AEPD (Spain) - PS/00027/2019
From GDPRhub
| AEPD - PS/00027/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(b) GDPR Article 83(5) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | n/a |
| Published: | 6. 3.2020 |
| Fine: | None |
| Parties: | Anoymous Ministry for Internal affairs |
| National Case Number/Name: | PS/00027/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in es) |
| Initial Contributor: | n/a |
The APED issued a reprimand to the Ministry of internal affairs due to their misuse of surveillance cameras in a police station. The controller did not inform about the specific purposes of the surveillances cameras which used for the processing of employees’ personal data and, thus, breached the principle of purpose limitation.
English Summary
Facts
Prior to the entry in force of the GDPR, a police inspector requested a copy of the surveillance cameras in a police station. Although the cameras were installed for the “security and protection” of the detainees and the police station, he requested the copy to check if one of the police officers followed his instruction: to wear the regulatory uniform. While, there was no proof that disciplinary procedure has been initiated, the copy of the images has been delivered.
The employee filed a complaint with the AEPD.
Dispute
The question was whether the information on the use of surveillance cameras for “security and protection” was sufficient to cover employees’ surveillance.
Holding
The AEPD ruled that the use of the cameras for the employees' surveillance was against the principle of purpose limitation, Article 5(1)(b) GDPR.
Indeed, the controller carried out a disciplinary control though surveillance cameras and did not inform the affected data subjects accordingly. Insofar the data subjects have not been properly informed of the surveillance specific purpose, the controller could not have legitimated the processing disputed on the consent.
The APED ruled that it constituted a misused of the system and as mentioned in another court case-law, “it was necessary to expressly, precisely, clearly and unequivocally inform the workers of the monitoring purpose with a prior notice” and that “it should specify the characteristics and scope of the data processing to be carried out, i.e. in which cases the recordings could be examined, for how long and for what purposes, explaining in particular that they could be used to impose disciplinary measures for breaches of the employment contract”.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.
Page 1
1/22
Procedure Nº: PS / 00027/2019
938-051119
RESOLUTION OF SANCTIONING PROCEDURE
The procedure instructed by the Spanish Agency for Data Protection and in
base to the following
BACKGROUND
FIRST : On the date of 05/22/2018, an AAA claim against the
PROVINCIAL COMMISSIONER OF *** LOCATION. 1 OF THE NATIONAL POLICE BODY
by using images of the Commissioner's video surveillance system to initiate a
disciplinary procedure, with deviation from the purpose of the system and without any
been informed that said device could be used for that purpose, in addition
of the lack of proportionality in terms of its use.
The claimant, Inspector of the CNP, is *** POSITION 1 of a group of police officers from the
*** BRIGADA.1 of the Commissioner of *** LOCATION.1 , states that he performs his duties
rotating shifts and uniform attached to the Citizen Security Brigade. The night
of *** DATE.1 was serving and at 11:30 pm the Inspector came *** POSITION 2 of the
Provincial Citizen Security Brigade, BBB with *** POSITION.1 (head of the
Police station). At that time, the police lent to dinner, wearing the claimant a
Black fleece over the uniform, due to the cold in the rooms. Caught
images by the Commissioner's surveillance system of detainees in which it appears as
It is mentioned, the images have been used to instruct a disciplinary procedure.
The complainant clarifies that there was no arrest that night, and that the images were
requested by the Inspector *** POSITION.2 on *** DATE.3 to “ sanction the
complainant for wearing the uniformity incorrectly ”, to the official in charge of
telecommunications that proceeded on *** DATE.2 and that their use for this purpose
it is not adequate, because there were other officials present who could have
testified about the fact.
There is the instruction of the Ministry of Interior 12/2015 that states that in the
detention centers there must be a video surveillance system to ensure the
physical security of persons deprived of liberty and of the officials exercising their
custody.
Provides partial copy (crossed out some ends to make reading impossible
complete) of:
one)
Minutes provided by the Inspector *** POSITION. 2,
BBB of
*** DATE. 3 , as “ reported ”, “ proceedings *** DILIGENCE. 1 in relation to complaint
of "workplace harassment " urged by the claimant. In said statement, from which it follows that
relates to legal proceedings, the Inspector states that he saw the claimant
night of *** DATE.1 because he went to give him the denial of a permit and saw him without the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 2
2/22
regulatory uniformity, and admonished him, and in order to prove it, since it was
Repeatedly, the next morning he requested a copy of
the images obtained by the cameras next to the lobby of his office, to
Check if you had modified your behavior and complied with the order. “ However
subsequently caused work leave, which is why no action has been processed
disciplinary ”.
two)
Declaration of declaration (there are also crossed out numerous paragraphs in the written
same matter) of the Commissioner, as a witness, who states that the Inspector
POSITION 2 commented on the claimant's lack of uniformity and the next morning the
Inspector informed him that he had requested the recording of the cameras in the hall of the
Commissioner in order to check if he had finally fulfilled the order.
3)
Declaration of declaration of the telecommunications manager, as a witness, that
indicates that he was ordered to obtain a copy of the images of the time slot between 0
hours and 4 hours of *** DATE. 2 , “ knowing later that the object of said
request was to check if *** POSITION.1 wore the regulatory uniform ”.
Provides copy of record of delivery of recordings of *** DATE. 2 at the request of
POSITION Inspector. 2
SECOND : In view of the facts denounced, by the Subdirectorate General of
Data Inspection, the complaint is transferred to the DIRECTORATE GENERAL OF THE POLICE,
to send to this Agency the relevant documentation related to the procedures
carried out by the controller, in relation to the facts presented
in the claim, including in particular the following information:
one.
Clear specification of the causes that have motivated the incidence that has resulted
gar to the claim.
two.
Details of the measures taken by the person responsible for solving the incident and
to avoid that new incidents occur as the exposed one.
3.
Documentation accrediting that, in accordance with the provisions of article 12 of the
GDPR, the appropriate measures have been taken to facilitate the exercise of their
rights under articles 15 to 22, including full copy of communications
nes sent in response to requests made.
Four.
Documentation accrediting that the claimant's right to be treated has been met
informed about the course and the result of this claim.
The General Directorate of the Police, dated 3/08/2018 and on the use of
video surveillance cameras of the Provincial Police of *** LOCATION.1 , states
to)
Attached is a report from the Informatics and Communications Unit of the
Central Head of Logistics and Innovation of the General Directorate of the Police. In it she
reports that “ The management of CCTV equipment installed in the dungeons of the
Commissioner of *** LOCATION. 1 is carried out by the Commissioner herself ”and continues giving
details of said system.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 3
3/22
THIRD: On 09/05/2018, the respondent indicates that he has not received an answer for
part of the delegate of data protection, and on 12/5/2018 another writing indicating that
has not received a reply from the AEPD.
