AEPD (Spain) - PS/00448/2021
From GDPRhub
| AEPD (Spain) - PS/00448/2021 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 11.01.2022 |
| Fine: | 3000 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS/00448/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | FA |
The Spanish DPA fined a property owner community €3000 for installing video surveillance cameras that were excessively directed outwards, in violation of the data minimisation principle.
English Summary
Facts
The complainant is an individual. The respondent is a property owner community.
The Spanish DPA received a complaint about cameras that recorded the public road on the property of the respondent. The DPA contacted the company that installed the cameras, which denied the allegation that they monitored adjoining land, inside houses or private spaces.
Holding
After an inspection of the property which determined that the cameras were excessively directed outwards (onto public land), the Spanish DPA held that the property owners were the controllers responsible for the cameras and violated the principle of data minimisation under Article 5(1)(c) GDPR.
Thus, it imposed a fine of €3000 on the property owner community.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6
File No.: PS/00448/2021
RESOLUTION OF PUNISHMENT PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
FACTS
FIRST: A.A.A. (*hereinafter, the complaining party) dated June 1, 2021
filed a claim with the Spanish Data Protection Agency. The
claim is directed against COMMUNITY OF OWNERS R.R.R. with NIF
***NIF.1 (hereinafter, the claimed party). The grounds on which the claim is based
are the following:
“They have several video surveillance cameras recording the exterior area of the public road.
AC. A photograph is attached where it can be seen that they do not record any portal or similar,
but, the sidewalks outside the farm. Around the entire estate happens exactly what
same where they do not record or focus on the perimeter but outside public roads even next to
of a playground on Paseo Gregorio Marañón” (folio nº 1).
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party in fe-
date 06/10/21, to proceed with its analysis and inform this Agency on the
period of one month, of the actions carried out to adapt to the foreseen requirements
cough in the data protection regulations.
On 06/28/21, this Agency received a written response indicating from the
of the installation company—Carlús Seguridad—which is the one that performs the maintenance
of the security system since October 2016.
"None of the installed cameras visualize adjoining land, interior of
homes or private spaces
“The maximum number of days that both recorders can have recording
is 30, currently having 19 days of recording the team of 16 cameras and 30
days the team of 8 cameras”.
Documentary evidence (Doc. No. 1) is provided as a contract between the parties in
where the work of this is reflected in the Installation and Maintenance Service.
THIRD: On September 2, 2021, the Director of the Spanish Agency
of Data Protection agreed to admit for processing the claim presented by the party
claimant.
FOURTH: On November 22, 2021, the Director of the Spanish Agency
of Data Protection agreed to initiate a sanctioning procedure against the claimed party,
for the alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the
GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/6
FIFTH: Once the term granted for the formulation of allegations to the agreement has elapsed,
beginning of the procedure, it has been verified that no allegation has been received
na by the claimed party.
In view of everything that has been done, by the Spanish Data Protection Agency
In this proceeding, the following are considered proven facts:
FACTS
First. The facts bring cause of the claim dated 06/01/21 through the
lime transfers as the main fact the installation of a "system of cameras of
video-surveillance” that captures the exterior sidewalks affecting the rights of third parties.
Documentary evidence is provided that proves the presence of the cameras in the
exterior façade with obvious orientation towards the adjacent public space.
Second. It is accredited as the main person responsible for the installation of the system
COMMUNITY OF OWNERS R.R.R..
Third. An informative poster is available showing the repealed regulations as
LOPD 15/1999, December 13, although located at a certain height on the main façade.
Bedroom. The images provided by the claimant party allow us to verify a
Excessive orientation towards public transit area, without explanation in this regard.
FOUNDATIONS OF LAW
I
By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and according to the provisions of articles 47 and 48 of the LOPDGDD, the Director
of the Spanish Agency for Data Protection is competent to initiate and to re-
solve this procedure.
II
Before going into the substance of the matter, it should be noted that in the Agreement to Start the Fe-
on 11/22/21 you were informed that if you did not make any claim to the Agreement
of Initiation, the same “may be considered as a Resolution proposal” in the terms
Article 64 letter f) Law 39/2015 (October 1).
“f) Indication of the right to make allegations and to be heard in the proceeding.
procedure and the deadlines for its exercise, as well as an indication that, in the event of
make allegations within the stipulated period on the content of the initiation agreement,
this may be considered a resolution proposal when it contains a pronouncement
precise statement about the imputed responsibility.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/6
In the present case, the claim dated 06/01/21 is examined by me-
from which the following facts are transferred to this Agency:
“They have several video surveillance cameras recording the exterior area of the public road.
AC. A photograph is attached where it can be seen that they do not record any portal or similar,
but, the sidewalks outside the farm. Around the entire estate happens exactly what
same where they do not record or focus on the perimeter but outside public roads even next to
of a playground on Paseo Gregorio Marañón” (folio nº 1).
