AEPD (Spain) - PS/00004/2020

AEPD - PS/00004/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	10.07.2020
Fine:	900 EUR
Parties:	Auto Desguaces Iglesias, S.L.
National Case Number/Name:	PS/00004/2020
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	Miguel Garrido de Vega

10 July 2020 - The Spanish Data Protection Agency (AEPD) decided to early finish the sanction procedure against Auto Desguaces Iglesias, S.L. (the defendant) for the infringement of the data minimisation principle specified at Article 5(1)(c) GDPR, as the defendant agreed to an early and guilty voluntary payment of the corresponding part (900 €) of the fine suggested by the AEPD (1,500 €).

English Summary

Facts

The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that the defendant had installed a video surveillance system with several video cameras directed to the public space that could be not compliant with the data protection legislation, and that they do not offer the corresponding legal information poster.

Dispute

The defendant answered to the AEPD investigation requests stating that the video surveillance system does offer the corresponding legal information poster in a visible area. The AEPD started the corresponding sanction procedure, and it determined that the video surveillance system obtained disproportionate images from the adjacent public road.

Holding

Without prejudice to the results of the final investigations corresponding to the sanction procedure, the AEPD understood that the defendant could have infringed the data minimisation principle as per Article 5(1)(c) GDPR: on the basis of the available evidences, the defendant has installed a video surveillance system that obtains public space images without a justified reason. Consequently, after considering some aggravating/mitigating circumstances [(i) the defendant is a small family company and it has collaborated with the AEPD, (ii) there is a minor negligence of the defendant, and (iii) there is no justified cause in order to obtain public space images with the surveillance camera], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 1,500 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision takes place by agreeing to a voluntary payment of part of the fine with two possible discounts: (i) acknowledging of its liability (1,200 €) and early voluntary payment (900 €). The defendant agreed to both concepts, so it paid 900 € and the sanction procedure was closed by the AEPD. Finally, the defendant is also required to redirect or relocate the surveillance camera in order to respect third party rights, as well as to include the corresponding information poster.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/9936-031219 Procedure No.: PS / 00004/2020RESOLUTION R / 00264/2020 OF TERMINATION OF THE PAYMENT PROCEDUREVOLUNTARYIn the sanctioning procedure PS / 00004/2020, instructed by the AgencySpanish Data Protection to AUTO DESGUACES IGLESIAS, SL . seen thecomplaint filed by AAA , and based on the following,BACKGROUNDFIRST: On March 11, 2020, the Director of the Spanish Agency forData Protection agreed to initiate sanctioning procedure to AUTO DESGUACESIGLESIAS, SL (hereinafter, the claimed), through the Agreement that is transcribed:<<Procedure Nº: PS / 00004/2020935-240719PENALTY PROCEDURE STARTING AGREEMENTOf the actions carried out by the Spanish Agency for the Protection ofData and based on the followingACTSFIRST: Mr. AAA (hereinafter, the claimant) dated October 21, 2019filed a claim with the Spanish Agency for Data Protection. Theclaim is directed against AUTO DESGUACES IGLESIAS, SL with NIFB37026291 (hereinafter, the claimed). The reasons on which the claim is based arethe following:C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/9"That there are various cameras outside the establishment, including somenas focusing on public roads and customer reception as well, being able tocomply with data protection regulations (...) without being marked in any way… ”- folio nº 1--.Along with the claim, he provides documentary evidence that proves the presence ofthe outer chambers (Annex I).SECOND: In view of the facts denounced in the complaint and the documents-cough provided by the claimant / of the facts and documents of which it has had knowledgeSince this Agency, the General Sub-Directorate for Data Inspection proceeded tothe carrying out of previous investigative actions to clarify thefacts in question, by virtue of the investigative powers granted to the authoritiesof control in article 57.1 of Regulation (EU) 2016/679 (General RegulationData Protection, hereinafter RGPD), and in accordance with the provisions of theTitle VII, Chapter I, Second Section, of Organic Law 3/2018, of December 5,Protection of Personal Data and guarantee of digital rights (hereinafterLOPDGDD).As a result of the investigation actions carried out, it is foundthat the person responsible for the treatment is the one claimed.THIRD: On 11/21/19, the claim is TRANSFERRED to thedenounced entity, receiving answering document dated 12/19/19.FUNDAMENTALS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authori-control, and as established in articles 47 and 48 of the LOPDGDD, the Di-Rector of the Spanish Agency for Data Protection is competent to initiate andto solve this procedure.