The same type of complaint from the complainant that has not received a response has
Entry on 02/21/2019 and 03/13/2019.
On 03/04/2019, it was sent written informing you of the status of your complaint.
FOURTH: On 04/01/2019 it was agreed by the director of the AEPD:
“ Initiate sanction procedure to the Ministry of Interior-General Directorate of Police
(Provincial Commissioner of *** LOCATION. 1 of the National Police Corps) by the alleged
violation of article 5.1.b) of the GDPR, infraction typified in article 83.5 a) of the
GDPR
In the shipment sent through the nofitic @ platform, it is certified:
“ The Support Service of the Electronic Notifications and Electronic Address Service
CERTIFY enabled:
- That the Ministry of Territorial Policy and Public Function (through the Secretariat
General of Digital Administration) is currently the head of the Notification Service
Electronics (SNE) and Electronic Address Enabled (DEH) in accordance with the Order
PRE / 878/2010 and Royal Decree 769/2017, of July 28. The service provider
since June 26, 2015, it is the National Mint and Doorbell-Real Casa de la
Currency (FNMT-RCM), according to the current Management Commission of the Ministry of Finance
and Public Administrations.
-That the notification was sent through this service:
Reference: 94162555ca5cd5c8ab84 Acting Administration: Spanish Agency of
Data Protection (AEPD) Owner: GENERAL DIRECTORATE OF THE POLICE-SERVICES
CENTRALES-MIR - S2816015H
Subject: "Notification available in the Folder or DEH of the indicated holder" with the following
Outcome:
Date made available: 04/07/2019 05:00:38
Automatic rejection date: 04/15/2019 00:00:00
Automatic rejection occurs, in general, after ten days have elapsed
natural since it was made available for access according to paragraph 2, article 43, of
Law 39/2015, of October 1, of the Common Administrative Procedure of the
Public administrations. And in particular, exceeding the deadline established by the
Administration acting in accordance with the specific legal regulations that are
application .
The LPCAP adds in its article 14 " Right and obligation to relate
electronically with the Public Administrations “
2. In any case, they will be obliged to interact through electronic means with the
Public Administrations for carrying out any procedure of a procedure
administrative, at least, the following subjects:
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 4
4/22
a) Legal persons . ”
And it is specified in article 41 ” General conditions for the practice of
notifications “1. Notifications will preferably be practiced by means
electronic and, in any case, when the interested party is obliged to receive them in this way.
Notwithstanding the foregoing, Administrations may practice notifications by
non-electronic means in the following cases:
to)
When the notification is made on the occasion of the spontaneous appearance of the
interested or your representative at the registration assistance offices and request
the communication or personal notification at that time.
b)
When to ensure the effectiveness of administrative action is necessary
practice notification by direct delivery of a public employee of the Administration
notifying
Regardless of the medium used, notifications will always be valid
that allow you to have proof of your sending or making available, of the receipt or
access by the interested party or their representative, of their dates and times, of the entire content,
and of the reliable identity of the sender and recipient thereof. The accreditation of the
notification made will be incorporated into the file. ”
As a consequence, the notification of the agreement is understood as produced with all
The legal effects.
FIFTH: A copy of the website of instruction 1/2012 of 10/1/2015 is obtained, (numbered
as 12/2015) of the Secretary of State for Security, (SES) approving the
" protocol of action in the custody areas of detainees of the forces and bodies of
state security ". It is incorporated into the file as an associated object 2 in the
application that manages it.
In the same figure: 2 f. Video Surveillance: The Detention Centers of the Forces and
State Security Bodies will have video surveillance systems with recording
that contribute to guarantee the physical integrity and safety of persons deprived of
freedom and that of the police officers who exercise their custody. This recording must
be permanently active, regardless of the agents in charge of the
custody must maintain permanent control of the dungeons through the media
of video surveillance.
Video surveillance systems will be governed by the provisions of the Organic Law
4/1997, of 4/08, which regulates the use of camcorders by the Forces and
Security forces in public places. In no case may they allow
visualization of the toilet areas, in order to preserve the privacy of people
arrested
Online copy of instruction no. 4/2018, signed on 05/14/2018 of
the SES approving the update of the "p protocol of action in the areas of
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 5
5/22
custody of detainees of the State Security Forces and Bodies "and left without
effect instruction 12/2015. It is incorporated into the file as an associated object 1 in
the application that manages it.
Figure in point 2.f):
“ Video Surveillance: The Detention Centers of the Security Forces and Bodies of the
State will have video surveillance and recording systems, which allow viewing
in the light conditions of their rooms, to ensure physical integrity and
security of persons deprived of liberty and that of police officers who
They exercise custody.
Said recording must be permanently active, regardless of whether
custody officers must maintain control of the dungeons to
through the means of video surveillance.
The recordings will be kept for thirty days from their capture.
Once this period is over, they will be destroyed, unless an incident occurs in
the course of custody of a detainee or related to criminal offenses
o Serious or very serious administrative matters regarding public safety; with a
police investigation in progress or with an open judicial or administrative procedure. In
in these cases, the recording will be kept available to the competent Authorities s. ”
SIXTH: Within the testing period, the claimed one is notified on 06/24/2019 the start
of the testing period, requesting:
-Croquis de Comisaria de *** LOCALITY.1 in which the events happened, in the
that the situation in which the camera that was used to collect the
image of the claimant and type of room in which they were collected and selected
images. Color image of the field collected by said camera identifying the spaces
towards which it focuses.
-Indicate if it has been delivered to the officials who provide custody services and
keep a guide explaining the use or purpose of these
cameras, and if they have been informed that they may be subject to disciplinary sanctions, in which
assumptions, how they have been informed. Specifically to the claimant.
-If you know if the claimant has been sanctioned, copy of the resolution, copy of
documents involved in the procedure, and if you know your administrative challenge and
(/ or judicial).
-Position / hierarchy held by the person requesting the extraction of
images, and if the General Directorate of the Police has issued any instruction on the
request for data from video surveillance systems, procedures to follow in the request
of said data, registration of the requests, to whom it is appropriate to decide whether they are delivered or not,
or if you consider its preparation convenient.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 6
6/22
- If at the disciplinary level, the person who requested the extraction of images may initiate
ciar a disciplinary procedure, procedures to be carried out.
A copy of the initial agreement is sent to you so that it can be read and
knowledge and with what is requested to contribute what was requested and allege what in your case
consider appropriate.
