AEPD (Spain) - PS/00178/2022
From GDPRhub
| AEPD - PS/00178/2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 4(1) GDPR Article 4(2) GDPR Article 5(1)(c) GDPR Article 6 GDPR Article 83(5)(a) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 20,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS/00178/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Giovanna Lahude |
The Spanish DPA fined a restaurant €20,000 for violating Article 6 GDPR by taking audio recordings of its employees and costumers disproportionate to the data minimisation principle of Article 5(1)(c) GDPR.
English Summary
Facts
Muxers Concept, S.L., the data controller, is the owner of a restaurant. Over the course of 2020 and 2021, the Judicial Police and the Spanish DPA received numerous complaints by employees of the restaurant, the data subjects, related to the discovery of hidden and operational audio and video recording systems in the company's toilet as well as changing and locker rooms. In the following investigation, the public entities were able to collect evidence of the hidden devices.
Following further investigations, the DPA considers it undisputed at the time of the proceedings at hand that the data controller engaged in video and audio surveillance of its employees and costumers since 2018.
While the controller informed its employees that their images, captured by video cameras, could be used to comply with labour laws, neither the employees nor the controller's costumers were informed of the hidden audio recordings.
Holding
The DPA held that the conduct of the controller infringed the GDPR by establishing three conclusions.
First, the recording of images and sounds of employees and costumers constituted the processing of personal data pursuant to Article 4(1) and Article 4(2) GDPR.
Second, the data controller's hidden image and sound recording of the employees' private spaces violated the principle of data minimisation pursuant to Article 5(1)(c) GDPR and the limits of proportionality and minimum intervention according to Article 89 of the national LOPDGDD law.
Third, the Spanish DPA held that the controller failed to consider the decision of the Spanish Constitutional Court Rec. No. 4015/1996, according to which the recording of conversations among workers or between workers and customers is not justified to ensure the employers compliance with their obligations and duties.
Therefore, the DPA concluded that the hidden image and voice recordings of uninformed employees and customers had no legal basis pursuent to Article 6 GDPR.
In determining the amount of the fine, the DPA considered aggravating factors, as stipulated in Article 83(2)(a) GDPR, and mitigating factors, as established by Article 83(2)(k) GDPR. The aggravating factors consisted of the duration of the infringement and the significant number of personal data subjects affected by the violation, whereas the DPA acknowledged as mitigating factors the data controler's status as a small business (SME) and its low turnover. As a result, the DPA fined the data controller €20,000 for violating Article 6 GDPR.
Comment
The decision of Spanish DPA on PS/00178/2022 highlights the importance of taking into account the necessity and proportionality of recording the audio of employees, especially in a circumstance where a combination of devices amounted to a system of surveillance, consisting not only of mere video recordings. One valuable resource for such analysis is the guidance provided by the Spanish DPA related to the protection of personal data in employment relation, available here.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
File No.: PS/00178/2022
RESOLUTION OF PUNISHMENT PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: The General Police Directorate, Moncloa-Aravaca Police Station (in
successive National Police), dated 11/16/2020 filed a claim with the
Spanish Data Protection Agency against the entity MUXERS CONCEPT,
SL, with NIF B87345369 (hereinafter, the claimed party or MUXERS). The motives
on which the claim is based are as follows:
The National Police gives an account of the complaint made before the Police Group
Judicial by five workers of a restaurant belonging to the claimed party,
for the “finding of an audio recording system in the company locker room”,
hidden in a false ceiling; as well as the proceedings instituted for that reason.
Provides a copy of the complaints outlined, in which the complainants declare having
found in the employee toilet, where their lockers are also located, a
alleged video surveillance camera and sound recorder, plugged in and on
conditions of use (three of the five complaints refer only to a
microphone). They also state that they were not informed about the installation of
These devices.
The National Police also provides a copy of a record, dated 10/27/2020, extended to
proceed to the intervention of a "Microphone with number Air Space AA003", and
photographs showing the location of this device in a false ceiling. According to
It is stated in this Act that the interested person who witnesses the intervention of the Police
Nacional states “that the seized microphone is owned by the company Muxers
Concept, SL, CIF…”.