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/9IIIn the present case, the complaint dated 10/21/19 is examined bygave from which the following is transferred as the main fact:"That there are various cameras outside the establishment, including somenas focusing on public roads and customer reception as well, being able tocomply with data protection regulations (...) without being marked in any way… ”On 12/19/19, a complaint statement from thedenounced party providing a copy of the information poster in a visible area, indicating theresponsible for the treatment.Analyzed the images provided by the recording system, it is foundthat some of them get disproportionately images of the qualityadjoining public highway, exceeding the perimeter framework allowed for this type ofdevices.Individuals cannot obtain images of public space, as this isa competition reserved for the State Security Forces and Corps.It should be borne in mind that in the field of image capture of thethe law establishes a series of limitations. Article 1 of the Organic Law4/1997, of August 4, which regulates the use of video cameras by theState Security Forces and Bodies in public places establishes:"This Law regulates the use by the Security Forces and Bodiescamcorder to record images and sounds in open or closed public placestwo, and their subsequent treatment, in order to help ensure citizen coexistence,the eradication of violence and the peaceful use of roads and public spaces,as well as to prevent the commission of crimes, offenses and infractions related topublic security".C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/9IIIIn accordance with the evidence available in this form,I agree to initiate the sanctioning procedure, and without prejudice to whatAs a result of the instruction, the person claimed is considered to have a camera systemras that obtains images of public space without just cause.The known facts could be a violation, attributable to theclaimed , for violation of art. 5.1 c) RGPD.The art. 83.5 RGPD provides the following: “Violations of the provisionsThe following shall be sanctioned, in accordance with section 2, with administrative fines.maximum of EUR 20 000 000 or, in the case of a company, an amount equal toequivalent to a maximum of 4% of the total annual total turnover for the financial yearprevious financial institution, opting for the largest amount:a) the basic principles for treatment, including conditions forconsent under articles 5, 6, 7 and 9;When motivating the sanction, it is taken into account that it is a smallña family business, as well as prior collaboration with this Agency in the requiredprocedure carried out, apart from the fact that it has not been previously sanctioned by this organizationmo.-Through the same images of attached public space are obtained without cau-sa justified, being able to exercise control of the people and vehicles that transitby the area (art. 83.2 a) RGPD).-It should have been foreseen after the complaint filed, that the camera (s) was wrongoriented, so that the conduct is considered negligent to a slight degree (art. 83.2 b)RGPD).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/9Therefore, it is appropriate to propose a sanction located on the lowest scale for this typeof infractions for the reasons stated, encrypting it in the initial amount of€ 1,500 (One Thousand Five Hundred Euros), minimum penalty for cases such as the above.All this without prejudice to reorient the camera in a matter ofIt is preferably oriented towards its private property or is relocatedthan to fulfill its purpose, but respecting the rights affected.You must also have an informative form (s) adapted to the regulationsis in force, available to the client who may require it.Therefore, in light of the above,By the Director of the Spanish Agency for Data Protection,HE REMEMBERS:FIRST: INITIATE SANCTIONING PROCEDURE to the entity AUTODESGUACES IGLESIAS, SL , with NIF B37026291 , for the alleged violation ofart.5.1 c) RGPD, infraction typified in article 83.5 a) RGPD.TWO: APPOINT instructor to BBB and as secretary to CCC , indi-cando that any of them may be challenged, if applicable, in accordance with the provisions-cited in articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regimeof the Public Sector (LRJSP).THIRD: INCORPORATE into the sanctioning file, for evidentiary purposes, the claim-mation filed by the claimant and its documentation, the documents obtained andgenerated by the General Sub-Directorate for Data Inspection during the in-vestigations, as well as the report of previous Inspection actions.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/9FOURTH: THAT for the purposes provided in art. 64.2 b) of law 39/2015, of October 1,tubre, of the Common Administrative Procedure of Public Administrations, thepenalty that could correspond would be € 1,500 (fifteen hundred euros), without prejudiceof what results from the instruction.FIFTH: NOTIFY this agreement to AUTO DESGUACES IGLESIAS, SL ,with NIF B37026291, granting you a hearing period of ten business days so thatformulate the allegations and present the evidence that you consider appropriate. In hisof claims must provide your NIF and the procedure number that appears inthe heading of this document.If, within the stipulated period, no allegations are made to this initial agreement, theThe same may be considered a proposed resolution, as established in articleass 64.2.f) of Law 39/2015, of October 1, of the Administrative Procedure Co-of the Public Administrations (hereinafter, LPACAP).In accordance with the provisions of article 85 of the LPACAP, in the event ofthat the sanction to be imposed was a fine, you may recognize your responsibility withinof the term granted for the formulation of allegations to this initial agreement; thewhich will entail a reduction of 20% of the sanction to be imposed inthe present procedure. With the application of this reduction, the sanction would remainestablished at € 1,200 (one thousand two hundred euros), resolving the procedure with theimposition of this sanction.In the same way, it may, at any time prior to the resolution of thein this procedure, carry out the voluntary payment of the proposed sanction, whichIt will mean a reduction of 20% of its amount. With the application of this reduction,the sanction would be established at 1,200 euros and its payment will imply the termination of theprocess.The reduction for the voluntary payment of the sanction is cumulative to the one thatIt corresponds to apply for the acknowledgment of responsibility, provided that thisacknowledgment of responsibility becomes apparent within the period grantedto make allegations to the opening of the procedure. The voluntary payment of theamount referred to in the preceding paragraph may be made at any time prior tothe resolution. In this case, if it were appropriate to apply both reductions, the amount of thesanction would be established at 900 euros.