AEPD (Spain) - PS/00273/2019

AEPD - PS/00273/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 12 GDPR Article 13 GDPR Article 30(1) GDPR Article 58(2) GDPR Article 83(2) GDPR Article 83(5) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	2000 EUR
Parties:	COMUNIDAD DE PROPIETARIOS DEMELZA BEACH AAA
National Case Number/Name:	PS/00273/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	Agencia Española de Protección de Datos (in ES)
Initial Contributor:	Silvia López Arnao

Spanish DPA (AEPD) holds that the installation of video surveillance systems that capture images of common areas of the neighborhood violates Article 5 of the GDPR (data minimization).

English Summary

Facts

A neighbor had placed cameras in his door directed to common areas, stairs and corridors, recording all of the rest of the neighbors who passed by

Dispute

Does the installation of surveillance systems that capture images of common areas of the neighborhood respect the principle of data minimization under the GDPR?

Holding

The DPA held that the installation of this type of system must be oriented preferably towards the access points to be protected and should not be oriented towards common or transit areas of the other neighbors, and it must also have the corresponding information sign, indicating that it is a video-surveillance area.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

DECISION ON DISCIPLINARY PROCEEDINGS
From the procedure instructed by the Spanish Data Protection Agency and
on the basis of the following
FACTS
FIRST: DEMELZA BEACH OWNERS COMMUNITY (hereinafter referred to as the
The complainant) filed a complaint with the Agency on 9 April 2019
Spanish Data Protection. The claim is directed against A.A.A. with NIF
***NIF.1 (hereinafter referred to as the Respondent).
The grounds for the complaint and, where appropriate, the documents provided
by the claimant are as follows:
"Place cameras on facade aimed at common areas, stairs and corridors,
recording all the communal farmers who pass by" (sheet no. 1).
SECOND: In view of the facts denounced in the complaint and the documents provided by the claimant, the General Sub-directorate of Data Inspection proceeded to carry out previous investigative actions for the clarification
of the facts in question, under the powers of investigation granted to the
supervisory authorities in Article 57(1) of Regulation (EU) 2016/679 (Regulation
Protection, hereinafter referred to as the RGPD), and in accordance with the provisions of Title VII, Chapter I, Section 2, of Organic Law 3/2018 of 5 December 1978 on the
December, Protection of Personal Data and Guarantee of Digital Rights (in
hereinafter LOPDGDD).
As a result of the investigative actions carried out, it is noted
that the person responsible for the processing is the one who is being claimed.
THIRD: On 17 December 2019, the Director of the Spanish
of Data Protection agreed to initiate sanctioning proceedings against the respondent, by the
alleged violation of Article 5.1(c) of the GPRS, as defined in Article 83.5 of the
RGPD.
In view of all that has been done, by the Spanish Data Protection Agency
The following are considered to be proven facts in these proceedings,
PROVEN FACTS
First, on 09/04/19, this agency received a complaint from the Community
of owners-Demelza Beach-which is made concrete by the following facts:
"Place cameras on facade directed to common areas, stairs and corridors,
recording all the communal farmers who pass by" (sheet no. 1).
Second. It is identified as the main responsible the neighbor of the same
A.A.A.
Third. The installation of a video-surveillance system is accredited
into common areas without just cause.
Fourth. It is noted that the information poster does not indicate the responsible party to whom
exercise, where appropriate, the rights recognised in Articles 15 to 22 of the GPR.
LEGAL GROUNDS
I
By virtue of the powers that Article 58.2 of the RGPD grants to each supervisory authority, and in accordance with the provisions of Articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and
to resolve this procedure.
II
In the present case, the complaint dated 09/04/19 is examined, by means of which the following is transferred as the main event:
"Placing cameras on the facade aimed at common areas, stairs and corridors,
recording all the communal farmers who pass by" (sheet no. 1).
The physical image of a person, according to article 4.1 of the RGPD, is a piece of information
personal and their protection, is therefore the subject of the said Regulation. In Article 4(2)
of the RGPD defines the concept of "processing" of personal data.
It is therefore relevant to analyse whether the processing of personal data (image
of individuals) carried out through the reported video surveillance system is in accordance with the provisions of the RGPD.
Cameras installed by private individuals cannot be directed at a
third parties, obtaining images/sound from third party conversations, by
affect your privacy, regardless of the fact that there are less invasive protection measures
of the property, if necessary.
The described facts suppose an affectation to the article 5.1 c) RGPD "The personal data will be:
c) adequate, relevant and limited to what is necessary in relation to the purposes
for those who are treated ("data minimization").
Individuals who install this type of device are responsible for
It must comply with current legislation and must also meet the requirements established in the Horizontal Property Law (LPH).
III
In accordance with the above, the processing of images through a video surveillance system, in order to comply with the regulations in force, must comply with the
following requirements:
- Respect the principle of proportionality.
- When the system is connected to an alarm centre, it may only
be installed by a private security company that meets the requirements set out in Article 5 of Law 5/2014 on Private Security of 4 April.
- The video cameras may not capture images of people outside the private space where the video surveillance system is installed, as image processing can only be carried out in public places,
unless authorized by the government, by the Security Forces and Corps.
Nor may spaces owned by third parties be captured or recorded without the consent of the owners or, where appropriate, of the people who are in them.
This rule admits some exceptions since, on some occasions, for the protection of private spaces, where cameras have been installed on facades or in the
may be necessary to ensure the security purpose of recording
a portion of the public road. In other words, cameras and camcorders installed for security purposes may not obtain images of the public highway unless it is essential for that purpose, or it is impossible to avoid it because of the location of
The minimum space for this purpose shall also be collected extraordinarily. Therefore, the cameras may exceptionally capture the minimum portion necessary for the intended security purpose.
- The duty to inform those affected must be fulfilled, as provided for in Articles 12 and 13 of the RGPD, and it is applicable - as it does not contradict the provisions of the
the manner provided for in Article 3 of Instruction 1/2006 of 8
of November, of the Spanish Data Protection Agency, on the Processing
