AEPD (Spain) - PS/00027/2022
From GDPRhub
| AEPD - PS/00027/2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR Article 22 LOPDGDD |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 16.03.2021 |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | PS/00027/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The DPA held that video cameras capturing a limited amount of public propperty and a house entrance (1.2km away from the controllers business) does not infringe the principle of data minimisation.
English Summary
Facts
The owner of a petrol station, who is the controller in this case, installed a video camera for his business above the door of the house of the data subject. The two parties were cousins who had a bad personal relationship. The camera is located 1.2km away from the controller's business and covers a range of 60m. The camera shows the entrance to the data subjects garage and a small part of the pavement infront of it. The data subject filed a complaint with the Spanish DPA (Agencia Española de Protección de Datos - AEPD) on 16 March 2021 about the fact that the controller installed the camera there eventhough his business is located 1.2 km away from it, accusing the controller of illegally monitoring and processing personal data of the data subject. The complaint was forwarded to the controller and collaboration with local security forces (Guardia Civil) was sought out. The Spanish DPA has rejected the complaint because there were informational signs in the area indicating the video surveillance and there was no evidence that the controller is processing the data subject's personal data. Thus, the AEPD issued a resolution proposal for closure of proceedings on 23 May 2022 based on the presumption of innocence.
Holding
The DPA recalled that the data to be processed should be minimised to what is necessary according to Article 5(1)(c) GDPR. The AEPD stated that, the video surveillance by the controller does not constitute an infringement of Article 5(1)(c) because there is no indication of processing of personal data of the data subject or any form of going above what is necessary.
The DPA also mentioned Article 22(2) Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter: LOPDGDD) which states that video surveillence of public propperty is allowed, if it is necessary for safety reasons. In the case the camera captures a small part of the public pavement which, according to the DPA, alignes with the provisions stated in Article 22 (2) LOPDGDD.
The DPA therefore concluded that the video monitoring happened in a legal manner and the presumption of innocence prevails for the controller. Thus, the complaint has been rejected.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6
File No.: PS/00027/2022
RESOLUTION OF SANCTIONING PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: A.A.A. (*hereinafter, the complaining party) dated March 16, 2021
filed a claim with the Spanish Data Protection Agency. claims her-
tion is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the claimed party). The
The reasons on which the claim is based are the following, as stated in the claim:
tion:
“The defendant is the owner of a gas station in which he has cameras installed.
video surveillance maras. Taking advantage of this circumstance, he has installed one on the
door of my house, located in Calle ***ADDRESS.1, that is, very far from ***DI-
SECTION.2 where you have the gas station.
The person in question is my cousin, who for reasons that are irrelevant to expose,
he does not have a good personal relationship with me, and he is making use of the media
that he has due to his status as an entrepreneur to coerce me and maintain the entry of
my controlled and monitored house, when this is far from the purpose that should be pursued
follow the installation of cameras in your business, which as I have explained, is quite far
far from my house I understand that you are not entitled to install them, since the regulations
data protection does not allow you to monitor beyond what your business reaches, and what
has made 1.2 km away.
This fact was reported to the Civil Guard on February 27, 2020.
The installed camera is a DOME MODEL with a range of 60 meters, I don't understand
Dose, therefore, what you are doing 1.2 km from your business. It has it installed from the window
on the top floor and oriented towards the two entrances of my house as can be seen in the photos.
cough attached. It should be noted that the upper floor is not his property,
but from direct relatives of him. It is not acceptable that personal differences or the
bad relationship that may exist between us allows you to submit us to this surveillance.
It must also be taken into account that it watches over everyone who approaches our house.
We request protection so that you uninstall them and stop knowing all our movements.
lies.
We provide photos of the day 11.03.21, which show that it has not been interrupted
this conduct despite its lack of legitimacy. We request protection from this body”.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereafter LOPDGDD), said claim was transferred to the party claimed on fe-
date 04/06/21, 04/27/21 and 05/21/21, to proceed with its analysis and inform
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/6
this Agency within a month, of the actions carried out to adapt to
the requirements set forth in the data protection regulations.
THIRD: This Agency ex officio proceeds to verify that the Agreement to Begin the
initial procedure PS/00350/2021 was not legally notified to the party
claimed, proceeding to revoke the Resolution of the Director of this Agency
dated 11/15/21 through act dated 01/18/22.
REVOKE the resolution issued on November 15, 2021 by which the
sanctioned Don B.B.B. as the notification of the initiation agreement has not been made.
FOURTH: On February 9, 2022, the Director of the Spanish Agency for
Data Protection agreed to initiate disciplinary proceedings against the claimed party,
for the alleged infringement of Article 5.1.c) of the GDPR, typified in Article 83.5 of the
GDPR.
FIFTH: On 03/21/22, collaboration is requested from the Security Forces and Bodies
locality, receiving a report from the Civil Guard Command
(04/13/22) in which the following is stated:
-That there is a single video-surveillance camera in the house, which is
located on its façade (photographs 1 and 2), providing the person responsible for the
installation screen print of what is captured with it.
-That in relation to the facts denounced IF there are conflicts between the
parties, facts which have been denounced in the Civil Guard Command of
lerin.
-That a photographic report is made in which the facts indicated are detailed
previously.
SIXTH: On 05/23/22, the "Resolution Proposal" was issued, agreeing
propose the File of the procedure as the commission of infractions is not accredited
any administrative action in the matter at hand.
In view of all the proceedings, by the Spanish Agency for Data Protection
In this proceeding, the following are considered proven facts:
PROVEN FACTS
First. The facts bring cause of the claim presented in this Agency by
the following reasons:
"presence of video-surveillance cameras in family home" by
close friend of the claimant, who states "he could be recording the public thoroughfare",
as well as access to family-owned housing (folio no. 1).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/6
Second. He is identified as the main person responsible for the B.B.B. with
DNI ***NIF.1.