Received the shipment, dated 8/07/2019, the claimed submits written in which without
respond to what is questioned, provides:
a) report prepared by the provincial Commissioner of *** LOCATION. 1 , subject;
“ Sending report on CCTV use for disciplinary purposes ” signed by the Inspector
POSITION. 2 Mr. BBB , on 2/01/2019. It highlights:
- “ At 11.30 pm of the past *** DATE 1 was presented in the office of
*** POSITION 1 of the Commissioner ... (claimant) checking according to the same
inspector acknowledges in his statement that he was a citizen, two
hours after having started the service ”he claimed the fact and ordered
to put on the uniform ”,“ he was aware that the said person did not wear the
uniform during night shifts but lacked evidence ”” In anticipation of
that he failed to comply again with the order to provide his uniformed service, he requested
formally to the head of the CCTV system that will view the images of the
*** DATE 1 night from 23.45 to check if it had changed and in
otherwise, extract the precise images to inform the Commissioner of
said fact and be able to prove it ”. “The Inspector - claimant - discharged medical
from *** DATE.4 and then denounced him for workplace harassment and for
infractions of LO 4/2010 of the disciplinary regime regulation for infringing the
legislation on the use of camcorders. "Both complaints were filed" by
the administrative dispatch unit. In the brief it indicates that it is cameras
whose images are obtained and used by the security forces and bodies of the
status, and which are governed by the provisions on the matter. Report the reports
of 2009 numbers 286, 472 of the AEPD on the possibility of using recordings
of the CCTV system installed in police units as evidence
to demand disciplinary responsibilities, it is indicated that “it lacks competencies
to assess what evidence may or may not contribute to disciplinary proceedings ”
Indicates that the purpose of the system is the security of the commissioner and protection
inside and outside the building, so I think that although “they are installed
for this purpose, this does not exclude its use to verify and verify the object facts
of an investigation, so it was relevant, legal, justified and proportionate
use it to prove and thus be able to debug disciplinary responsibilities if
there would be ”, it was limited to cameras whose purpose is public safety and
control of entry and exit of citizens, therefore including the schedules of
service provision “
Report 286/2009 of the Legal Cabinet is associated with the procedure
of the AEPD, signed by State Attorney of 06/12/2009, found in the SIJ application
which manages these reports, which appears with the following literal:
Entry Ref 177676/2009 (SEP-CV Trade Union Section of the City Council of
Benidorm)
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 7
7/22
Having examined your request for a report, sent to this Legal Office, referring to the
consultation raised by the SEP-CV Trade Union Section of the Benidorm City Council,
please inform me of the following:
The consultation raises several issues related to the installation of systems
of video surveillance by the City of Benidorm, to check if they comply with the dis-
put in the Organic Law 15/1999, of December 13, on Data Protection of Character
Personal ter.
The first question raises whether the City Council has obtained authorization from the
Spanish Agency for Data Protection to install the video surveillance system in the
local police building. On this point, it is reported that the Spanish Agency of
Data Protection lacks powers for the authorization of video surveillance systems
gilance, being its competence to ensure that the data processing derived from the
existence of such systems is in accordance with the provisions of Organic Law 15/1999,
of December 13, Protection of Personal Data, and Instruction 1/2006,
of November 8 of this Agency.
However, we can point out that the aforementioned City Council notified and has registered
in the General Registry of Data Protection, a file of video surveillance cameras
of the Police, whose name and stated purpose is “Access control and surveillance of the
Police building ”and“ video surveillance ”.
In the declaration of the aforementioned file, it is stated that the General Provision of
Creation of the file was published in the Bulletin of the Province, with number 00067 and date
April 9, 2008.
As for the period of conservation of the images, according to the purpose
described in the File Creation Provision, the Instruction is applicable
1/2006, of November 8, of the Spanish Agency for Data Protection, on the treatment of
Personal data for video surveillance purposes through camera systems
or camcorders where it is foreseen in article 6 that “The data will be canceled in the
maximum period of one month from its acquisition. ”
Regarding the term that the images can be kept, the Agency has pronounced
cited in the report of July 3, 2008, regarding the basis of said deadline
do what
“Article 6 of instruction 1/2006, which regulates the term of conservation of
the images are closely related to the provisions of article 4.5 of the
Organic Law 15/1999 which states the following “The data will be canceled when
have ceased to be necessary or relevant for the purpose for which they would have
have been collected or registered. ”, this provision is reiterated in article 8.6 of the
development regulation of the Organic Law. The criteria of the Agency according to
This principle has been to understand that the images recorded to comply with the fi-
Security purpose must be kept for a maximum of one month, one
Once this purpose has been fulfilled, they must be canceled. So that term
It remains in force after the Regulation enters into force as it does not oppose
forecasts contained therein.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 8
8/22
A greater abundance it is necessary to emphasize that the term of one month than in
The Instruction is set to cancel the images, it is not arbitrary, since
it has been decided to follow the same criteria as that established in Organic Law 4/1997,
of August 4, which regulates the use of camcorders by the Forces
and State Security Bodies in public places, which in its article 8 indicate
which “The recordings will be destroyed within a maximum period of one month from its
catchment".
On the other hand, the instruction expressly states in article 6 that “the
data will be canceled within a maximum period of one month from its acquisition ”, he wants
that is to say that after this period has elapsed, the images must be
celadas, which implies the blocking of the same, as established by the Law
15/1999, which in article 16.3 states that “the cancellation will result in the
queo of the data, keeping only available to the Administrations
Public, Judges and Courts, for the attention of possible responsibilities-
born from the treatment, during the period of prescription of these. Complied with
said period must be deleted ”.
The consultation also raises whether the omission of the duty to inform the rights of
access, rectification, cancellation and opposition of the data makes the cameras illegal
flush So that the installation of these cameras conforms to the provisions of the regulations of
data protection, compliance with certain requirements such as; the le-
amount of image processing. Article 6.1 of Organic Law 15/1999 to which
Article 2 of Instruction 1/2006 is referred to, states that “The data processing of
personal character will require the consent of the affected party, unless the Law provides another
thing". What obliges to go to a Law that provides for the treatment of images without recalling
bar the consent of the affected.
In this sense, Organic Law 2/1986, of March 13 of Forces and Bodies of
Security in its article 11, regulates its functions indicating that “1. The Forces and Cuer-
The State Security's mission is to protect the free exercise of rights
and freedoms and guarantee citizen security by performing the following
functions: (..) c) Monitor and protect public buildings and facilities that require it ”,
Consequently, we can conclude that Organic Law 2/1986 legitimizes the treatment of
The images are collected in the police offices.