The facts denounced could imply an affectation to the content of art. 5.1 c)
RGPD (regulation currently in force) that provides: “personal data will be:
c) adequate, pertinent and limited to what is necessary in relation to the purposes
for which they are processed (“data minimization”) (…)”.
Individuals are responsible for the installed video-surveillance systems to be
comply with current legislation, and must be able to prove such extremes.
We report to the competent authority.
Cameras installed by individuals must be oriented towards their private space.
vative avoiding the capture of private area of third parties without just cause.
In no case will the use of surveillance practices be admitted beyond the objective environment.
of the installation and in particular, not being able to affect the surrounding public spaces.
contiguous buildings and vehicles other than those accessing the guarded space.
Likewise, in the case of false cameras, they must be oriented
to a private area, avoiding intimidation of neighboring neighbors who are unaware
know whether or not they process personal data.
III
In accordance with the evidence available in this proceeding
sanctioning party, it is considered that the claimed party has a video system
Surveillance that affects public transit area without just cause.
The cameras installed in its appreciation from the outside are oriented
excessively towards public transit area, without the initial manifestations in
the previous phase of investigation are sufficient to decree the Archive of the
actions, remembering that they should be oriented towards the inner perimeter
of the Community and comply with all the requirements set by the regulations in
current force.
The known facts constitute an infraction, attributable to the party
claimed, for violation of the content of art. 5.1 c) RGPD, previously mentioned-
I swim.
IV
Article 83.5 RGPD provides the following:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/6
“The infractions of the following dispositions will be sanctioned, in accordance with the
section 2, with administrative fines of a maximum of EUR 20,000,000 or, treating-
of a company, of an amount equivalent to a maximum of 4% of the volume of
Total annual global business of the previous financial year, opting for the one with the highest
amount:
a) the basic principles for the treatment, including the conditions for the
consent under articles 5, 6, 7 and 9;
When motivating the sanction, the following is taken into account:
-the nature of the infraction by having a video-surveillance system that is
oriented towards public transit area without just cause, treating personal data
identifiable physical data (art. 83.5 a) RGPD).
-the intentionality or negligence of the infringement, (art. 83.2 b) RGPD), since with the
video-surveillance system performs excessive control of public area without just cause
ficada any, highlighting the poor orientation of the installation of the device (s).
The evidence provided is considered sufficient to prove the infringement
object of imputation, when verifying the bad orientation of the same, as well as the
absence of response despite the requirements of this body on
concrete and precise questions.
For all this, a penalty is agreed in the amount of €3,000 (Three Thousand Euros),
by having a camera system that excessively records areas of a public nature.
sanction located on the lower scale of this type of infraction and according to the nature
rarity of the facts described.
v
Among the corrective powers contemplated in article 58 of the RGPD, in its section 2
d) it is established that each control authority may “order the person in charge or
of the treatment that the treatment operations comply with the provisions
of this Regulation, where appropriate, in a certain way and within
a specified period…”. The imposition of this measure is compatible with the sanction
consisting of an administrative fine, as provided in art. 83.2 of the GDPR.
Therefore, in accordance with the applicable legislation and after assessing the graduation criteria
tion of the sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: IMPOSE the COMMUNITY OF PROPRIETORS R.R.R., with NIF ***NIF.1,
for an infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the
RGPD, a fine of €3,000 (three thousand Euros).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/6
SECOND: ORDER the claimed party in accordance with article 58.2 RGPD
so that within ONE MONTH the regularization of the system is accredited, providing im-
display pressure (date and time) of the orientation angle correction of the face (s)
in question.
THIRD: NOTIFY this resolution to the COMMUNITY OF OWNERS
R.R.R.
FOURTH: Warn the sanctioned party that he must make the imposed sanction effective once
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co-
of the Public Administrations (hereinafter LPACAP), within the term of payment
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, through its entry, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency
Department of Data Protection at the banking entity CAIXABANK, S.A.. In case of
Otherwise, it will be collected during the executive period.
Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
will be until the 20th day of the following month or immediately after, and if
is between the 16th and last day of each month, both inclusive, the term of the payment
It will be valid until the 5th of the second following month or immediately after.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
resents may optionally file an appeal for reconsideration before the Director
of the Spanish Agency for Data Protection within a month from the date of
the day following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court,
in accordance with the provisions of article 25 and section 5 of the additional provision
Final fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-
administrative, within a period of two months from the day following the notification
tion of this act, as provided for in article 46.1 of the aforementioned Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the interested party
do states its intention to file a contentious-administrative appeal. If it is-
In this case, the interested party must formally communicate this fact in writing
addressed to the Spanish Agency for Data Protection, presenting it through the Re-
Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or to
through any of the other registers provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also transfer to the Agency the documentation
that proves the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious-administrative appeal
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/6
tive within two months from the day following the notification of this
resolution, would end the precautionary suspension.
938-26102021
Sea Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
