AEPD (Spain) - PS/00120/2020
From GDPRhub
| AEPD - PS/00120/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 29.10.2020 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | PS/00120/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Sergi Ariño Mayans |
The Spanish DPA (AEPD) imposed a warning to Escuela Infantil (nursery school) for the infringement of Article 13 GDPR.
English Summary
Facts
The decision is the consequence of a complaint filed by a Spanish citizen (the claimant) stating that at her workplace (nursery school) there are cameras inside the rooms recording the children. Their parents/tutors get access to those cameras through an App provided by the School, so they can observe, listen, record and take pictures of the children. The school provides all of the parents/tutors with a password (same password for everyone) and they can watch through this App any of the children inside of the rooms.
According to the claimant, she has never given her consent regarding the recordings and there are not any signs in place warning about the rooms being a video-recorded zone.
Dispute
The work contrat between the nursery school and the claimant states the existence of the cameras but does not specify which is the purpose of the recording, and therefore, of the data processing.
Are the requirements of the Article 13 GDPR satisfied in that case?
Holding
The AEDP held, that the contractual clause in the work contract informing about the existence of cameras does not specify neither the purpose of the processing, nor where are being storaged the images of the claimant. Therefore, the AEPD has imposed a warning to the nursery school, requiring them to add a specific clause in the upcoming work contracts, by which all of the requirements of the Article 13 GDPR are satisfied. Furthermore, the AEPD has also recommended setting up an individual password for each of the parents/tutors.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Procedure No.: PS / 00120/2020938-300320
RESOLUTION OF SANCTIONING PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on the following
ACTS
FIRST: Ms. AAA (* hereinafter, the claimant) dated January 23, 2020filed a claim with the Spanish Agency for Data Protection. Theclaim is directed against BBB (CHILDREN'S SCHOOL *** SCHOOL.1 ) with NIF*** NIF. 1 (hereinafter, the claimed).The reasons on which the claim is based are the following: In the place wherewho works, a nursery school for children from 0 to 3 years old, there are cameras located in theinterior of the classrooms where the children are. The school provides an applicationparents so that they can observe the children, hear them, record them, and takePhotographs. Provides the same password to all parents, so they cansee any child in any classroom.They have not requested your consent to carry out such recordings,considered the measure that violates their right to privacy; and there are no postersinformation about the installation of cameras.He sent a burofax to the College stating that he considered that, with theaudio and video recordings in the classrooms and in the places where the tutorials take placewith the parents, without their consent, their privacy was violated. Adding that asall parents use the same passwords can see any child and anyprofessor.Along with the claim, it provides documentary evidence (photographs) that prove thepresence of camera (s) inside the classrooms.SECOND: In view of the facts denounced in the claim and the documentsprovided by the claimant, the General Subdirectorate for Inspection of Datayielded to carrying out preliminary investigation actions to clarifyof the facts in question, by virtue of the powers of investigation granted to thecontrol authorities in article 57.1 of Regulation (EU) 2016/679 (RegulationGeneral Data Protection, hereinafter RGPD), and in accordance with the provisions ofcido in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5December, Protection of Personal Data and guarantee of digital rights (inhereinafter LOPDGDD).As a result of the investigation actions carried out, it is verifiedthat the person responsible for the treatment is the one claimed.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/11THIRD: On 02/20/20, TRANSFER was given to the denounced entity of theclaim presented, stating the following in relation to the facts:In the center that is the subject of the complaint, the rules of social responsibility apply.corporate communication and transparency, through which the company makes known to theBe sure how you act, developing the activity honestly. This is essentialfor the sustainability of your company. These are also concepts that serve asguarantee for long-term success. The way of transparency is communication,what must be strengthened the communication system of the company, both internallyas external. A company like yours must maintain a positive image and manageBuild trust among your customers.The purpose of camera installation is primarily educational, asallows observing the evolution and development of classes and how children respond tolearning.The Legal Office of the Spanish Data Protection Agency has alreadyreported in this regard in its report 0274/2009 and in the Video Surveillance Guide dedicates asection to video surveillance in "school environments and minors". Its center complies withall the requirements to guarantee the privacy and intimacy of minors ”.It accompanies the record of activities and the information clause referring to the treatmentdata storage from cameras. It indicates that the purpose of the recordingsit is educational and business transparency; in no case are images captured fordirect or indiscriminate control of workers. There are no audiovisual systemscontrol points in places of rest or recreation, such as changing rooms,toilets, dining rooms and the like.Regarding the moment of information to the workers of the installation ofcameras, indicates that it is done at the beginning of the employment relationship, in the act of signing thecontract with the