Likewise, the duty to inform must be fulfilled in accordance with the provisions of the
Article 3 of Instruction 1/2006, and notify and register the file in the General Registry of
Data Protection. In addition to allowing the exercise of the rights to which they refer
Articles 15 and following of Organic Law 15/1999, under the terms of Article 5 of
The instruction. In the exercise of rights, specialties should be taken into account.
from article 23 of Organic Law 15/1999, since exceptions to the regulations are regulated
access, rectification and cancellation rights in the files for which I am responsible
the State Security Forces and Bodies.
Finally, it is considered, if the recordings obtained through the video-video system
installed in the premises of the local police, they can be used as a
God of proof to demand from the police disciplinary responsibilities. On this point,
It should be noted that the Agency lacks the powers to assess what evidence or not
They can be provided in a disciplinary procedure.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 9
9/22
However, according to the purpose stated in the General Registry of Protection of
Data, the file created is to control and monitor the access to the building, therefore, if the answers
disciplinary responsibilities, were derived from access to it (entry time and
exit by the police) could be used, and cannot be used to
other types of purposes, which are not declared.
Finally, in the event that the existence of a
action allegedly contrary to Organic Law 15/1999, you must address your complaint
before this same body, in order to take the necessary measures to
In order to check whether or not to open the corresponding sanction file
being so that article 37.1.g) of the Law attributes to this Agency the sanctioned power-
ra regarding data protection.
In any case, the allegations made by the complainant should contain the
Documentation proving the effective reality of the facts. Such complaint must
be submitted in writing and go to the Spanish Agency for Data Protection in terms of
mines established in article 70 of the Law on the Legal Regime of Administrations
Public and Common Administrative Procedure, must contain:
to)
Name and surname of the interested party and, where appropriate, of the person representing him,
as well as the identification of the preferred medium or place indicated for that purpose
of notifications.
b)
Facts, reasons and request in which the request is clearly specified.
c)
Place and date.
d)
Signature of the applicant or accreditation of the authenticity of his will expressed by
any means
and)
Body, center or administrative unit to which it is addressed. (in his case it would be the sub-
General Directorate of Data Inspection of this Agency ”
The State Lawyer Report 472/2009, of
10/20/2009:
Entry ref. *** REFERENCE. 1 (Foundation *** FOUNDATION. 1)
“ Having examined your request for a report, sent to this Legal Office, referring to the
consultation raised by the *** FOUNDATION.1 , please inform me of the following:
The consultation raises several issues related to the issues of
video surveillance, to adapt its performance to Organic Law 15/1999, of 13 of
December, Protection of Personal Data, as in the Regulations of
development of the same and Instruction 1/2006, of November 8, on the treatment
of personal data for surveillance purposes through camera systems or
camcorders
The first question refers to the obligation to keep the blocked images,
in this regard, it should be noted that the period of conservation of the images, according to the
Article 6 of Instruction 1/2008 that “The data will be canceled within the maximum period
one month since its capture. ”
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 10
10/22
Regarding the term that the images can be kept, the Agency has pronounced
cited in the report of July 3, 2008, regarding the basis of said deadline
do what
“Article 6 of instruction 1/2006, which regulates the term of conservation of
the images are closely related to the provisions of article 4.5 of the
Organic Law 15/1999 which states the following “The data will be canceled when
have ceased to be necessary or relevant for the purpose for which they would have
have been collected or registered. ”, this provision is reiterated in article 8.6 of the
development regulation of the Organic Law. The criteria of the Agency according to
This principle has been to understand that the images recorded to comply with the fi-
Security purpose must be kept for a maximum of one month, one
Once this purpose has been fulfilled, they must be canceled. So that term
It remains in force after the Regulation enters into force as it does not oppose
forecasts contained therein.
A greater abundance it is necessary to emphasize that the term of one month than in
The Instruction is set to cancel the images, it is not arbitrary, since
it has been decided to follow the same criteria as that established in Organic Law 4/1997,
of August 4, which regulates the use of camcorders by the Forces
and State Security Bodies in public places, which in its article 8 indicate
which “The recordings will be destroyed within a maximum period of one month from its
catchment".
On the other hand, the instruction expressly states in article 6 that “the
data will be canceled within a maximum period of one month from its acquisition ”, he wants
that is to say that once this period has elapsed the images must be
canceled, which implies blocking them as established by law
Organic 15/1999 that in article 16.3 states that “the cancellation will result in
data blocking, being kept only available to
Public Administrations, Judges and Courts, for the attention of possible
responsibilities arising from the treatment, during the prescription period of
these. Once the aforementioned deadline has elapsed, the deletion must proceed.
On the other hand, the Regulation of development of the LOPD, approved by Royal Decree
1720/2007, of December 21, defines in its article 5.1. b) cancellation as
“Procedure under which the person responsible ceases to use the data. The
cancellation will imply the blocking of the data, consisting of the identification and reservation of
the same in order to prevent its treatment except for its provision
Public Administrations, Judges and Courts, for the attention of possible
responsibilities arising from treatment and only during the prescription period of
those responsibilities. After this period, the deletion of the
data."
As for the way to carry out the blockade, it was indicated in this report
Agency of June 5, 2007 that “must be carried out in such a way that the
access to data by personnel who usually had such access, for example
For example, the personnel that provide their services in the consulting center, limiting access to
a person with maximum responsibility and by virtue of the existence of a requirement
To judicial or administrative for this purpose. Thus, despite remaining the treatment of
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 11
11/22
data, access to them would be entirely restricted to people at
that reference has been made. ”
As for the term of conservation of blocked images, we can only
reiterate what was stated in the report attached by the consulting entity of 18 of
February 2009, which states “it is impossible to establish a taxable list
It goes from them, and must, fundamentally, be taken into account, as already indicated.
previously, the statute of limitations for the actions that could be derived from
the legal relationship that links the client to his client, as well as those derived from the
tax regulations or the limitation period of three years, provided for in article 47.1 of
Organic Law 15/1999 itself in relation to constitutive infraction behaviors
very serious."
And as regards the last question raised, it is necessary to distinguish whether the
recordings are made on digital media or not, because if it is done on
digital transport, there is an automated data processing, which implies the obligation of
comply with the basic level security measures provided for in article 94 of the Regulation
Development of Organic Law 15/1999. ”
b) Copy of the Report of the Subdirectorate General of Logistics and Innovation of
12/3/2018, recipient “ data protection delegate. Technical Cabinet ”
In it, we now talk about the “ video surveillance ” file for the purpose of
“ Guarantee the internal and external protection of the CNP Commissioners and buildings,
facilities and centers monitored by it, its use is aimed at "security and
protection . " The system is regulated by Internal Order 1865 of 11/30/2016 of the Ministry of
Interior amending Order INT / 1202/2011, of 4/05, which regulates the
personal data files of the Ministry of Interior, BOE 12/12/2016. In the
single article indicates that both the new creation of the files that are contained and
The modification is governed by the LOPD and development regulations.