On the other hand, on 04/20/2021, a claim filed by AAA was received
(hereinafter, the complaining party), also directed against the entity MUXERS, in the
stating that on 10/27/2020, in the company of other colleagues,
discovered at his workplace (the same one referred to in the claim of the
National Police) “the placement of audio/video recording cameras in the toilets
corresponding to the changing rooms of the workers”.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the claim received from the National Police was transferred
to the claimed party, so that it could proceed with its analysis and inform this Agency in
within a month, of the actions carried out to adapt to the requirements
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/18
provided for in the data protection regulations.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
(hereinafter, LPACAP) by electronic notification, was not collected by
the person in charge, within the period of making available, understanding rejected
in accordance with the provisions of art. 43.2 of the LPACAP on 12/20/2020, as stated
in the certificate that works in the file.
Although the notification was validly made by electronic means, assuming
carried out the procedure in accordance with the provisions of article 41.5 of the LPACAP, by way of
informative, a copy was sent by mail that was reliably notified in
date 01/18/2021. In said notification, he was reminded of his obligation to relate
electronically with the Administration, and they were informed of the means of access to
said notifications, reiterating that, in the future, it would be notified exclusively
by electronic means.
On 02/17/2021, this Agency received a response letter provided by the
Respondent, stating the following:
The system, which was installed by the entity Teknometric Biometric Solutions and New
Technologies, SL (Teknometric) on 06/20/2018, has 22 cameras within
of the premises, 2 exterior cameras on the facade, 1 recording equipment and 4 microphones of
preamplified audio, without any device in the locker room or in the
toilets.
On the existence of a contract by which a third party is commissioned to view and/or
listening to the images and/or audios, informs that there is a contract with the company
“Stop Alarma since the installation corresponds to the video surveillance system”. I know
attached contract and certificate of connection to alarm center and video certificate
check with that company.
In relation to the purpose of the installation of video surveillance equipment, it indicates that
Said purpose is “the access control of people, merchandise… security of the
goods and people”. In this regard, it notes that a written communication was made to
the workers since the opening and the letters signed in agreement by
each worker about the placement, its nature and its location.
Regarding the causes that gave rise to the claim, the respondent adds that the
rarefaction of the labor relationship caused by the reduction of working hours of the
workers and not having collected the amounts owed by the partial ERTE, motivated
that the workers raised the false ceiling and dragged the micro from the office (where if
there is a microphone) and they will take him to the locker room area, not to the bathrooms, and from there all the
controversy.
Additionally, all the workers have criminally denounced the owner of the
company, and there have been dismissals with the corresponding lawsuits in the Court
of the Social.
There are complaints by the company against the aforementioned workers for this
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/18
incident, which led to the dismissal of some of them, among others the manager who
abandoning her functions, she admitted the entry of people outside the premises and
he hatched a whole plan in order to ask for money by all means, as it has been.
Attached are the complaints from the company, the letters reducing the working day, which
explain the real reasons for this matter, which has nothing to do with the
placement of cameras or microphones since the company has never placed them and
appears on the location map from the first day of opening of the premises and the
communication to female workers since August 2018.
Therefore, according to the respondent, it is difficult for the workers to say, as
say they were unaware of the location of the security systems when they were
knowledgeable from the beginning of its existence, purpose, location, etc.
For more details, the lawyer of one of the complainants has asked the company
35,000 euros for this compensation issue for not going to trial.
Everything along the lines that we have said of pressuring the company to compensate the
workers or to reinstate them.
With his response, he provides the following relevant documentation:
. Location map of the cameras and microphones (22 interior cameras, 2
exterior cameras, 1 recording equipment, 4 audio microphones
preamps). According to this plan, prepared by Teknometric, the microphones
they are installed at the entrance to the restaurant, in the room where they are located
the tables and bar of the establishment (more than XX tables of different dimensions
-between and six stalls- and 12 bar stalls), in an office and in a room of
small size whose use is not specified in the plan.