company you are informed of the center's operating standards andThey give their consent by signing their contract.The consent for the data processing of minors always requires theparental / maternal authorization as developed by RGPD. Parents can accessimages, prior express authorization for this purpose. Being all of them awarethat the center is equipped with cameras and authorizing that the image of your child ordaughter is captured by said cameras.FOURTH. On June 16, 2020, the Director of the Spanish Agency forData Protection agreed to initiate a sanctioning procedure to the claimed, by thealleged violation of Article 5.1.c), 5.1 f) and 13 of the RGPD, typified in Article83.5 of the RGPD.FIFTH. On 07/29/20, a Proposal for Resolution was issued in which it was agreedSEE the entity denounced for the accredited violation of article 13 RGPD.SIXTH. Consulted the database of this Agency on 10/13/20 there is no evidenceany allegation of the denounced entity— Escuela Infantil *** ESCUELA.1 -, norcorrective measure has been proven to have been adopted in this regard.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/11In view of all the actions, by the Spanish Agency for Data ProtectionIn this proceeding, the following are considered proven facts,First. On 01/23/20, a letter from the complainant is received in this AEPDby means of which it transfers the following:“… There are cameras located inside the classrooms where thechildren. They have not requested your consent to carry out such recordings,considered the measure that violates their right to privacy; and there are no postersinformation on the installation of cameras ” (folio nº 1).Second. It is identified as the main responsible BBB (SCHOOLCHILDREN *** SCHOOL . 1).Third. A copy of the employment contract is provided, although blurred in some of theits clauses, not including the date of signature, where the complainant is informedin the following terms:“Each classroom is equipped with a webcam to which the parents ofthe children of the group and the management of the Center. The cameras are orientedform that they only collect the image of the area where the children develop theireducational activities, at no time is observed through the same areaschange and toilet "Fourth. It is proven that there is an informative poster where it indicatesthat it is a video-monitored area, with indication of the person responsible for the treatment(Attached File No. 1-8 cameras), although it is not possible to determine if they weretwo initially at the time of the Complaint.Fifth. The camera system has a timer, being disconnectedtadas outside school hours, at 15:30, taking place the development of tutorialsoutside of those hours, so it is not possible to record them.Evidence No. 3 is provided that corroborates the installation of the timer inthe cabling of the cameras.Sixth. There is no evidence that informed consent has been obtainedof the parents (guardians) of the Center, as the complainant did not provide the documentsnecessary for this purpose.Seventh. Parents (guardians) are informed by the Center through astandard form with some access codes- Username and Password — indicating thatcan access the classroom of their children as well as not transfer the keys to ter-ceos outside the family nucleus, although it does not provide a detailed explanation of theoperation (use) of the same.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/11FOUNDATIONS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authoritycontrol, and according to what is established in articles 47 and 48 of the LOPDGDD, therector of the Spanish Data Protection Agency is competent to initiate andto solve this procedure.IIIn the case of recordings in nurseries or early childhood education centers, you mustIt should be noted that the general principles of the regulations relating to theprocessing of personal data, being relevant:- The consent for the treatment of data of minors is foundregulated in article 8 of the RGPD and requires parental, maternal or partner authorization.legal representative in the case of minors.-The purpose for capturing such images must be precisely defined,that in any case it will respect the principle of proportionality and adequacy, and in particularlar additional uses for promotional or marketing purposes, school reportsactivity, or public websites of the center.- In relation to the proportionality of the capture of the images, it is necessary toconsider that children who attend schools / nurseries, with ages between 0 and 3years, they carry out many activities in the classroom (they eat, play, take naps…);There is a difference with older children who attend schools that perform eachactivity in differentiated areas: classrooms, patios and dining rooms.-They must be adequately informed and respect the rights of the workers-affected by the use of camcorders as monitors, teachers,cleaning etc.-Security and secrecy must be guaranteed, particularly when accessimages are produced online.And in those cases in which access to a group is provided, such as that of alltwo parents in a classroom:-The access profiles must be defined, which, for example, should be limited tothe environments in which your children are, never to other classrooms.-The parents must be informed of their responsibilitiesfor access to data. "The RGPD establishes a series of guidelines, which seek to achieve greaterproactivity on the part of those responsible for data processing.