In it the file is created: " Video Surveillance" which highlights:
a.2) Purpose: To guarantee the security and internal and external protection of the Police Stations
of the National Police Corps and the buildings, facilities and centers monitored by the
same .
a.3) Intended uses: Security and protection.
b) Origin of the data:
b.1) Collective: People who are in video surveillance areas of the police stations
of the National Police Corps or of the buildings, facilities and centers monitored by the
same.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 12
12/22
b.2) Origin and collection procedure: Closed circuit television.
c) Basic structure of the file:
c.1) Description of the data:
Identification data: Image / voice.
c.2) Treatment system: Automated.
d) Expected data communications: judicial bodies, Fiscal Ministry and other ser-
vices of the National Police Corps for the exercise of legally enforced functions
as well as other Security Forces and Bodies for the exercise of their functions
protection of public safety, in accordance with the provisions of article 22.2
of Organic Law 15/1999, of December 13, in compliance with the principles of cola-
reciprocal cooperation, mutual assistance and cooperation and information established by the Organic Law
Nicaraguan 2/1986, of March 13.
e) International transfers of data provided to third countries: Not provided.
f) Body responsible for the file: General Subdirectorate of Logistics, Calle Julián Gon-
Zález Segador, without number, 28043 Madrid.
g) Service or Unit to which access rights could be exercised, rectified
tion, cancellation and opposition: General Secretariat of the General Sub-Directorate of Logistics,
Julián González Segador street, without number, 28043 Madrid.
i) Basic, medium or high level of security that is required: High.
He adds that “ Currently the telecommunications area of the unit of
computer science and communications has a procedure for the treatment of
video surveillance images where the following aspects are determined: ”The system of
access control to images, consist of an alphanumeric key with two categories
of users: administrator with permissions for viewing and extracting images and
basic user only with permissions for viewing. ICT delegates hold permits
of user administration and therefore for the extraction of images in all
provincial commissioners of the CNP ”
SEVENTH: On 09/18/2019 a written response is received from the claimant requesting
inform you of the status of the procedure, ask to be considered interested in it,
deciding to communicate the end of the procedure for the purpose of the web consultation of the
resolution.
EIGHTH: On 11/18/2019 a motion for a resolution was issued with the literal:
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 13
13/22
“ That the Director of the Spanish Agency for Data Protection be sanctioned
with warning to the DIRECTORATE GENERAL OF THE POLICE (MINISTRY OF
INTERIOR), for a violation of Article 5. 1 b) of the RGPD, typified in Article 83.5
of the GDPR . ”
The claimant submits allegations indicating that the events occurred before
the entry into force of the GDPR, and this is important because “ During the period of validity of
the previous LOPD the Courts have maintained that the use of images coming from the
Chambers of commissioners to check the correct functioning of the services
Police cannot be considered an incompatible purpose prohibited by law, although
its main use is the security of property and people ”.
PROVEN FACTS
one)
The Inspector *** POSITION. 2 of the Provincial Brigade of Citizen Security of the
Commissioner of *** LOCATION. 1 , Mr BBB , observes the night of *** DATE.1 that the
complainant, Inspector of the CNP and *** POSITION. 1 , is not properly uniformed, carrying
a black fleece as declared by the claimant, being admonished by him and sent to
properly uniformed, as stated by the Inspector *** POSITION. 2 , leaving the
place. The next day, the Inspector *** POSITION 2 , decides to verify if the claimant complied
your order and request a copy of the images of the cameras between 0 and 4 of the day
*** DATE . 2 . The extraction of the images is produced by personnel dedicated to
telecommunications in the same commissioner of *** LOCATION. 1 , staff that stated,
that no reason was contained or explained, knowing after the object
of that request was to check if *** POSITION.1 wore the regulatory uniform ”. Do not
the written request is available, if there is an extraction of the images, and it is provided
copy of record of delivery of recordings of *** DATE. 2 , at the request of the Inspector
*** POSITION. 2
two)
As stated by the claimant on the night of *** DATE.1 there was no detainee
in the comisary.
3)
The Commissioner of the CNP of *** LOCATION.1 in which he serves the
complainant, has video surveillance cameras for detainees' cells. I know
this capture is governed by the protocol of action in the Areas of Custody of Detainees
of the State Security Forces and Bodies, instruction of the Secretary of State
of Security 4/2018, signed on 05/14/2018 and which voids Instruction number
12/2015 of the Secretary of State for Security. Figure as the object of “ set
the rules of action of the personnel in charge of custody of detainees ... in order
to guarantee the rights of detainees and their safety and staff
police . ”
“ The recordings will be kept for thirty days from their capture. One time
At the end of this period they will be destroyed, unless there is an incident in the
course of custody of a detainee or related to criminal offenses or
serious or very serious administrative matters regarding public safety; with a
police investigation in progress or with an open judicial or administrative procedure. In
in these cases, the recording will be kept available to the competent Authorities . ”
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 14
14/22
Unlike the previous instruction, it does not indicate that the
video surveillance will be governed by what is established in Organic Law 4/1997, of 4/08, by which
the use of camcorders is regulated by security forces and bodies in
public places.
4)
In the testing period, it is also indicated by the Commissioner of
*** LOCATION. 1 that has cameras for the security of the police station and protection
interior and exterior of the building and in the Report of the General Sub-Directorate of Logistics and
Innovation of 12/3/2018, recipient “delegate of data protection. Technical Cabinet ”
it is specified that these cameras are for the "purpose of" guaranteeing internal protection and
exterior of the CNP Commissioners and the buildings, facilities and centers monitored by
the same. Its use is aimed at " security and protection ." To this system the
LOPD, in accordance with the order of creation of files - Order INT / 1202/2011, of 4/05,
regulating the personal data files of the Ministry of Interior,
BOE 12/12/2016
5)
The claimant has not specified, by not responding in evidence, with what kind of
camera images were obtained on compliance with uniformity by the
complainant, in which spaces were taken, to which of the two systems corresponds
(surveillance of cells or the police station in general) and what protocol exists of request for
Images and delivery.