. Camera location photos
. Provide a photograph in which the existence of an informative poster can be seen
of the existence of the cameras, located inside the premises.
. Provides an invoice from the installer of the Teknometric cameras, detailing
the installed system, made up of 22 interior cameras, 2 exterior cameras, a recorder
video surveillance and 4 audio outputs with hard disk, and "4 hidden microphones
preamplified”; and technical report issued by this same entity on the
installation of these devices on 06/20/2018. This report indicates
that MUXERS was informed “of the regulations and legality regarding the notice of
their employees before the placement of audio microphones”.
. "Video verification certificate" and "Certificate of connection to alarm center"
issued by the entity Stop Alarmas, SLU The latter includes a section
called "Verification" in which the "Sequential" options are marked,
Image” and “Bidirectional”. The “Audio” option is not checked.
. 10 documents dated 08/20/2018, with the label “Communication to the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/18
worker of the existence of video surveillance cameras whose images can
be used to control labor obligations and duties”. to information
contained in these documents is excerpted in the Fourth Proven Fact.
. Complaint filed with the National Police by the administrator of the entity
MUXERS, for damage caused to the staff locker room on the date
10/27/2020 (“the roof is broken and the microphone cables that were in the
inside hanging”). This document contains the manifestations of the
complainant. Among them, the following:
"That the complainant states that they are microphones, that in the employment contract comes
specified the audio and video recording, and that they themselves have signed”.
“That at 1:20 p.m. another indicative of the National Police comes to
seize the microphone from the locker room, all of which is reflected in a Record of
Intervention of Effects of which they deliver a copy to the complainant”.
THIRD: On 02/22/2021, in accordance with article 65 of the LOPDGDD,
The claim filed by the National Police was admitted for processing.
Similarly, the claim made by the claimant was admitted for processing in
date 05/07/2021.
FOURTH: The General Subdirectorate for Data Inspection proceeded to carry out
of previous investigative actions to clarify the facts in
question, by virtue of the functions assigned to the control authorities in the
article 57.1 and the powers granted in article 58.1 of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter RGPD), and
in accordance with the provisions of Title VII, Chapter I, Second Section, of the
LOPDGDD, having knowledge of the following extremes:
. A request for information was sent to the claimed party, by postal mail
Addressed to the same address where the notification of the outlined transfer was made
in the previous Antecedent, without in this case the notification could be practiced
(it was returned with the indication "unknown").
. The National Police, on 12/03/2021, informed the Inspection Services that
the police report of the Moncloa-Aravaca Police Station, has led to the opening
Preliminary Proceedings No. ***PROCEEDINGS.1, followed up in the Court of Instruction No.
XX of Madrid.
. Requested information from the aforementioned Court of Instruction on the possible
responsibility of the claimed party in the installation of the devices of
audio and video recording in the changing rooms and toilets used by the workers of the
establishment to which the claims refer, no reply was received from
said court during the period of these investigative actions.
Thus, it was agreed to declare the expiration of the aforementioned prior actions of
research and open new research actions, as well as incorporate the
same the documentation that integrates the expired actions.
The response from the Investigating Court was received on 01/26/2022, stating
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/18
reports that what has been done to date (01/18/2022) in the Procedure
Abbreviated that follows under the number ***DILIGENCIAS.1, "the
responsibility of the entity MUXERS CONCEPT, SL”.
FIFTH: On 05/13/2022, by the General Subdirectorate for Data Inspection
You can access the information related to the MUXERS entity in “Axesor” (“Informe
monitor”). (...).
SIXTH: On 05/20/2022, the Director of the Spanish Agency for the Protection of
Data agreed to initiate a sanctioning procedure against the MUXERS entity, in accordance with the
provided in articles 63 and 64 of the LPACAP, for the alleged violation of article
6 of the RGPD, typified in article 83.5.a) of the aforementioned Regulation; and rated as
very serious for prescription purposes in article 72.1.b) of the LOPDGDD.
In the opening agreement it was determined that the sanction that could correspond,
attended the existing evidence at the time of opening and without prejudice to what
resulting from the instruction, would amount to a total of 20,000 euros (twenty thousand euros).