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/11Along with the registration of treatment activities, it is necessary to carry out abrief reflection. The level of risk that the data processing per-sonal (in this case, the capture or recording of images of natural persons), im-plican for those affected (parents, students and teachers).It is recommended that the result of the risk analysis be in writing.IIIIn the present case, we proceed to examine the claim dated 01/23/20 by means ofgave from which the following is briefly transferred as the main fact:“… There are cameras located inside the classrooms where thechildren. They have not requested your consent to carry out such recordings,considering the measure threatening their right to privacy; and there is noinformative posters of the installation of cameras ” (folio nº 1).The facts are therefore specified in the presence of a device (s) in thethe interior of the classroom where the complainant teaches, without, according tohas informed about the use of the images, nor has it been requested by theconsent, affecting your personal intimacy and privacy (folio nº 1).As a first question, it is necessary to analyze "the absence of an informative poster" toIn this regard, it should be noted that the denounced entity provides documentary evidence thatcertifies the presence of informational poster (s) inside the classroom (s), indicating thatIt is a video-monitored area, so it complies with the provisions of theArticle 22.4 LOPDGDD (LO 3/2018, December 5).The presence of video surveillance cameras is not something alien today,There are cameras in shopping centers, in small establishments or in Centerseducational, obeying in principle the presence of the same to a purpose offacility security.However, this type of device is fulfilling in Centers for minorsor nurseries, a different purpose such as to facilitate the possibility for parents (guardians)to share the child's adaptation to their new school environment, allowing them to beparticipate in this first contact with the educational system.This, however, may entail a certain collision with the rights of theemployees, who feel subject to permanent observation, including in theirteaching work, other fundamental rights come into play (art. 18 CE), with thelogical concern of the fear of being the object of recording, as well as the fate that inyour case will be given to them.This is related to the second question reported, relating to the lack ofinformation on the purpose of the treatment of the images (data) that where appropriateare obtained.A copy of the contract signed by the complainant is provided by the denounced party.you, where you are informed in one of the clauses "Attitude of staff towards work"C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/11of the presence of the cameras (Evidentiary Document No. 1), although it does not indicate (reports)clearly what is the purpose of the treatment.Article 28 Law 39/2015 (October 1) provides the following : “Interested parties arethey will be responsible for the veracity of the documents they present ”, so thisThe body considers a priori valid the contract provided by the denounced party.Article 5 paragraph 1 letter b) RGPD provides that personal data will be“They are chosen for specific, explicit and legitimate purposes , and will not be processed further.riormente in a manner incompatible with said purposes; in accordance with article 89,Section 1 (Scientific Research, Statistics), the further processing of datapersonal data for archival purposes in the public interest, scientific research andhistorical or statistical purposes shall not be considered incompatible with the initial purposes ("li-purpose mitigation ').The RGPD obliges data controllers to offer interested parties amore information on the treatments carried out and how to exercise the rightschos. All those responsible must comply with this obligation of transparency,regardless of its size as an organization.Article 13 GDPR establishes an exhaustive list of the information that must bebe provided to interested parties (* broader than was determined by the now extinct LOPD15/99) based on the data obtained from the interested party.In the case of data obtained from the interested party , the following information will be providedtion at the time the data is requested:1. identity and contact details of the person in charge and, where appropriate, of their representativestea2. contact details of the delegate, if applicable,3. purposes of the treatment4. legal basis of the treatment5. The legitimate interest pursued by the person in charge or a third party, when theYour claim is based on that legitimate interest.6. the recipients or categories of recipients of data (assignments)7. the intention to carry out international transfers of the data to third partiescountries and the existence of an adequacy decision or adequate guarantees andthe means to obtain a copy of these8. the period of conservation of the data or the criteria used to determinethe term9. the need to provide the data and the consequences of not providing it if it isdata communication is a legal or contractual requirement or a necessary requirementto sign a contract10. the existence of automated decisions, including profiling(in such cases, significant information about the applied logic, as well as theimportance and expected consequences of such processing for the interest ofsado)11. the possibility of exercising the rights of the interested party, the rightto withdraw consent as well as the right to file a claimC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/1112. in the event of further processing for a different purpose, you must first entertrain you on that other purpose with the relevant additional information.If the clause of the contract provided in it is read, theembodies the following:“Each classroom is equipped with a webcam to which the parents ofthe children of the group and the management of the Center. The cameras are orientedform that they only collect the image of the area where the children develop theireducational activities, at no time is observed through the same areaschange and toilet "Therefore, the provided contract clause does not determine what they will be treated for.two data, where the images obtained from the employee of theCenter.The obligation to inform must be fulfilled without the need for an al-guno, and the person in charge must be able to prove later that he has fulfilledcha obligation.So that any employee of the Center, whose personal data istreaties, must be able to know the purposes of their