6)
Neither of the purposes of the data collection process the two systems,
of video surveillance contemplate the use of their images for the purpose of verifying
conduct, compliance with the internal regime, or disciplinary offenses that could
committing the agents, which was the purpose of the petition and extraction of those of the claimant the
*** night DATE . 2 .
7)
In addition, it is proven that the image request and its delivery to the Inspector
*** POSITION. 2 , the claimant's superior is not, nor does it appear in any protocol that regulates the
issue, with authorized persons having access to images exclusively
expressly in some type of document or protocol that regulates the request for images,
reasons and documentation of these aspects.
8)
It is not proven that disciplinary proceedings have been initiated or resolved against the
complainant or based on the lack of uniformity of the night of *** DATE.1 , although if the
Request for images and delivery.
RIGHTS OF LAW
I
Under the powers that Article 58.2 of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 04/27/2016 on the protection of persons
physical with regard to the processing of personal data and the free movement of information
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 15
15/22
cough data (hereinafter GDPR); recognizes each supervisory authority, and as is
established in art. 47 of Organic Law 3/2018, of 5/12, on the Protection of Personal Data
les and guarantee of digital rights (hereinafter LOPDGDD), the director of the
AEPD is competent to initiate and to resolve this procedure.
II
In the present case, given the lack of specificity of the claim, as it does not specify
with what type of camera or its location or regime the images that the
complainant, it can be deduced that there could be two types of cameras in the Commissioner
Where the facts happen. The result is that whatever the system of
cameras employed, extraction for the reasons that occurred and directly for the
Claimant's first superior violates the GDPR in that it is not contemplated in
neither system uses the repression of irregular behaviors by
Agents, and also it is not regulated in your case who has to ask for the images.
On the one hand, the cameras that monitor the cells of the detainees, with their regime
applicable of the Organic Law *** LAW.1 regulating the use of camcorders
For the Security Forces and Corps in public places, you need an authorization
prior issuance of a report by a collegiate body, and the “ resolution by which
agree the authorization must be motivated and referred in each case to the public place
concrete to be observed by camcorders. That resolution
it will also contain all the necessary limitations or conditions of use, in particular the
prohibition of taking sounds, except when there is a specific and precise risk, as well
as those referring to the qualification of the people in charge of the exploitation of the
image and sound treatment system and the measures to be taken to guarantee the
Respect for the legal provisions in force. Likewise, you must specify the
physical scope that can be recorded, the type of camera, its technical specifications
and the duration of the authorization, which will be valid for a maximum of one year, at whose
term must be requested for renewal . ”
As authorization criteria to take into account are indicated: ” To authorize the
installation of camcorders will be taken into account, in accordance with the principle of
proportionality, the following criteria: ensure the protection of buildings and
public facilities and their accesses; safeguard the facilities useful for the
national defense; verify violations of citizen security, and prevent causation
of damage to people and property . ” Art 4
Article 6 describes the “ principles of use of camcorders:
1. The use of camcorders shall be chaired by the principle of proportionality,
in its double version of suitability and minimal intervention.
2. Suitability determines that the camcorder can only be used when it results
adequate, in a specific situation, for the maintenance of citizen security, of
in accordance with the provisions of this Law.
3. The minimum intervention requires the weighting, in each case, between the purpose
intended and the possible affectation by the use of the camcorder to the right to honor,
to one's own image and the privacy of people.
4. The use of camcorders will require the existence of a reasonable risk for the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 16
16/22
citizen security, in the case of fixed, or a specific danger, in the case of
mobiles
5. You cannot use camcorders to take pictures or sounds inside
the dwellings, neither of their vestibules, unless consent of the holder or judicial authorization, nor
of the places included in article 1 of this Law when it is directly affected and
serious to the privacy of people, as well as to record conversations of
strictly private nature. The images and sounds accidentally obtained in
These cases must be destroyed immediately, by the person responsible for
custody .
The space that these cameras have to focus on is related to the
mandatory existence of video surveillance cameras to observe and guarantee the
security of detainees in police dungeons. This modality related to the
public safety does not seem directly related to the lack of uniformity of
complaining public employee, who states, being the night of *** DATE.1 that before the
intense cold that exists in this Commissioner, wore a fleece over the uniform.
Therefore, by reason of the matter, nor those whose purpose is the surveillance of
those detained in cells, or those installed in the police station, to which they apply
The LOPD, since May 2018 the GDPR, are likely to be used for the purpose of
that they have been, without having previously informed of this purpose. To do this, you should first
Having decided by the person responsible for the treatment, that the follow-up of any possible
behaviors likely to be disciplined through said means and modality of
video surveillance for agents in the police station were undertaken with these means, issue
that affects their labor rights and privacy and proportionality should be assessed
and suitability of the system, or for what assumptions.
Instruction 1/201/2006 of 8/11 of the Spanish Agency for the Protection of
Data, on the processing of personal data for surveillance purposes through
camera systems or camcorders, BOE 12/12 indicated in its preamble:
In relation to the installation of camcorder systems, it will be necessary
Weigh protected legal assets. Therefore, every installation must respect the
principle of proportionality, which ultimately means, whenever possible,
adopt other means less intrusive to people's privacy, in order to
prevent unjustified interference in fundamental rights and freedoms .
In the absence of clarification by the claimed of the type of cameras with which
they obtained the images, nothing contributed to what was requested in tests, it should be indicated that the use
of cameras or camcorders should not be the initial means to carry out functions
monitoring so, from an objective point of view, the use of these systems
It must be proportional to the purpose pursued, which in any case must be legitimate.
Regarding proportionality, despite being an undetermined legal concept, the
Judgment of the Constitutional Court 207/1996 determines that it is "a requirement
common and constant for the constitutionality of any restrictive measure of rights
fundamental, including those that involve interference with the rights to integrity
physical and privacy, and more particularly the restrictive rights measures
fundamentals adopted in the course of a criminal proceeding is determined by the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 17
17/22
strict observance of the principle of proportionality ».
Article 4 states:
1. In accordance with article 4 of Organic Law 15/1999 of December 13, of
Protection of Personal Data, images will only be treated when they are
adequate, relevant and not excessive in relation to the scope and purposes
certain, legitimate and explicit, that have justified the installation of the cameras or
camcorders. ”
It states Article 1 of the GDPR “ This Regulation establishes the rules
concerning the protection of natural persons with regard to the treatment of
personal data and rules regarding the free movement of such data.
