AEPD (Spain) - EXP202209175
From GDPRhub
| AEPD - PS-00624-2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR Article 13 GDPR Article 15 GDPR Article 16 GDPR Article 17 GDPR Article 18 GDPR Article 19 GDPR Article 20 GDPR Article 21 GDPR Article 22 GDPR Article 58(2) GDPR Article 83(5) GDPR Article 22(3) LOPDGDD Article 47 LOPDGDD Article 48(1) LOPDGDD Article 50 LOPDGDD Article 63(2) LOPDGDD Article 64(2) LOPDGDD Article 65(4) LOPDGDD Article 68(1) LOPDGDD Article 74 LOPDGDD |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 29.07.2022 |
| Decided: | 01.09.2023 |
| Published: | 01.09.2023 |
| Fine: | 300 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS-00624-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | isabela_maria_rosal |
Spanish DPA fines controller for providing incomplete information about the use of video cameras. Article 13 of GDPR was breached since the sign had no information about the identity of the controller and how to exercise subjects' rights.
English Summary
Facts
The data subject presented a complaint against the controller alleging that the video cameras installed on private property were also gathering images from a public space. Even though the Spanish DPA held that the public space filmed was not significant, the sign informing data subjects about the video cameras did not comply with data protection rules. The sign did not present enough information about the identity of the controller or about how to exercise the data subjects' rights. For that, the Spanish DPA understood that there was a breach of Article 13 of the GDPR and Article 22 of the LOPDGDD.
Holding
The DPA held that there was a breach of Article 13 of the GDPR since the sign informing citizens about the video surveillance cameras did not present enough information. Even though there was a sign on the private property, it did not mention the identity of the controller nor provided information about how to exercise the data subjects' rights.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/5
File No.: EXP202209175
RESOLUTION OF SANCTIONING PROCEDURE
From the procedure instructed by the Spanish Data Protection Agency and based
to the following
BACKGROUND
FIRST: A.A.A. (hereinafter, the complaining party) dated July 29, 2022
filed a claim with the Spanish Data Protection Agency. The
claim is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the part
claimed). The reasons on which the claim is based are the following:
The complaining party states that the complained party is responsible for a camera
video surveillance that is oriented towards public roads, without authorization
prior administrative for this and without it being properly signposted
through the mandatory video surveillance area information signs.
Provides images of the camera location.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party, to
to proceed with its analysis and inform this Agency within a period of one month, of the
actions carried out to adapt to the requirements provided for in the regulations of
Data Protection.
The transfer, which was carried out in accordance with the rules established in Law 39/2015, of
October 1, of the Common Administrative Procedure of Administrations
Public (hereinafter, LPACAP), was collected on 09/14/2022, as stated in the
acknowledgment of receipt that appears in the file.
On 10/28/2022, this Agency received a written response indicating:
-That the claimed party is responsible for the video surveillance system.
-That the surveillance system is made up of two cameras.
-A photograph of the sign that warns of the existence of the area is attached.
video-surveillance.
-That the maintenance of the system has been contracted with the company ***COMPANY.1.
-That the recording of images is maintained for 7 days.
THIRD: On October 29, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the complaining party was admitted for processing.
FOURTH: On March 16, 2023, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning proceedings against the claimed party,
for the alleged violation of Article 5.1.c) of the RGPD and Article 13 of the RGPD,
typified in Article 83.5 of the RGPD.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/5
FIFTH: The aforementioned initiation agreement has been notified in accordance with the rules established in
Law 39/2015, of October 1, on the Common Administrative Procedure of the
Public Administrations (hereinafter, LPACAP), the claimed party presented a written
of allegations in which, in summary, he stated:
-That the images captured by the “patio 1” camera are part of the property
of the identity without, at any time, affecting the promenade, beach or
include buildings.
In this regard, this Agency points out that, having studied the documents on record
in the file, mainly the images that correspond to the space
captured by the cameras, it is not observed, in fact, that they affect excessively
considered contrary to data protection regulations, to public areas
or adjacent buildings. The alleged allegation is therefore accepted and we proceed to
archive the infringement alleged by article 5.1.c of the RGPD.
-That he does not agree with the imputation of the infraction to the provisions of the
article 13 RGPD since the precise and regulatory information is included, the poster being
provided by the company in charge of maintaining the video surveillance system.
In this regard, this Agency points out that, although in the photo provided with the
response to the transfer, a zone warning sign is indeed observed
video-surveillance, this does not comply with the requirements established in article 22.4
of the LOPDGDD, since neither the identity of the person responsible nor the
possibility of exercising the rights provided for in articles 15 to 22 of the
GDPR
-That, currently, there are no cameras installed on the property as a result of
the works that are being carried out on the property. This point is credited with the
photographs that, as annexes, are attached.
