AEPD (Spain) - PS/00198/2019

AEPD - PS/00198/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1) GDPR Article 83(5) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	n/a
Published:	18. 2. 2020
Fine:	n/a n/a
Parties:	A.A.A. B.B.B.
National Case Number/Name:	PS/00198/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Agencia Española de Protección de Datos filed a case brought by ms. A.A.A against mr. B.B.B in which the applicant denounced that the respondent had installed a video surveillance system with an alleged focus on the complainant's house, infringing article 5(3) GDPR which enshrines the principle of data minimisation.

English Summary

Facts

The AEPD examined a complaint submitted by miss A.A.A against mr. B.B.B. for the installation of a video surveillance system with an alleged focus on her house. The defendant denies the facts, stating that he has no connection whatsoever with them, and that he is not responsible for any installation.

Dispute

What happens if the DPA cannot determine the authorship of a video surveillance system that infringes article 5(3) GDPR?

Holding

The AEPD determined that it could not determine the material author of the installation of the camera in question and that the competence to investigate the facts is attributed to the National Police Force. Therefore, it files the cause as the person responsible for the events could not be identified, If a report is received specifying the authorship and the facts that are the subject of the complaint, the AEPD will proceed ex officio to open a new procedure

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.

Procedure No.: PS/00198/2019938-051119-PENALTY PROCEDURE RESOLUTION

From the procedure instructed by the Spanish Data Protection Agency and based on the following

FACTS
FIRST: Mrs. A.A.A. (*hereinafter, the claimant) on February 7, 2019 filed a claim before the Spanish Data Protection Agency, motivated by the data processing carried out through cameras of a video-surveillance system whose owner is identified as B.B.B. (hereinafter, the claimed) installed in***ADDRESS.

1.The reasons on which the claim is based are "installation of video-surveillance cameras with alleged orientation towards the complainant's home" (sheet no. 1).

Together with the complaint, it provides documentary evidence (Annex I Photographs) that accredits the presence of several devices oriented towards the adjacent dwelling.

SECOND: In view of the facts denounced, in accordance with the evidence available, the Data Inspectorate of this Spanish Data Protection Agency considers that the processing of personal data carried out by the defendant through the cameras to which the complaint refers does not comply with the conditions imposed by the regulations on data protection, so it is appropriate to open this sanctioning procedure.

THIRD: On 26/02/19 the complaint was TRANSFERRED to the party denounced, being recorded as notified in the computer system of this body, without any allegation having been made for the appropriate legal purposes.

FOURTH: On July 11, 2019, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the defendant, for the alleged infringement of Article 5.1(c) of the RGPD, typified in Article 83.5 of the RGPD.

FIFTH: On August 12, 2019, the cooperation of the State Security Forces and Bodies was requested so that they could go to the scene of the events to verify the authorship and other circumstances of the case.

SIXTH: On 04/11/19 the request for collaboration from the local Security Forces and Bodies (National Police Force) is reiterated, without any reply having been given.

In view of all that has been done, the following are considered to be proven facts by the Spanish Data Protection Agency in these proceedings,

FACTS
First. On 07/02/2019, the affected party receives a claim, which is then transferred to the following event:

"installation of video-surveillance cameras with alleged orientation towards the complainant's home" (sheet no. 1).

Second. The same identifies Don B.B.B. as the main responsible party, providing photographic proof of the installation.

Third. The denounced in date 09/08/19 denies the facts, declaring not to have any connection with them, and not to be responsible for any installation.

Fourth. It has not been possible to verify the presumed author, nor the operability of the operating system.

LEGAL FOUNDATIONS

I

By virtue of the powers that Article 58.2 of the RGPD grants to each control authority, and in accordance with the provisions of Article 47 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter referred to as LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.

II

In the present case, the claim for the date of entry into this AEPD (07/02/19) by means of which it transfers as a principal event, is examined:

"installation of video-surveillance cameras with alleged orientation towards the complainant's home" (sheet no. 1).

The content of Article 5.1(c) of the RGPD is considered to be affected, which states: "Personal data shall be:

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation");

Individuals may install video surveillance cameras, but are responsible for ensuring that they comply with the regulations in force, avoiding the capture of private space of third parties without justified cause.

On 09/08/2019 this agency received a reply from the defendant, in relation to the facts of the transfer, stating that "he has no express authorization to manipulate, or knowledge of the video-surveillance system installed (...). He also does not have any ownership of the system (...)".

"That the claimant is exposed to be denounced by means of judicial procedure for FALSENESS and for using personal data of the person claimed before a state institution".

Therefore, the person denounced denies being responsible for the installation of any device, nor being responsible for the placement of the camera(s) object of the denouncement.

III
It should be noted that this body is unable to determine the perpetrator of the installation of the camera in question, and has not received any report to date clarifying the matters complained of.

Notwithstanding the foregoing, it should be pointed out that once the appropriate investigations have been carried out, the National Police Force (Córdoba) has the material competence to investigate the facts, based on the location of the complainant's home.

It is recalled that the affected party may lodge the mandatory report with the District Commissioner's Office closest to the place where the events took place, which must make the appropriate inquiries, failing which it may file a complaint with the same (Complaints Book) or, if appropriate, demand that the Ministry of the Interior (Directorate General of the Police) be held responsible.

The National Police is a body of the State Administration that reports to the Ministry of the Interior and must comply with a series of quality standards in the care of citizens, which is reflected in a "Charter of Services", regulated by Royal Decree 951/2005.

Article 89 of Law 39/2015 (1 October) provides that: "The investigating body shall resolve the termination of the procedure, with the proceedings being closed, without it being necessary to formulate a proposal for a resolution, when it becomes clear in the investigation procedure that one of the following circumstances is present

(d) When the person or persons responsible are not available or could not be identified, or appear to be exempt from responsibility (...)".

In the event that a report is received that specifies the authorship and the facts that are the subject of the complaint, this body will proceed ex officio to reopen the procedure in order to clarify the facts and determine the responsibilities against the author.

Similarly, the provision of new, reliable evidence that allows the author of the facts to be identified may lead to the opening of a new procedure in order to judge the legality of the video-surveillance devices installed.

The Director of the Spanish Data Protection Agency RESOLVES

FIRST: ORDER the ARCHIVE of the present procedure, as the presumed responsible for them has not been accredited.

SECOND: TO NOTIFY the present resolution to the denouncing party Doña A.A.A..

In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the interested parties may, optionally, lodge an appeal for reversal with the Director of the Spanish Data Protection Agency within a period of one month starting from the day following notification of this resolution or the address of the contentious-administrative proceedings before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final resolution may be suspended in administrative proceedings if the interested party expresses its intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact in writing addressed to the Spanish Data Protection Agency, presenting it through the Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the other registers provided for in art. 16.4 of the aforementioned Law 39/2015, of 1 October. He will also have to send to the Agency the documentation that accredits the effective lodging of the contentious-administrative appeal. If the Agency were not aware of the lodging of the contentious-administrative appeal within the period of two months from the day following the notification of the present resolution, it would terminate the precautionary suspension.

Mar España Martí Director of the Spanish Data Protection Agency