2. This Regulation protects the fundamental rights and freedoms of
natural persons and, in particular, their right to the protection of personal data . ”
The art. 4.1 and. 2 of the GDPR indicates “ 1 )“ personal data ”: all information on a
identified or identifiable natural person ("the interested party"); will be considered a natural person
identifiable any person whose identity can be determined, directly or indirectly, in
particular by means of an identifier, such as a name, a number of
identification, location data, an online identifier or one or more elements
proper to the physical, physiological, genetic, psychic, economic, cultural or social identity of
said person;
2) "treatment" means any operation or set of operations performed on data
personal or personal data sets, either by automated procedures or
no, such as collection, registration, organization, structuring, conservation, adaptation or
modification, extraction, consultation, use, communication by transmission, dissemination or
any other way of enabling access, collation or interconnection, limitation, deletion
or destruction;
The video surveillance system in the present case implies an identification
direct from the person whose actions are collected when they are in their recording space.
In this case at the Commissioner there were two different systems implemented the one of
video surveillance for detainee cells and the general for security of
facilities, the purpose being different, otherwise none of them for the purpose
of behavior check or repression of agent infractions.
In this case, personal data, the physiognomy of the Agent, are considered
identifiable, together with their clothing, relating if the claimant had adapted the
same dress to the internal regulations of personnel, being captured by way of accreditation
reliable obtaining the images that focused that space between a section
differentiated schedule, which was selected by *** POSITION. 2 , which had hours before
seen and warned of the lack of uniformity, in order to punish a fault.
The use of images in both systems, recording, conservation, extraction,
It relates to the safety of people, agents or facilities. However, in
This case has been used in the workplace as a means of verification. The AEPD does not
it is pronounced on the validity of the images that will be contributed to the procedure
disciplinary, but for the legitimacy and legality of the same according to the regulations of
data protection and the treatment that is accredited is carried out with the data
Personal affected.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 18
18/22
Article 18.4 of the Spanish Constitution states: “ the law will limit the use of the
informatics to guarantee the honor and personal and family privacy of citizens and the
full exercise of their rights ”.
In accordance with the ruling of Constitutional Court 254/1993 that initiates the
doctrine of the right to data protection: “… From everything said it turns out that the content
of the fundamental right to data protection consists of a power of disposition and of
control over personal data that empowers the person to decide which of those
data provided to a third party, be it the State or a private party, or what this third party can
collect, and that also allows the individual to know who owns that personal data and
for what, being able to oppose that possession or use. These powers of disposition and control
on personal data, which constitute part of the content of the fundamental right to
Data protection is legally specified in the power to consent to the collection,
Obtaining and accessing personal data, its subsequent storage and
treatment, as well as its use or possible uses, by a third party, be it the State or a private individual.
And that right to consent to the knowledge and treatment, computer or not, of the data
personal, it requires as indispensable complements, on the one hand, the power to know
at all times who has this personal data and what use it is
submitting, and, on the other hand, being able to oppose that possession and uses. ”
In conclusion of the two reports of the Legal Department of the AEPD alleged
for the claim, it is not possible to collect that video surveillance cameras for internal control
located in the Commissioners, whether they control entrances, are of another type, which are not referred to
reports are required, as to whether their purpose is the safety of their facilities and their
sonal, there is no extensive use for the purpose of correcting disciplinary behaviors of
its employees, be police officers, be another type of personnel, such as the control of the
claimant's uniform. With such data processing for that disciplinary purpose, it affects
ta to the legal sphere of its staff, creating a means of compliance verification
of conduct without prior information that affects a fundamental right, without security
legal status in terms of its use, subjects authorized for the petition, levy, and determination
rights of the affected access, cancellation, conservation and non-manipulation, security,
etc.
Nor is it true that with the LOPD different uses are enabled for the purpose
File or processing. In addition, remember that incompatible use is not sanctioned,
but a use for a purpose for which it was not reported, outside the expectations of
employees.
III
The GDPR, article 5.1.b) of the GDPR indicates:
"one. The personal data will be:
b) collected for specific, explicit and legitimate purposes, and will not be treated
subsequently incompatible with these purposes; according to article 89,
section 1, the further processing of personal data for the purpose of archiving in interest
public, scientific and historical research purposes or statistical purposes will not be considered
incompatible with the initial purposes ("limitation of purpose")
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 19
19/22
Requirement for a data processing to be in accordance with the provisions of the
normative is that it is legitimized in the provisions of article 6 and that
Adjusting to its principles of Article 5. However, data processing cannot be legitimized
of video surveillance for verification purposes of compliance with the internal regulations in the
employee consent. To do this, we must go to another legitimate base that
it could be the control of compliance with established legal obligations, but as
It has been noted above that would require valuing various elements and taking into account
various aspects, among others the proportionality of use, in this case of an order that
It occurred when he saw the Agent that he was not properly uniformed, to do so.
In this case, the images are treated with an end that is not the one provided by the
treatment operations established by the video surveillance systems of the
Police station.
The LOPD is applied, or the GDPR is applied, the basic principle breached, in case of
that the system be considered proportional to the purposes and had been implemented, is that no
those affected, in this case the complainant, were informed of the use of the system, of their
consequences and the rights that derive from it. The circumstance of no
having been done supposes, with its use, a deviation of purpose, since the system was
provided for the security purposes of the Commissioner, the Agents, or, where appropriate, of the
detained The breached principle is that the infringement of the claim is opened, 5.1 b)
of the GDPR.
On the other hand, the consequences in both norms is the declaration of infraction
LOPD or the warning, GDPR. In both cases it implies the declaration of a form of
act does not match the data protection regulations and the requirement for
adequacy of behaviors hereafter, if not done during the substantiation of the
same to what the norm foresees.
In this sense, it is ignored if the system has been used later
video surveillance in some case similar to that reported in said commissioner, given the lack
of explanations as requested in tests.
IV
In addition, for the virtuality of the operation of the system, the
compliance with the principle, which imposes the obligation of prior information to employees
and consultation with their representatives. In that sense, it is worth mentioning the sentence
of the Constitutional Court of 29/2013 of 11/02 that in a case of control by
video surveillance of an employee of the University of Seville of which there was suspicion of
irregularities in the fulfillment of your workday, in its foundation of law VII
indicated:
“That right of information also operates when there is legal authorization to
collect data without consent, it is clear that one thing is the
need or not authorization of the affected and other, different, the duty to inform you about
its holder and the purpose of the treatment. It is true that this informative requirement does not
it can be considered as absolute, since limitations can be conceived for reasons
constitutionally admissible and legally provided, but it should not be forgotten that the
Constitution has wanted the Law, and only the Law, to set the limits to a right
fundamental, also demanding that the cut they experience is necessary to achieve
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 20
20/22
the intended legitimate purpose, provided to achieve it and, in any case, respectful of the
essential content of the restricted fundamental right (SSTC 57/1994, of February 28
[RTC 1994, 57], F. 6; 18/1999, of February 22 [RTC 1999, 18], F. 2, and in relation to the
right to personal data protection, STC 292/2000 [RTC 2000, 292], FF. 11 and
16). ”
There is no express legal authorization for that omission of the right to
information on the processing of personal data in the field of relationships
labor, without for that purpose the basis of interest in controlling the activity is sufficient, and
without it being sufficient that, in the specific case, that data processing results
eventually provided to the end pursued.