In this regard, this Agency points out that, although currently it is not
observe installed video surveillance cameras, if there were any at the time of
present the claim by the complaining party, for which it is appreciated
breach of the aforementioned article 13 of the RGPD, although, logically, it is not
measures will be imposed in relation to the need to complete the information
provided on the posters, since currently no
data treatment.
SIXTH; On April 26, 2023, a proposed resolution was formulated,
proposing:
That the Director of the Spanish Data Protection Agency sanction
B.B.B., with NIF ***NIF.1, for a violation of Article 13 of the RGPD, typified in the
Article 83.5 of the RGPD, with a fine of €300 (Three hundred euros).
SEVENTH: Postal notification of the proposed resolution was attempted, it has not been
collected at the address of the claimed party, the acknowledgment of receipt being returned with
the result “absent”.
No allegations have been presented to the proposed resolution.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/5
In view of everything that has been done, by the Spanish Data Protection Agency
In this procedure, the following are considered proven facts:
PROVEN FACTS
FIRST: It is proven that, at the time of filing the claim, the
claimed party had video surveillance cameras installed on its property, although
From the images of their field of vision it is clear that they do not capture
images of public roads, at least not in excess that is punishable, according to the regulations
of data protection, nor adjacent buildings.
SECOND: It is proven that, although according to the image provided by the party
claimed, there are signs warning of the existence of video cameras, the information
that they provide is insufficient and does not meet the requirements demanded by the article
22 of the LOPDGDD, as it does not contain either the identity of the person responsible or the
possibility of exercising the rights provided for in articles 15 to 22 of the RGPD.
FOUNDATIONS OF LAW
Yo
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."
II
The installation of a video camera entails the unavoidable obligation to warn of the
sence of it through an informative device, in a sufficiently visible place.
ble, identifying at least the existence of the treatment, the identity of the person responsible, and
the possibility of exercising the rights provided for in articles 15 to 22 of the GDPR.
In the present case, although the claimed party has provided a photograph of a poster
placed next to the cameras, it is observed that it does not comply with all the requirements.
requirements established for this purpose in article 22 of the LOPDGDD, as it is incomplete and
the information provided is sufficient.
Therefore, it is considered that the facts presented violate the provisions of the
Article 13 of the RGPD, which means the commission of an offense classified in the
Article 83.5 of the GDPR, which provides the following:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/5
“Infringements of the following provisions will be sanctioned, according to
with paragraph 2, with administrative fines of EUR 20 000 000 as
maximum or, in the case of a company, an amount equivalent to 4%
maximum of the overall total annual turnover of the financial year
above, opting for the highest amount:
(…)
b) the rights of the interested parties under articles 12 to 22; (…)”.
For the purposes of the limitation period, article 74 “Infringements considered minor” of
The LOPDGDD indicates:
“The remaining infractions of violations are considered minor and will expire after one year.”
purely formal nature of the articles mentioned in sections 4 and
5 of article 83 of Regulation (EU) 2016/679 and, in particular, the following:
a) Failure to comply with the principle of transparency of information or the
right to information of the affected person for not providing all the required information
by articles 13 and 14 of Regulation (EU) 2016/679.
(…)”
III
In light of the facts presented, it is considered that it is appropriate to impute a sanction to
the party claimed for the violation of Article 13 of the GDPR typified in Article
83.5 of the GDPR. The sanction that must be imposed is an administrative fine for
an amount of 300 euros (THREE HUNDRED EUROS)
Therefore, in accordance with the applicable legislation and evaluated the criteria of
graduation of sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: IMPOSE B.B.B., with NIF ***NIF.1, for a violation of Article 13
of the RGPD, typified in Article 83.5 of the RGPD, a fine of 300 euros
(THREE HUNDRED EUROS)
SECOND: NOTIFY this resolution to B.B.B..
THIRD: Warn the sanctioned person that he must make the sanction imposed effective
once this resolution is executive, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by entering it, indicating the NIF of the sanctioned person and the number
of procedure that appears in the heading of this document, in the account
restricted IBAN number: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code:
CAIXESBBXXX), opened on behalf of the Spanish Data Protection Agency in
the banking entity CAIXABANK, S.A.. Otherwise, it will be
collection in executive period.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/5
Once the notification is received and once enforceable, if the enforceable date is
between the 1st and 15th of each month, both inclusive, the deadline to make the payment
voluntary will be until the 20th of the following month or immediately following business month, and if
The payment period is between the 16th and last day of each month, both inclusive.
It will be until the 5th of the second following or immediately following business month.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Data Protection Agency within a period of one month to
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.
Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the
interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.
938-010623
Sea Spain Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
