AEPD (Spain) - 00027-2022
From GDPRhub
| AEPD - 00027-2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 24(2) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 07.09.2022 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 00027-2022 |
| European Case Law Identifier: | PS |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | patrikmatos |
The Spanish DPA denied a complaint about the surveillance camera pointing to a sidewalk in front of a private parking lot, as it was considered an essential surface to protect people and property, not being demonstrated the processing of any personal data.
English Summary
Facts
A gas station owner has installed a video surveillance camera over the door of his cousin's house, the data subject, who alleges that there is no good relationship between them and that the defendant is using the means he has as a businessman to coerce the claimant to keep the entrance to his house under control and surveillance. The camera is 1.2km from the gas station, has a range of 60 meters and is installed in the upstairs apartment, which does not belong to the controller, but to his relatives. The complaint has been denied because it was proven that the camera was directed only towards the access door to the garage. Although it affects the sidewalk, the dimensions are limited to a scope that is considered essential to preserve the persons and property that are in the purpose for which the camera is installed. In addition, the Spanish DPA resolution considered that there were several informative signs, indicating not only that it was a video-monitored area, but also the person responsible for the treatment. Moreover, there was no evidence of any data processing of the data subject, nor was there any control of the access to the house, so that the resolution indicated that the presumption of innocence must prevail in this case.
Holding
The Spanish DPA considered that the controller has not exercised a control of the entrances and exits of the property, nor has it processed the personal data of the data subject and/or third parties in violation of the content of art. 5 (1) GDPR, which provides that personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. According to the AEPD, since the camera only reached a sidewalk of limited dimensions and containing informative signs, there was no violation of art. 22 (2) of the Spanish local law (LOPDGDD), according to which images of the public road can only be captured to the extent that it is essential for the purpose of preserving people and property. In other words, the Spanish DPA considered that the use of the cameras occurred on a regular basis in this case and did not extrapolate the principle of data minimization, so the presumption of innocence must be applied to the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
RESOLUTION OF SANCTIONING PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: A.A.A. (*hereinafter, the complaining party) on March 16, 2021 filed a claim with the Spanish Agency for Data Protection. The claim is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the claimed party). The reasons on which the claim is based are the following, as stated in the claim: “The claimant is the owner of a gas station in which video surveillance cameras are installed. Taking advantage of this circumstance, he has installed one over the door of my house, located in Calle ***ADDRESS.1, that is, very far from ***ADDRESS.2 where the gas station is. The person in question is my cousin, who for reasons that are not relevant to expose, does not have a good personal relationship with me, and is making use of the means that he has due to his status as a businessman to coerce me and keep the entrance of my house controlled and monitored, when this is far from the purpose that the installation of cameras in your business should pursue, which, as I have explained, is quite far from my house. I understand that you are not entitled to install them, since the data protection regulations do not allow you to monitor beyond what your business reaches, and you have done so from 1.2 km away. This fact was reported to the Civil Guard on February 27, 2020. The camera installed is a DOME MODEL with a range of 60 meters, therefore it is not understood what it is doing 1.2 km from your business. It is installed from the window on the top floor and facing the two entrances of my house as can be seen in the attached photos. It should be noted that the upper floor is not owned by him, but by his direct relatives. It is not acceptable that personal differences or the bad relationship that may exist between us allow you to submit to this surveillance. It must also be taken into account that it watches over everyone who approaches our house. We request protection so that you uninstall them and stop knowing all our movements.
We provide photos from 03.11.21, which show that this conduct has not been interrupted despite its lack of legitimacy. We request protection from this body”. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), said claim was transferred to the claimed party on date 04/06/21, 04/27/21 and 05/21/21, to proceed with its analysis and inform this Agency within a month of the actions carried out to adapt to the requirements set forth in the data protection regulations.
THIRD: This Agency ex officio proceeds to verify that the Initiation Agreement of the initial procedure PS/00350/2021 was not legally notified to the claimed party, proceeding to revoke the Resolution of the Director of this Agency dated 11/15/21 by act dated 01/18/22. REVOKE the resolution issued on November 15, 2021 by which Mr. B.B.B. as the notification of the initiation agreement has not been made. FOURTH: On February 9, 2022, the Director of the Spanish Agency for Data Protection agreed to initiate disciplinary proceedings against the claimed party, for the alleged violation of Article 5.1.c) of the GDPR, typified in Article 83.5 of the GDPR. FIFTH: On 03/21/22, collaboration was requested from the local Security Forces and Corps, receiving a Report from the Civil Guard Command (04/13/22) in which the following is stated: - That there is a single video-surveillance camera in the house, which is located on its façade (photographs 1 and 2), providing the person responsible for the installation with a screen print of what is captured with it.
