having received any reply. Subsequently, it
proceeded to reiterate the request for information and was notified on 07/22/2021,
but no response has been received from the respondent.
THIRD: On 08/26/2021, the Director of the Spanish Protection Agency
Data agreed to admit the claim filed by the claimant for processing.
FOURTH: On 11/15/2021, the Director of the Spanish Protection Agency
of Data agreed to initiate a sanctioning procedure against the claimed party, in accordance with
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/7
the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged infringement of article 13 of the RGPD, typified in article
83.5 of the GDPR.
FIFTH: Having been notified of the aforementioned initiation agreement, the party complained against submitted a written
pleadings in which, in summary, it stated that:
““Coincidentally” he reported us the day after (or a few days) after we
have stolen the posters from the street cameras. We have several more robberies, this
It is the third time in a year that the posters are ripped from the facade.
The first signs were installed from February 19, 2020 (...). Then we have
made copies and we have installed them on 3 more occasions, coinciding with the theft of
the same. Although the exterior information signs are stolen, there is a
general poster of cameras of the alarm company, an informative poster nothing more
go through the front door, and two others inside (...).
The installation consists of 4 informative video surveillance posters (two external, plus
the entrance and another internal), one of general information of the company of
video surveillance. In addition, it consists of 6 cameras, and a single mobile phone of the owner to
view the images.
[...]
The cameras that focus on the entrance, have informative posters on both
sides of the facade, except when they are stolen from us, and the sign on the front door,
so that from any direction of the street from which you access the area
video surveillance, you receive information in advance (...).
The installation map and photographs of posters and cameras; was already provided as
document nº1 to the previous file, so we understand that it does not make sense
send documents that are already in the possession of this administration.
[...]
The value of two video surveillance posters is minimal, and for this reason we have not denounced
on previous occasions (...), and this time we are going to report it to the police and contribute
the complaint.
We have told them that there have been three robberies:
- The first on the date of the complaint, which we will credit with the invoices of the
copy shop that we attach.
- The second right now, which we will prove with the complaint and the bills of
the copy shop
- There was another robbery, but we replaced the posters with several that the police brought us.
data protection company.
[...]
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/7
Provide the following documentation:
- Two invoices from the copy shop dated 04/21/2021 and 12/02/2021, for the purchase
of two video surveillance posters in each of them for a value of €7 each
a.
- A copy of the complaint filed by the respondent on 12/16/2021 in the
which indicates, in summary, that between 04/19/2021 and 11/30/2021, at the PUB
***PUB.1, “Unknown person(s) have stolen him from the facade of the premises
two posters announcing the area monitored by security cameras
video surveillance."
SIXTH: On 01/21/2022 the instructor of the procedure agreed to open a period
practice tests, taking into account the previous actions of
investigation, E/05768/2021, as well as the documents provided by the respondent in
date 12/16/2021.
SEVENTH: On 01/24/2022, a resolution proposal was formulated in which
proposed to sanction the defendant with a fine of €1,500, for the infraction of the
article 13 of the RGPD, since at the time of the claim it did not have
Informative posters of the video-surveillance area on the facade of the PUB ***PUB.1.
Likewise, in accordance with article 58.2.d) of the RGPD, the claimed party was ordered to
proceed to place the corresponding signs outside the premises.
EIGHTH: The respondent submitted a brief of allegations to the proposed resolution
on 02/09/2022 where it states the following:
“[...]
In our letter we reiterated that although the posters were stolen
exterior information, there is a general poster of cameras of the company of
alarms, an information poster as soon as you walk through the front door, and another two on
inside.
[...]
The cameras do not record, they only view, and that there is always company signage
of vigilance.
[...]
At the time of making the first allegations, we contacted by telephone
with the Agency, to show our maximum willingness to collaborate (...)
That the neighbor is the same one who denounced us in the first instance and what underlies is
a problem about the inconvenience generated by the activity.
[...]
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/7
The first posters were installed on February 19, 2020, the day the
company visited us, prior to installation and opening. How do we tell them?
in the previous arguments. There has always been regulatory compliance. There are always
posters that can be seen from the outside when the blind is raised, and before accessing the
video surveillance area.
[...]”
Attach the following documentation:
- Photographs where the location of the information posters of the area is observed
video surveillance. It has placed two new badges on the facade of the premises.
- A plan of the establishment in which it indicates where the
cameras, posters and monitored areas.
- Capture of the log of calls made to this Agency on 12/02/2021
and 02/08/2022.
- A sworn statement signed by the respondent stating that
“You have the Video Surveillance Signage installed in your establishment,
always replace any missing signs before reopening;
Of the actions carried out in this procedure and the documentation
in the file, the following have been accredited:
PROVEN FACTS
FIRST: Existence of a video surveillance system installed in the PUB
***PUB.1 located in CALLE ***DIRIMIENTO.1 and made up of 6 chambers. two of the
cameras are placed on the facade of the premises, without the mandatory sign
informative video surveillance area in the same.