Third. The presence of a single camera on the façade of the property is accredited.
oriented downwards towards the access door to the Garage, in the case of
of a sidewalk of limited dimensions.
Room. There is evidence of the presence of several informative signs in the visible area
informing that it is a "video-surveilled area" with indication of the person in charge of the
treatment.
Fifth. There is no record that the claimant's data is being processed, or that any
controlling access to the home, nor affecting the rights of third parties.
ros.
FUNDAMENTALS OF LAW
Yo
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679 (Re-
General Data Protection Regulation, hereinafter GDPR), grants each authori-
quality of control and as established in articles 47, 48.1, 64.2 and 68.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve
this procedure the Director of the Spanish Data Protection Agency.
Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed
by the Spanish Data Protection Agency will be governed by the provisions of
Regulation (EU) 2016/679, in this organic law, by the regulations
comments dictated in its development and, insofar as they do not contradict them, with a sub-
sisidario, by the general rules on administrative procedures.”
II
In this case, we proceed to examine the initial claim dated 03/16/21
through which the following facts are transferred:
“presence of video surveillance cameras in the family home” that “could
recording the public highway”, as well as access to family-owned housing.
The facts bring cause, apart from other implications in his criminal case, of the
installation of a system of video-surveillance cameras in a family home of which
the claimant temporarily disposes of the usufruct.
The installation of video surveillance cameras in the street corresponds solely and exclusively-
to the State Security Forces and Corps in the performance of functions
security purposes.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/6
The facts denounced could affect the content of art.
5.1 c) GDPR (regulations currently in force) that provides: "personal data is
ran:
c) adequate, pertinent and limited to what is necessary in relation to the purposes
for those who are processed ("data minimization") (...)".
Individuals are responsible for ensuring that the installed video surveillance systems are
conform to current legislation, and must be in a position to prove such extremes.
before the competent authority.
Cameras installed by individuals must be oriented towards their private space.
vativo avoiding the capture of private area of third parties without just cause.
In no case will the use of surveillance practices be accepted beyond the objective environment.
of the installation and in particular, not being able to affect the surrounding public spaces.
dantes, adjoining buildings and vehicles other than those that access the monitored space.
A certain amount of “caution” must be exercised when installing this type of device.
assets, weighing their usefulness in the absence of a less harmful means, given its
affectation of the right (image) of third parties through their treatment.
Likewise, in the case of false cameras, they must be oriented
towards a private area, avoiding intimidation of neighboring neighbors who do not know
They do not know if they treat personal data or not.
II
In accordance with the "evidence" available in this proceeding
disciplinary action, it is considered that the claimed party has proceeded to install a system
of video-surveillance cameras, made up of a single camera that captures from the
building façade a minimal portion of sidewalk, coinciding with the access to the
home garage.
The installed system has an informative sign(s) indicating that it is
of a video-surveilled area, informing the person responsible for the treatment and the way of
exercise rights within the framework of the regulations in force.
It has not been verified that a control of the entrances/exits is being exercised
of the property that affect the rights of the claimant and/or third parties, or that it is
tea producing a "treatment of your data" outside the permitted assumptions.
It should be specified that the analysis of the claims in the matter that we
occupies should be carried out according to the context of the specific case, not being disproportionate
determined the presence of the device to avoid, as a guideline, graffiti on the door
access to the garage.
Article 22 section 2 of the LOPDGDD (LO 3/2018, December 5) provides:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/6
"Images of public roads may only be captured to the extent that it is
essential for the purpose mentioned in the previous section.
Therefore, sometimes a minimum public space capture is allowed
essential for the protection of people or property, as is the case of
this analysis due, among other reasons, to the scarce portion of public sidewalk that limits
with access to the garage of the house.
It is recalled that with this type of device it is not possible to exercise control of
the entrances / exits of the property, as it can be considered a means of coercion of
the freedom of its inhabitants, who can be intimidated by this type of
of devices being a conduct with reproach in other fields of law.
The presumption of innocence governs without exceptions in the sanctioning Law and has
to be respected in the imposition of any sanction, whether criminal or administrative
(TCo 13/1981), since the exercise of the sanctioning right in any of its
manifestations, is conditioned to the set of evidence and a procedure
contradictory in which one's own positions can be defended.
Pursuant to this principle, no sanction may be imposed based on the
guilt of the accused if there is no probative activity, which in the
appreciation of the authorities or bodies called to resolve, destroy this
presumption (TCo Auto 3-12-81).
IV.
Based on the foregoing, it can be concluded that excessive control has not been proven.
of a public area that affects neighbors close to the property in question, considering-
I know that the installation of the camera is proportionate to the pursued purpose and that the
itself is duly informed, which justifies the filing of this proceeding.
ment.
Lastly, the parties are reminded of the importance of the rights at stake,
while avoiding the instrumentalization of this body for issues outside the
data protection or that may well be resolved in the appropriate judicial instances.
tunas for an alleged violation of the right to privacy of the claimant or any
any other contentious issue between them.
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: ORDER the FILING of this procedure as there is no accredited
gives any administrative infraction in the matter at hand.
SECOND: NOTIFY this resolution to the claimed party B.B.B. and inform
of the result of the actions to the complaining party.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/6
Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the interested parties
Respondents may optionally file an appeal for reinstatement before the Director
of the Spanish Agency for Data Protection within a period of one month from the
the day following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and section 5 of the additional provision
fourth clause of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-
administration, within a period of two months from the day following the notification
tion of this act, as provided for in article 46.1 of the aforementioned Law.
938-100322
Mar Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