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/9In any case, the effectiveness of any of the two mentioned reductionsit will be conditioned to the withdrawal or resignation of any action or resource in processadministrative against the sanction.In the event that you choose to proceed to the voluntary payment of any of theamounts indicated above € 1,200 or € 900 must be paid byyour deposit in the account number ES00 0000 0000 0000 0000 0000 opened in the name of theSpanish Agency for Data Protection at Banco CAIXABANK, SA, indicatingin the concept, the procedure reference number that appears in the headingof this document and the reason for the reduction of the amount to which it is accepted.Likewise, you must send the proof of income to the General Subdirectorate ofInspection to continue the procedure in accordance with the amount enteredsada.The procedure will have a maximum duration of nine months fromthe date of the initiation agreement or, if applicable, the draft initiation agreement. Trans-once this period expires, it will expire and, consequently, the action file willtions; in accordance with the provisions of article 64 of the LOPDGDD.Finally, it is pointed out that in accordance with the provisions of article 112.1 of theLPACAP, there is no administrative appeal against this act.
Mar España Marti
Director of the Spanish Agency for Data Protection
>>SECOND : On June 4, 2020, the requested party has paid thesanction in the amount of 900 euros making use of the two reductions provided forthe Initiation Agreement transcribed above, which implies the recognition of theresponsibility.THIRD : The payment made, within the period granted to make allegations tothe opening of the procedure, implies the renunciation of any action or recourse in processadministrative against the sanction and the recognition of responsibility in relation tothe facts referred to in the Home Agreement.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 8
8/9FUNDAMENTALS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authority ofcontrol, and as established in art. 47 of Organic Law 3/2018, of 5 ofDecember, on Personal Data Protection and guarantee of digital rights (inhereinafter LOPDGDD), the Director of the Spanish Agency for Data Protectionis competent to sanction the infractions that are committed against saidRegulation; infractions of article 48 of Law 9/2014, of May 9, GeneralTelecommunications (hereinafter LGT), in accordance with the provisions of thearticle 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and38.4 d), g) and h) of Law 34/2002, of July 11, on services of the society of theinformation and electronic commerce (hereinafter LSSI), as provided in the article43.1 of said Law.IIArticle 85 of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations (hereinafter, LPACAP), under the heading" Termination in sanctioning procedures " provides the following:"one. Initiated a sanctioning procedure, if the offender acknowledges hisresponsibility, the procedure may be resolved with the imposition of the sanctionthat proceed.2. When the sanction is solely pecuniary or fitsimpose a pecuniary and a non-pecuniary sanction but it has been justifiedthe inadmissibility of the second, the voluntary payment by the alleged responsible, inany time prior to the resolution, will imply the termination of the procedure,except with regard to the replacement of the altered situation or the determination of thecompensation for the damages caused by the commission of the offense.3. In both cases, when the sanction is solely pecuniary in nature,the competent body to resolve the procedure will apply reductions of, toless, 20% on the amount of the proposed sanction, these being cumulativeeach. The aforementioned reductions must be determined in the notification ofinitiation of the procedure and its effectiveness will be conditioned to the withdrawal orwaiver of any administrative action or recourse against the sanction.The reduction percentage provided in this section may be increasedby regulation.According to what was stated,the Director of the Spanish Agency for Data Protection RESOLVES :FIRST: DECLARE the termination of the procedure PS / 00004/2020 , ofin accordance with the provisions of article 85 of the LPACAP.SECOND: NOTIFY this resolution to AUTO DESGUACES IGLESIAS,SLC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 9
9/9In accordance with the provisions of article 50 of the LOPDGDD, thisResolution will be made public once the interested parties have been notified.Against this resolution, which ends the administrative procedure as prescribed bythe art. 114.1.c) of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations, interested parties may file an appealadministrative litigation before the Contentious-administrative Chamber of theNational Court, in accordance with the provisions of article 25 and section 5 ofthe fourth additional provision of Law 29/1998, of July 13, regulating theContentious-Administrative Jurisdiction, within a period of two months fromday after notification of this act, as provided in article 46.1 of thereferred Law.
Mar España Martí
Director of the Spanish Agency for Data Protection