-That in relation to the facts that are the object of the complaint IF there are conflicts between the parties, facts which have been denounced in the Civil Guard Command of Lerín. -That a photographic report is made in which the facts indicated above are detailed. SIXTH: On 05/23/22, the "Resolution Proposal" was issued in which it was agreed to propose the File of the procedure as the commission of any administrative infraction in the matter at hand was not accredited. In view of all the proceedings, the following are considered proven facts by the Spanish Data Protection Agency in this proceeding: PROVEN FACTS First. The facts bring cause of the claim presented in this Agency by
the following reasons: "presence of video surveillance cameras in the family home" by
close friend of the claimant, who states “he could be recording the public thoroughfare”, as well as access to the family-owned home (folio no. 1). Second. He is identified as the main person responsible for the B.B.B. with DNI ***NIF.1. Third. There is evidence of the presence of a single camera on the façade of the property oriented downwards towards the access door to the Garage, in the case of
of a sidewalk of limited dimensions. Fourth. There is evidence of the presence of several informative posters in a visible area informing that it is a "video-surveilled area" with an indication of the person responsible for the treatment. Fifth. There is no evidence that the claimant's data is being processed, nor is there any control of access to the home, nor is the rights of third parties affected. FUNDAMENTALS OF LAW
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), grants to each control authority and as established in articles 47, 48.1 , 64.2 and 68.1 of Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Agency for Information Technology is competent to initiate and resolve this procedure. Data Protection. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Agency for Data Protection will be governed by the provisions of Regulation (EU) 2016/679, in this organic law, by the provisions of the comments dictated in its development and, as long as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures.”
II In the present case, we proceed to examine the initial claim dated 03/16/21 through which the following facts are transferred: "presence of video surveillance cameras in the family home" that "could be recording the road public”, as well as access to family-owned housing. Apart from other implications in her criminal case, the facts are caused by the installation of a system of video surveillance cameras in a family home that the claimant temporarily has the usufruct. The installation of video surveillance cameras in the street corresponds solely and exclusively to the State Security Forces and Bodies in the fulfillment of security functions.
The facts denounced could affect the content of art. 5.1 c) GDPR (regulations currently in force) that provides: "personal data will be: c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization") (...)" . Individuals are responsible for ensuring that the installed video surveillance systems comply with current legislation, and must be in a position to certify such extremes before the competent Authority.
The cameras installed by individuals must be oriented towards their private space, avoiding the capture of the private area of third parties without just cause. In no case will the use of surveillance practices be allowed beyond the environment that is the object of the installation and, in particular, not being able to affect the surrounding public spaces, adjoining buildings and vehicles other than those that access the monitored space. A certain amount of “caution” must be exercised when installing this type of device, weighing its usefulness in the absence of a less harmful means, given its affectation of the right (image) of third parties through their treatment. Likewise, in the case of false cameras, they must be oriented towards a private area, avoiding intimidation of neighboring neighbors who are unaware whether or not they process personal data. III In accordance with the "evidence" available in this disciplinary proceeding, it is considered that the claimed party has proceeded to install a system
of video-surveillance cameras, made up of a single camera that captures a minimal portion of the sidewalk from the building's façade, coinciding with the access to the house's garage. The installed system has an informative sign(s) indicating that it is a video-surveilled area, informing of the person responsible for the treatment and the way to exercise the rights within the framework of the regulations in force. It has not been verified that a control is being exercised over the entrances/exits of the property that affect the rights of the complaining party and/or third parties, nor that a "processing of their data" is taking place outside the permitted assumptions. It should be specified that the analysis of the claims in the matter at hand must be carried out according to the context of the specific case, the presence of the device to avoid graffiti on the access door to the garage not being disproportionate. Article 22, section 2 of the LOPDGDD (LO 3/2018, December 5) states "Images of public roads may only be captured to the extent that it is essential for the purpose mentioned in the previous section." Therefore, sometimes a capture of a minimum essential public space is allowed for the protection of people or property, as is the case of this analysis due, among other reasons, to the scarce portion of public sidewalk that borders the access to the parking garage. the House. It is recalled that with this type of device it is not possible to control the entrances/exits of the property, as it can be considered a means of coercion of
the freedom of its inhabitants, who can be intimidated by this type of devices, being a reproachful conduct in other fields of law. The presumption of innocence governs without exception in the sanctioning system and must be respected in the imposition of any sanction, whether criminal or administrative (TCo 13/1981), since the exercise of the sanctioning right in any of its manifestations is conditioned to the game of proof and a contradictory procedure in which one's own positions can be defended. Pursuant to this principle, no sanction can be imposed based on the guilt of the accused if there is no probative activity, which in the
appreciation of the authorities or bodies called to resolve, destroy this presumption (TCo Auto 3-12-81).
IV In accordance with the foregoing, it can be concluded that excessive control of the public area that affects neighbors close to the property in question has not been proven, considering that the installation of the camera is proportionate to the purpose pursued and that it is duly informed, reason that justifies the filing of this procedure. Lastly, the parties are reminded of the importance of the rights at stake, in order to avoid using this body as an instrument for issues outside the scope of the data protection or that may well be resolved in the appropriate judicial instances due to an alleged affectation of the right to privacy of the claimant or any other litigious issue between them. The Director of the Spanish Agency for Data Protection RESOLVES: FIRST: TO ORDER the FILE of this procedure as no administrative infraction in the matter at hand is proven. SECOND: NOTIFY this resolution to the claimed party B.B.B. and inform the claimant of the outcome of the proceedings. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once the interested parties have been notified. Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, interested parties may optionally file an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of one month from since the day following the notification of this resolution or a direct contentious-administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of the Law 29/1998, of July 13, regulating the Contentious Administrative Jurisdiction, within a period of two months from the day following the notification of this act, as provided for in article 46.1 of the aforementioned Law.