The TCo, 29/2013 added that “ prior and express information was necessary ,
precise, clear and unequivocal to the workers of the purpose of control of the activity
labor to which this uptake could be directed »and that« should specify the
characteristics and scope of the data processing that was to be carried out, that is, in what
cases the recordings could be examined, for how long and with what
purposes, explaining very particularly that they could be used for the imposition of
disciplinary sanctions for breaches of the employment contract ».
The idea from which to start when determining the essential content of the right that
enshrines article 18.4 of the EC is that if the legislation recognizes certain
guarantees linked to the fundamental right to the protection of personal data,
in this case, the prior informative duty that allows having full
knowledge of who owns personal data and what they are used for. Only then can he
worker or employee know the use and consequences of the collection of their data,
“ Informative self-determination ”, and also request, as part of your right, the
limitation, access, cancellation or deletion of data.
In this case, the specific and punctual, predetermined extraction of a strip
time at which the claimant was not in uniform, has served directly to
monitor compliance with its uniformity with a video surveillance system that did not have
that purpose
V
Article 58.2 b) and d) of the GDPR provides as follows: “Each supervisory authority
You will have all the following corrective powers indicated below:
b) sanction all responsible or responsible for the treatment with warning
when the processing operations have violated the provisions of this
Regulation; -
d) order the person responsible or in charge of the treatment that the operations of
treatment conform to the provisions of this Regulation, where appropriate, of
a certain way and within a specified period;
The imposition of this measure is compatible with the warning penalty,
as provided in art. 83.2 of the GDPR.
No concrete measures are imposed to be implemented by the complainant, since no
the treatment appears detailed with the purpose with which it has been carried out, and must
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 21
21/22
not be reused on another occasion, unless you prove the proportionality of the
purpose of the use of verification of disciplinary regulations and adequate and clear
information on such use to those affected. As indicated in this resolution,
a new purpose would have to be added if I decided to carry out disciplinary control
for the system for capturing camcorders inside the curators, for which
It should meet the requirements of the GDPR.
Article 83.5.a) of the GDPR indicates
"5. Violations of the following provisions will be sanctioned, in accordance with
Section 2, with administrative fines of a maximum of EUR 20 000 000 or, in the case of
of a company, of an amount equivalent to a maximum of 4% of the turnover
overall annual total of the previous financial year, opting for the largest amount:
a) the basic principles for treatment, including the conditions for
consent under articles 5, 6, 7 and 9; ”
Article 83.7 of the GDPR states:
“ Without prejudice to the corrective powers of the supervisory authorities under the
Article 58, paragraph 2, each Member State may establish rules on whether it is possible,
and to what extent, impose administrative fines on public authorities and agencies
established in that Member State ”
The LOPDGDD, in its article 77 indicates
The Spanish legal system has chosen not to penalize the
public entities, as indicated in article 77.1. c) and 2. 4. 5. and 6. of the
LOPDDGG: “ 1. The regime established in this article shall apply to
treatments for which they are responsible or in charge:
c) The General State Administration, the Administrations of the communities
autonomous and the entities that make up the Local Administration.
2. When those responsible or managers listed in section 1 committed
any of the infractions referred to in articles 72 to 74 of this organic law,
the competent data protection authority shall issue a resolution sanctioning
to them with warning. The resolution will also establish the measures that
it is necessary to adopt so that the conduct ceases or the effects of the infraction that are corrected are corrected
I would have committed.
The resolution will be notified to the person responsible or in charge of the treatment, to the body of which
depend hierarchically, where appropriate, and those affected who had the status of
interested, if applicable.
4. The resolutions that should be communicated to the data protection authority
fall under the measures and actions referred to in the sections
previous.
5. They shall be notified to the Ombudsman or, where appropriate, to similar institutions of
the autonomous communities the actions carried out and the resolutions issued to
under this article.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 22
22/22
6. When the competent authority is the Spanish Agency for Data Protection,
this will publish on its website with due separation the resolutions referring to the
entities of section 1 of this article, with express indication of the identity of the
responsible or in charge of the treatment that would have committed the infraction . ”
the Director of the Spanish Agency for Data Protection RESOLVES:
FIRST: IMPOSE a sanction of APPROVAL to the GENERAL DIRECTORATE OF
THE POLICE (MINISTRY OF THE INTERIOR) , with NIF S2816015H , for a violation of the
Article 5.1 b) of the GDPR, in accordance with Article 83.5 and 58.2.b) of the GDPR.
/
SECOND: NOTIFY this resolution to the DIRECTORATE GENERAL OF THE
POLICE (MINISTRY OF THE INTERIOR) .
THIRD: COMMUNICATE this resolution to the OMBUDSMAN, of
in accordance with the provisions of article 77.5 of the LOPDGDD.
FOURTH: Against this resolution, which ends the administrative procedure in accordance with art. 48.6
of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
interested parties may, optionally, lodge an appeal for reinstatement with the Director of
the Spanish Agency for Data Protection within one month from the day
following notification of this resolution or directly contentious appeal
administrative before the Contentious-administrative Chamber of the National Court, with
in accordance with the provisions of article 25 and section 5 of the fourth additional provision
of the Law 29/1998, of 13/07, regulating the Contentious-administrative Jurisdiction, in
the period of two months from the day following the notification of this act, according to
the provisions of article 46.1 of the aforementioned Law.
Finally, it is noted that according to the provisions of art. 90.3 a) of the LPACAP,
the final decision in administrative proceedings may be suspended cautiously if the interested party
It expresses its intention to file a contentious-administrative appeal. If this is the
In this case, the interested party must formally communicate this fact by writing to
the Spanish Agency for Data Protection, presenting it through the Registry
Agency Email [https://sedeagpd.gob.es/sede-electronica-web/], or through
any of the remaining records provided in art. 16.4 of the aforementioned Law 39/2015, of 1/10.
You must also transfer to the Agency the documentation proving the filing
effective contentious-administrative appeal. If the Agency did not have knowledge of the
interposition of the contentious-administrative appeal within two months from the day
following notification of this resolution, it would terminate the suspension
caution.
Sea Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