The notification of this opening agreement to the claimed party, in which
granted a term to formulate allegations and propose evidence, it was sent by means of the
Electronic Notification Service, although it was not collected by the
claimed within the period of availability.
Although the notification was validly made by electronic means, assuming
carried out the procedure in accordance with the provisions of article 41.5 of the LPACAP, with
date 06/09/2022 a new notification attempt was made by post, being
returned the shipment due to an incorrect address, even though it was addressed to the
registered office of the entity that appears in the Mercantile Registry.
Likewise, on 06/23/02022, a document was published in the Official State Gazette
announcement of notification of the opening of proceedings. In said announcement, it is informed
the party complained against about the possibility of obtaining a copy of the opening agreement.
SEVENTH: Notification of the aforementioned start-up agreement in accordance with the established rules
in the LPACAP and after the term granted for the formulation of allegations,
has verified that no allegation has been received by the respondent party.
Article 64.2.f) of the LPACAP - provision of which the respondent was informed
in the agreement to open the procedure - establishes that if no
allegations within the stipulated period on the content of the initiation agreement, when
it contains a precise statement about the imputed responsibility,
may be considered a resolution proposal. In the present case, the agreement
beginning of the sanctioning file determined the facts in which the
imputation, the infraction of the RGPD attributed to the claimed and the sanction that could
prevail. Therefore, taking into consideration that the respondent has not
formulated allegations to the agreement to initiate the file and in attention to what
established in article 64.2.f) of the LPACAP, the aforementioned initial agreement is
considered in this case proposed resolution.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/18
In view of everything that has been done, by the Spanish Data Protection Agency
In this proceeding, the following are considered proven facts:
PROVEN FACTS
1. the MUXERS entity is responsible for the video surveillance system installed in the
premises in which it carries out its activity on 06/20/2018. It's about a
establishment open to the public dedicated to restoration.
2. The video surveillance system outlined in the First Proven Fact, in addition to
video surveillance cameras, has four audio microphones
preamplified, installed at the entrance to the restaurant, in the room where they are
located the tables and bar of the establishment (more than 30 tables of different
dimensions -between and six seats- and 12 bar seats), in an office and in a
small room whose use is not specified.
This system has a video surveillance recorder and 4 audio outputs with
HDD.
3. The intended purpose of installing this equipment is access control
of people and goods, the safety of goods and people, as well as the
control of labor obligations and duties.
4. At the time of the installation of the video surveillance system, the entity MUXERS
provided its workers with an informative document with the label "Communication to the
worker of the existence of video surveillance cameras whose images can be
used to control labor obligations and duties”. According to these documents,
the party claimed informs the worker who signs it as follows:
“In accordance with Law 5/1999… INFORMS… (name and surname of the worker) of the
recording through video cameras in the internal and external facilities of the company of
which is a treatment responsibility of Muxers Concept, SL in which they remain
stored his personal data, including his image and sound obtained, recorded and
captured through cameras and video cameras, for the following purposes:
I. Surveillance
Internal and external surveillance of the company's facilities..., in order to provide
compliance with the security operation and to prevent risks that affect the security and
protection of people, premises and patrimonial assets as well as to denounce, when
necessary, made before the competent authorities or meet requirements of the
themselves.
II. Quality and work performance
Control of the quality and labor performance of the workers as well as verification of the
fulfillment by… (name and surname of the worker) of their obligations and duties
labor.
III. disciplinary sanctions
The images and sound captured by the video surveillance cameras may be used to
the detection by Muxers… of criminal acts or labor offenses included in the agreement
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/18
collective… as evidence when sanctioning
…the technical instruments used…respect the right to privacy, within the
legitimate exercise of the power of business surveillance.
5. Due to complaints made by restaurant workers, the
The National Police appeared at the MUXERS establishment and drew up a record dated
10/27/2020, extended to proceed with the intervention of a “Microphone with
Air Space numbering AA003”. This document includes some photographs in which
the location of this device is seen in a false ceiling. As stated in these Minutes,
the interested person who, on behalf of MUXERS, witnesses the intervention
of the National Police states “that the seized microphone is property of the
company Muxers Concept, SL, CIF…”.