treatment, in a waythat is understandable to him, the set of rights that he may exercise (art.15-22 RGPD) or the conservation criteria thereof as an example.The employer (entrepreneur) can install video surveillance cameras limit-based on the purposes set forth in the Workers' Statute since it attributesto the entrepreneur the power of management, which allows him to "adopt the measuresmost opportune surveillance and control measures to verify compliance by thejador of their obligations and labor duties ”.The employer must strictly respect the principle of proportionality , it isthat is, video surveillance cameras will be installed when there are no other measuresmore suitable, they will only record essential spaces to satisfy the finallabor control and will not be used for purposes other than those of the control itselflabor.In this case, we are dealing with the installation of a webcam in the classroom of thecomplainant, it does not obey a labor control purpose, but rather an objective of theThe “educational” policy of the Center, consisting of facilitating access to school activitiesres of minors in it, facilitating remote access by their parents(tutors) through a concerted password system.The issue of privacy (art. 18 CE) reported by the partycomplainant, it is not a matter that should be analyzed in depth by thisAgency, whose competence framework is limited to the issue of information due in the workdata processing thereof.The Constitutional Court, in its Sentence 292/2000, of November 30,2000 (BOE of January 4, 2001), has come to define the right to the protection ofC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 8
8/11data such as that which every citizen has to freely dispose of their personal datasonal rights, detaching it from the right to privacy and configuring it as a rightindependent fundamental (legal bases 6 and 7).This fundamental right to data protection, unlike the right tothe privacy of art. 18.1 CE, with whom it shares the objective of offering an effectiveconstitutional protection of personal and family private life, attributes to its holder a beamof faculties that consists for the most part in the legal power to imposethe performance or omission of certain behaviors whose specific regulationtion must establish the Law, that according to art. 18.4 CE should limit the useof computing, while developing the fundamental right to data protection(art. 81.1 CE), or regulating its exercise (art. 53.1 CE).The educational centers, in their task of making effective the fundamental right toeducation that constitutes their reason for being, they must also observe the fundamental rightfundamental to the protection of personal data which, by not constituting its activitymain activity, sometimes generates doubts about the interpretation and application of itsregulation.The possibility of dealing with the image of the denounced would be legitimized bycomplete information that could be provided in the signed contract, given that youreducational work is carried out in a classroom where external monitoring bythe parents (tutors) of their students, as indicated in the signed contract freely-mind for the same.The denounced "privacy" is not affected, since the camera(s) does not obtain images of sensitive spaces, limiting the capture to the area ofclassroom, being the same aware of the presence of these.Do not forget that in the workplace art. 20.3 ET empowers the employerto adopt “the most appropriate surveillance and control measures to verifycheck the compliance by the operator of his obligations and labor duties, keeping-in its adoption and application, the consideration due to their dignity andif applicable, the real capacity of workers with disabilities is taken into account ”.The foregoing, however, does not prevent greater precision in relation to thetraining to be provided in relation to the purpose (s) of data processingcough of the complainant, as explained above.With the entry into force of the new RGPD, the informative clause does not conform tothe greatest protection that is pursued in the right to information, this must be"Precise, concise, transparent" with a clear and simple language.Thus, the infringement of article 13 RGPD is considered proven, whennot include in the contract provided the purpose (s) to which the obtaining of images will be dedicated.n in the classrooms where the complainant carries out her activity.IVC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 9
9/11In relation to the imputation of breach of article 5.1 c) RGPD, for alleged"Data processing" consisting of the recording of conversations, it should be notedthat the installed devices are disconnected at 15:30 (end time of theschool hours), being tutorials with parents developed outside of said hours,so the conversations are not subject to recording in any way.Documentary evidence is provided by the denounced that allows verifying thesence of the timer that allows the disconnection of the video equipment, corroboratingthe allegations made.Therefore, it is proven that the infraction described has not been committed, asbe subject to recording the conversations with the parents (guardians) of thestudents, when the system is programmed to disconnect.VFinally, the alleged commission of an infraction of art.5.1 c) RGPD considering that parents could have access to third party data(other students), lacking information on responsibilities in dealing withstorage of personal data.The keys provided only allow access to the specific classroom where your children(as) develop the corresponding educational workshops, in such a way that it is not possible toaccess to other classrooms than those authorized.It is attached as documentary evidence (Doc. No. 4) where the following is noted.next:"Please use these keys responsibly, making use of thempersonal way and not transferring them to any person outside his family "“Please do not disseminate these photos on social networks, or publish them in anysome public access site "Therefore, it is considered that the “recommendations” put forward are sufficient.to prevent unauthorized dissemination of the data of minors, havingautomated passwords that allow exclusive access to the classrooms where they developtheir training workshops call their respective offspring.SAWIn accordance with the evidence available in these proceedings,sanctioning penalty, it is considered that the defendant has not fully proventhat the owner of the data be informed about the purpose (s) in the treatment of their datacoughs of a personal nature.The known facts are constitutive of an administrative infraction, imputedtable to the defendant , for violation of the content of article 13 RGPD, previous-mind transcribed.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 10