This end is accredited by photographs provided by the claimant dated 4
of March and April 8 and 9, 2021 in which it is observed that there are effectively no
on the facade of the property the aforementioned distinctive. Also, attach a copy of
complaint in which it states that on 04/09/2021, the PUB ***PUB.1 "on the facade does not
It has no sign that warns of the installation of the cameras on public roads.
SECOND: It is identified as the main person in charge of the B.B.B.
with NIF ***NIF.1.
THIRD: In the allegations to the opening agreement, the respondent states that in
the facade of the premises there were two informative posters, as can be seen in the
photographs that he provided in PS/00353/2020 and in which the file of
performances, but they have been stolen on several occasions. brings diverse
supporting documentation, including an affidavit.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/7
FOURTH: The placement of two new posters on the façade of the
local PUB ***PUB.1 as of 02/08/2022.
FOUNDATIONS OF LAW
Yo
In accordance with article 58.2 of the RGPD and as established in articles 47 and
48.1 of Organic Law 3/2018, of December 5, on Data Protection
Personal and guarantee of digital rights (hereinafter, LOPDGDD), is
competent to initiate and resolve this procedure the Director of the Agency
Spanish Data Protection.
Likewise, article 63.2 of the LOPDGDD determines that: “The procedures
processed by the Spanish Agency for Data Protection will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations issued in its development and, as long as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures.”
II
In the present case, it is appropriate to examine the claim dated 04/21/2021 filed
in this Agency in which the absence of an informative poster of
video-surveillance area on the facade of the PUB ***PUB.1 located on CALLE ***ADDRESS.1,
when there are two video surveillance cameras installed in it.
Article 13 of the RGPD, sections 1 and 2, establishes the information that must be provided
to the interested party at the time of collecting their data. In the case of treatments
of personal data for surveillance purposes through camera systems or
video cameras, the duty of information can be fulfilled by placing, in the
video-monitored areas, an informative badge located in a sufficiently
visible, both in open and closed spaces, and using forms in the
that the planned information is detailed, which the person in charge must make available
of those interested.
In this sense, article 22.4 of the LOPDGDD provides that:
“The duty of information provided for in article 12 of Regulation (EU) 2016/679 is
understood fulfilled by placing an informative device instead
sufficiently visible identifying, at least, the existence of the treatment, the
identity of the person in charge and the possibility of exercising the rights foreseen in the
Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the
informative device a connection code or internet address to this
information."
This infringement is typified in article 83.5 of the RGPD:
“The infractions of the following dispositions will be sanctioned, in accordance with the
section 2, with administrative fines of a maximum of EUR 20,000,000 or,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
6/7
in the case of a company, an amount equivalent to 4% of the turnover
global annual total of the previous financial year, choosing the highest amount:
a) The basic principles for the treatment, including the conditions for the
consent under articles 5, 6, 7 and 9;
(...)
For the purposes of the limitation period of the infraction, it is considered very serious
and prescribes after three years, in accordance with article 72.1 of the LOPDGDD, which establishes
that:
a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679;
(...)
III
On 02/09/2022, a written statement of allegations to the proposed resolution was received by
the party claimed providing photographs dated 02/08/2022 in which two
Informative posters of the video-monitored area on the facade of the PUB “***PUB.1”.
Although it is true that at the time of the start of this sanctioning procedure
there were no signs indicating the video surveillance system installed on the facade of the
establishment, we are faced with an assumption of exemption from liability,
in accordance with article 28 of Law 40/2015, of October 1, on the Regime
Legal of the Public Sector. This precept enshrines one of the principles of
sanctioning power, the “Responsibility”, by virtue of which “1. They can only be
sanctioned for acts constituting an administrative infraction, natural persons
and legal, as well as, when a Law recognizes them capacity to act, the groups
affected, unions and entities without legal personality and assets
independent or autonomous, who are responsible for them by way of
fraud or guilt”.
Analyzing the file as a whole, it can be seen that there is no fraud or negligence in the
conduct of the defendant since it has been sufficiently proven (invoices,
denounces, among others) that every time the informative posters of the zone
under video surveillance, puts them back.
Therefore, according to the above,
The Director of the Spanish Data Protection Agency RESOLVES:
FIRST: ORDER the FILE of this procedure due to the absence of
culpability in the defendant's conduct.
SECOND: NOTIFY this resolution to the claimant and the respondent.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
7/7
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month from
counting from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided in article 46.1 of the
aforementioned Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact by
writing addressed to the Spanish Agency for Data Protection, presenting it through
Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registers provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would end the precautionary suspension.
938-270122
Sea Spain Marti
Director of the Spanish Data Protection Agency