In its response to the claim transfer process, MUXERS stated that the
microphone intervened by the National Police was in the office set up in the
establishment.
FOUNDATIONS OF LAW
Yo
In accordance with the powers that article 58.2 of the RGPD grants to each authority of
control and as established in articles 47, 48.1, 64.2 and 68.1 of the Organic Law
3/2018, of December 5, on the Protection of Personal Data and guarantee of the
digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve
this procedure the Director of the Spanish Data Protection Agency.
Likewise, article 63.2 of the LOPDGDD determines that: “The procedures
processed by the Spanish Agency for Data Protection will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations issued in its development and, as long as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures.
II
Image and voice are personal data
The physical image and voice of a person, in accordance with article 4.1 of the RGPD, are a
personal data and its protection, therefore, is the subject of said Regulation. In the article
4.2 of the RGPD defines the concept of "treatment" of personal data.
Images and voice captured by a camera or video camera system are data
of a personal nature, so its treatment is subject to the regulations of
Data Protection.
It is, therefore, pertinent to analyze whether the processing of personal data (image and voice
of the workers in the establishment to which the claims refer, whose
ownership corresponds to the claimed party, and of the natural persons who attend
as customers to said establishment, open to the public) carried out through the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/18
denounced video surveillance system is in accordance with the provisions of the RGPD.
III
Infringement
Article 6.1 of the RGPD establishes the assumptions that allow the legalization of the
treatment of personal data.
The permanent installation of a video camera system for reasons of
Security has a legitimate basis in the LOPDGDD, whose explanatory statement indicates:
“Together with these assumptions are included others, such as video surveillance… in which the legality of the
treatment comes from the existence of a public interest, in the terms established in the
article 6.1.e) of Regulation (EU) 2016/679”.
Regarding the treatment for video surveillance purposes, article 22 of the LOPDGDD
establishes that natural or legal persons, public or private, may carry out
carry out the processing of images through camera systems or video cameras
in order to preserve the safety of people and property, as well as their
installations.
This same article 22, in its section 8, provides that "The treatment by the
employer of data obtained through camera systems or video cameras
subject to the provisions of article 89 of this organic law.
On the legitimacy for the implementation of video surveillance systems in the field
employment, Royal Legislative Decree 1/1995 of 03/24 is taken into account, approving
the revised text of the Workers' Statute Law (LET), whose article 20.3
points out:
"3. The employer may adopt the measures that he deems most appropriate for surveillance and control.
to verify compliance by the worker with his labor obligations and duties,
keeping in its adoption and application the consideration due to its dignity and taking into account
account, where appropriate, the real capacity of workers with disabilities.
The surveillance and control measures admitted include the installation of
security cameras, although these systems must always respond at the beginning
of proportionality, that is, the use of video cameras must be proportional to the purpose
pursued, this is to guarantee the security and fulfillment of the obligations and
job duties.
Article 89 of the LOPDPGDD, specifically referring to the "right to privacy
against the use of video surveillance and sound recording devices in the place
of work” and the treatment of personal data obtained with camera systems or
video cameras for the exercise of control functions of workers, allows
that employers can treat the images obtained through systems of
cameras or video cameras for the exercise of control functions of the
workers or public employees provided, respectively, in article 20.3
of the Workers' Statute and in the public function legislation, provided that
These functions are exercised within their legal framework and with the limits inherent to the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/18
same.
In relation to the recording of sounds, the aforementioned article 89 of the LOPDGDD
sets the following:
"two. In no case will the installation of sound recording systems or
video surveillance in places intended for rest or recreation of workers or
public employees, such as changing rooms, toilets, dining rooms and the like.
3. The use of systems similar to those referred to in the previous sections for the
recording of sounds in the workplace will be allowed only when they are relevant
risks to the safety of facilities, assets and people arising from the activity
that is developed in the workplace and always respecting the principle of proportionality,
the minimum intervention and the guarantees provided for in the previous sections. suppression
of the sounds preserved by these recording systems will be made according to what
provided in section 3 of article 22 of this law.”