10/11Article 83.5 RGPD provides the following: “Violations of the provisionssubsequent events will be sanctioned, in accordance with section 2, with administrative finesup to EUR 20,000,000 or, in the case of a company, of an amountequivalent to a maximum of 4% of the total annual global business volume for the yearprevious financial cio, opting for the one with the highest amount:b) the rights of the interested parties in accordance with articles 12 to 22;Without prejudice to the provisions of article 83 of the RGPD, the aforementioned Regulationprovides in its art. 58.2 b) the possibility of sanctioning with warning, in relation towith what is stated in Recital 148:"In the event of a minor offense, or if the fine likely to be imposedwould constitute a disproportionate burden on a natural person, rather thantion through a fine may be imposed a warning. It must nevertheless be paidspecial attention to the nature, severity and duration of the offense, its characterintentional, to the measures taken to alleviate the damages suffered, to the degreeliability or any prior relevant infringement, to the way in which the au-control authority has had knowledge of the infringement, compliance withorders ordered against the person in charge or in charge, to adherence to codes ofduct and any other aggravating or mitigating circumstance. "In the present case, the complexity of the matter that weoccupies, as well as the absence of previous infractions and active collaboration with thisAgency, to propose a warning sanction, imposing correct measures-to those responsible for the Center in question.VIIIn accordance with the foregoing, the contract provided is not clear in terms of the informationtion of the purpose of processing the data of the complainant.For all this, it is proposed to comply with current legislation, the following requirementcertification, accrediting it as soon as possible before this body:-A specific data protection clause must be included in the counter-labor agreements that he / she signs with the employees of the Center, infor-expressly command of the data controller, purpose, rights in the frameworkof the GDPR, etc.It is recommended that the information concerning minors be publishedin private spaces of the center (eg Intranet of the Center), which is accessed throughIdentification and individualized password for each parent, avoiding to the extentIf possible, shared passwords that allow access by unauthorized third parties.two to the data of minors.Finally, it is recalled that not meeting the requirements of this body,it can be considered as a very serious offense in accordance with the provisions of art. 72letter o) LOPDGDD “The resistance or obstruction of the exercise of the inspection functionC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 11
11/11by the competent data protection authority ”, which is made known to youfor the appropriate legal purposes.Therefore, in accordance with the applicable legislation and the criteria ofgraduation of sanctions whose existence has been proven,the Director of the Spanish Agency for Data Protection RESOLVES :FIRST: IMPOSE Doña BBB (SCHOOL INFANTIL *** SCHOOL ), with NIF*** NIF. 1 , for a violation of Article 13 of the RGPD, typified in Article 83.5 of theRGPD, a penalty of Admonition .SECOND: NOTIFY this resolution to Doña BBB (SCHOOL INFANTIL*** SCHOOL. 1 ) and REPORT the result of the actions to the complainant DoñaAAAIn accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once it has been notified to the interested parties.Against this resolution, which ends the administrative procedure in accordance with art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPA-CAP, the interested parties may file, optionally, an appeal for reconsideration beforethe Director of the Spanish Data Protection Agency within one month tocount from the day after notification of this resolution or directly appealcontentious administrative procedure before the Contentious-Administrative Chamber of theNational authority, in accordance with the provisions of article 25 and section 5 of theFourth additional provision of Law 29/1998, of July 13, regulating the Juris-Contentious-administrative diction, within a period of two months from the day if-following notification of this act, as provided in article 46.1 of the aforementionedLaw.Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPA-CAP, the final administrative resolution may be suspended provisionally if theinterested party expresses his intention to file contentious-administrative appeal.If this is the case, the interested party must formally communicate this fact throughletter addressed to the Spanish Agency for Data Protection, presenting it throughof the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web /], or through any of the other records provided for in art. 16.4 of the ci-Tada Law 39/2015, of October 1. You must also send the Agency the documentationtion that proves the effective filing of the contentious-administrative appeal. Yesthe Agency was not aware of the filing of the contentious-administrative appealnistrative within a period of two months from the day following the notification of theThis resolution would terminate the precautionary suspension.Mar Spain MartíDirector of the Spanish Agency for Data Protection