of Personal Data for Surveillance Purposes through Camera or Video Systems.
In particular, at least one information sign must be placed in the video-surveillance areas, in a sufficiently visible place, both in open spaces
as closed, which shall identify at least the existence of a treatment, the
identity of the person responsible and the possibility of exercising the rights provided for in those
precepts. The information must also be kept available to those affected
referred to in the aforementioned RGPD.
- The person responsible must keep a register of processing activities
carried out under his responsibility which includes the information to which he
reference to Article 30.1 of the RGPD.
- Installed cameras cannot obtain images from space that is exclusive to
third party and/or public space without duly accredited cause, nor can
to affect the privacy of passers-by who are freely passing through the area. It is therefore not permitted to place cameras on the private property of neighbours with
the purpose of intimidating them or affecting their privacy without just cause.
- In no case shall the use of surveillance practices be allowed beyond the environment that is the object of the installation and in particular, they may not affect the surrounding public spaces, adjacent buildings and vehicles other than those that access the space under surveillance.
In relation to the above, to facilitate consultation by interested parties, the Spanish Data Protection Agency offers through its website
[https://www.aepd.es] access to the legislation on personal data protection, including the RGPD and the LOPDGDD (section "Reports and resolutions" / "regulations"), as well as the Guide on the use of video cameras for security and other purposes, as well as the Guide for the fulfilment of the duty to inform (both available in the section "Guides and tools")
It is also of interest, in case of data processing under
risk, the free tool Facilita (in the section "Guides and tools"), which
by means of specific questions, allows the assessment of the situation of the person responsible with regard to the processing of personal data that he/she carries out, and if appropriate, to generate various documents, informative and contractual clauses, as well as an annex with
Indicative security measures considered as minimum.
IV
The claim is based on the installation of a video surveillance system with
alleged orientation towards common areas, without the authorization of the Board
of owners and without the appropriate approved information sign.
It is identified in the claim as the main responsible the neighbour of the
property referenced above.
The known facts constitute an infringement, attributable to the defendant, for violation of art. 5.1 c) RGPD, described above.
In addition, the complainant warns that the property in question does not have a sign
informing about the presence of the chambers and the identity of the data controller, so that the data subjects can exercise the rights provided for in articles 15 to 22 of the RGPD.
Article 83(5) of the RGPD states: 'Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines not exceeding EUR 20 000 000 or, in the case of an undertaking, by a sum
equivalent to a maximum of 4 % of the total annual turnover of the previous financial year, whichever is higher:
(a) the basic principles for treatment, including the conditions for
consent under articles 5, 6, 7 and 9; (...)".
V
The corrective powers available to the Spanish Protection Agency
of Data, as supervisory authority, are set out in Article 58(2) of the GPRS. These include the power to sanction with a warning - Article 58.2 b),
the power to impose an administrative fine under Article 83 of the GPRS
-Article 58(2)(i), or the power to instruct the controller or processor
that the processing operations comply with the provisions of the RGPD, when
proceed, in a certain manner and within a specified period - Article 58. 2
d)-.
In accordance with Article 83(2) of the RGPD, the measure provided for in Article 58(2)(d) of that Regulation is compatible with the sanction consisting of a fine
administrative.
Without prejudice to the provisions of Article 83 of the GPRS, the said Regulation
Article 58(2)(b) provides for the possibility of a warning in relation to
with what is stated in Recital 148:
"In the event of a minor infringement, or if the fine likely to be imposed
constitute a disproportionate burden on a natural person, a warning may be imposed instead of a penalty in the form of a fine. It should however be provided
special attention to the nature, gravity and duration of the infringement, to its character
the measures taken to mitigate the damage suffered, to the extent
liability or any previous relevant breach, the way in which the supervisory authority became aware of the breach, compliance with measures ordered against the responsible person or person in charge, adherence to codes of conduct and any other aggravating or mitigating circumstances.
In the present case, it is considered that the owners' association has warned the defendant about the "disagreement" of the owners' association, and may have given at least the necessary explanations to avoid the reporting of the "facts" to
This organism, the chambers according to the indications given affect common areas and
are not properly marked, which justifies the imposition of a penalty in the
2 000 (two thousand euros), taking into account the absence of any previous infringement and the particular nature of the infringement.
It should be remembered that the installation of this type of system should preferably be oriented towards the access points to be protected (e.g. door and window
particular) should not be oriented towards common or transit areas of neighbours
(as), it must also have the corresponding information device, informing
that this is a video-surveillance area.
The reported party must clarify the cause/reason for the installation of the camera, as well as the technical characteristics of the same, providing photographs with date and time of what it captures with the same in a situation plane, or in its absence Contentious-Administrative Jurisdiction, within two months from
day following notification of this act, as provided for in Article 46(1) of
referred to Law.
Finally, it is pointed out that in accordance with the provisions of article 90.3 a) of the
LPACAP, the final resolution may be suspended in administrative proceedings as a precautionary measure
if the interested party expresses his intention to file an administrative appeal. If this is the case, the interested party must formally communicate this
made by writing to the Spanish Data Protection Agency,
by submitting it through the Agency's Electronic Register
[https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other
registrations provided for in Article 16.4 of the aforementioned Law 39/2015 of 1 October. Also
must send to the Agency the documentation proving the effective intervention
of the contentious-administrative appeal. If the Agency was not aware of the
the lodging of the contentious-administrative appeal within two months of
day following notification of this resolution, would terminate the
precautionary suspension.
Mar EspañaMartí
Director of the Spanish Data Protection Agency