On the other hand, it is interesting to note that, according to the doctrine of the Constitutional Court, the
Recording of conversations between workers or between them and customers is not justified
for verification of compliance by the worker with his obligations or duties.
In Judgment dated 04/10/2000 (2000/98), issued in rec. no. 4015/1996, it
declares the following:
“In this sense, it must be taken into account that the managerial power of the employer,
essential for the smooth running of the productive organization and expressly recognized
in art. 20 LET, attributes to the employer, among other powers, that of adopting the measures that
considers more opportune of vigilance and control to verify the fulfillment of the worker of
his labor obligations (art. 20.3 LET). But this faculty must occur in any case,
as is logical, within due respect for the dignity of the worker, as we expressly
It is recalled by labor regulations (arts. 4.2. and 20.3 LET)…
… it should be remembered that the jurisprudence of this Court has repeatedly insisted on the
full effectiveness of the fundamental rights of the worker within the framework of the relationship
employment, since this cannot imply in any way the deprivation of such rights for
those who provide service in productive organizations... Consequently, and as
this Court has also affirmed, the exercise of such rights only admits
limitations or sacrifices to the extent that it operates within an organization
that reflects other constitutionally recognized rights in arts. 38 and 33 EC and that
imposes, according to the assumptions, the necessary adaptability for the exercise of all of them...
For this reason, the premise from which the appealed Judgment starts, consisting of
affirm that the workplace does not constitute by definition a space in which the
right to privacy on the part of the workers, in such a way that the conversations that
keep workers among themselves and with customers in the performance of their work activity
are not covered by art. 18.1 EC and there is no reason why the company cannot
know the content of those, since the aforementioned right is exercised in the field of
worker's private sphere, which in the workplace must be understood as limited to the
places of rest or recreation, changing rooms, toilets or the like, but not those
places where work is carried out...
…Such an affirmation is rejectable, since it cannot be ruled out that also in those
places of the company in which the work activity is carried out may occur
illegitimate interference by the employer in the right to privacy of the
workers, such as the recording of conversations between a worker and a
client, or between the workers themselves, in which issues unrelated to the relationship are addressed
28001 – Madrid 6 sedeagpd.gob.es 10/18
work that are integrated into what we have called the sphere of development of the
individual (SSTC 231/1988, of December 2, FJ 4 and 197/1991, of October 17, FJ 3, by
all). In short, it will be necessary to attend not only to the place of the workplace where they are installed
by the company audiovisual control systems, but also to other elements of judgment (if
the installation is done or not indiscriminately and massively, if the systems are visible or have
been installed surreptitiously, the real purpose pursued with the installation of such
systems, if there are security reasons, due to the type of activity that takes place in the
work center in question, justifying the implementation of such means of control, etc.)
to elucidate in each specific case whether these means of surveillance and control respect the right
to the privacy of workers. Certainly, the installation of such means in places of
rest or recreation, changing rooms, toilets, dining rooms and the like is, a fortiori, harmful
in any case of the right to privacy of workers, without further consideration, for
obvious reasons... But this does not mean that this injury cannot occur in those places
where the work activity is carried out, if any of the exposed circumstances that
allows the business action to be qualified as an illegitimate intrusion into the right to privacy
from the workers. It will therefore be necessary to attend to the concurrent circumstances in the event
specifically to determine whether or not there is a violation of art. 18.1 EC.
…their limitation [of the fundamental rights of the worker] by the powers
business can only derive good from the fact that the very nature of work
contracted implies the restriction of the right (SSTC 99/1994, FJ 7, and 106/1996, FJ 4), either
an accredited need or business interest, without its mere invocation being sufficient to
sacrificing the fundamental right of the worker (SSTC 99/1994, FJ 7, 6/1995, FJ 3 and 136/1996,
FJ 7)…
These limitations or modulations must be those that are indispensable and strictly
necessary to satisfy a business interest worthy of guardianship and protection, in a
that if there are other possibilities of satisfying said interest that are less aggressive and affect the
right in question, it will be necessary to use the latter and not the more aggressive and
affecting. It is, in short, the application of the principle of proportionality...
The question to be resolved is, therefore, whether the installation of microphones that allow the recording of
conversations of workers and customers in certain areas... is adjusted in the event
that concerns us to the essential requirements of respect for the right to privacy. To the
In this regard, we must begin by pointing out that it is indisputable that the installation of
capture and recording of sound in two specific areas... it is not without utility for the
business organization, especially if one takes into account that these are two areas in which
significant economic transactions take place. Now, the mere utility
or convenience for the company does not simply legitimize the installation of hearing aids and
recording, given that the company already had other security systems than the
hearing system is intended to complement…
In summary, the implementation of the audition and recording system has not been in this case
in accordance with the principles of proportionality and minimum intervention that govern the modulation
of fundamental rights by the requirements of the interest of the organization
business, because the purpose pursued (to give a plus of security, especially before
possible claims from customers) is disproportionate to the sacrifice that
It implies the right to privacy of workers (and even customers...). This system
allows you to capture private comments, both from customers and workers...,
comments completely unrelated to business interest and therefore irrelevant from the
perspective of control of labor obligations, being able, however, to have
consecuencias negativas para los trabajadores que, en todo caso, se van a sentir constreñidos
de realizar cualquier tipo de comentario personal ante el convencimiento de que van a ser
escuchados y grabados por la empresa. Se trata, en suma, de una intromisión ilegítima en el
derecho a la intimidad consagrado en el art. 18.1 CE, pues no existe argumento definitivo que
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/18
autorice a la empresa a escuchar y grabar las conversaciones privadas que los trabajadores…
mantengan entre sí o con los clientes”.
Por otra parte, el tratamiento de datos personales está sometido al resto de los
principios del tratamiento contenidos en el artículo 5 del RGPD. Destacaremos el
principio de minimización de datos contenido en el artículo 5.1.c) del RGPD que
dispone que los datos personales serán “adecuados, pertinentes y limitados a lo
necesario en relación con los fines para los que son tratados”.
Esto significa que en un tratamiento concreto sólo pueden tratarse los datos
personales oportunos, que vengan al caso y que sean los estrictamente necesarios
para cumplir la finalidad para la que son tratados. El tratamiento debe ser ajustado y
proporcional a la finalidad a la que se dirige. La pertinencia en el tratamiento de los
datos debe producirse tanto en el momento de la recogida de los datos como en el
posterior tratamiento que se realice de los mismos.
Conforme a lo antedicho, debe restringirse el tratamiento de los datos excesivos o bien
procederse a la supresión de los mismos.
La aplicación del principio de minimización de datos al supuesto examinado comporta
que el sistema de cámaras o videocámaras instalado no pueda obtener imágenes o
sonidos afectando a la intimidad de los empleados, resultando desproporcionado
captar imágenes o sonidos en espacios privados, tales como vestuarios, taquillas o
zonas de descanso de trabajadores.
IV
Obligaciones en materia de videovigilancia
De conformidad con lo expuesto, el tratamiento de imágenes a través de un sistema
de videovigilancia, para ser conforme con la normativa vigente, debe cumplir los
requisitos siguientes:
1.- La personas físicas o jurídicas, públicas o privadas, pueden establecer un sistema
de videovigilancia con la finalidad de preservar la seguridad de las personas y bienes,
así como de sus instalaciones.
Se ha de valorar si la finalidad pretendida puede lograrse de otra forma menos
intrusiva para los derechos y libertades de los ciudadanos. Los datos personales solo
deben tratarse si la finalidad del tratamiento no pudiera lograrse razonablemente por
otros medios, considerando 39 del RGPD.
2.- Las imágenes obtenidas no puedan utilizarse para una finalidad ulterior
incompatible con la que motivó la instalación del sistema de videovigilancia.
3.- Se deberá cumplir con el deber de informar a los afectados previsto en los artículos
12 y 13 del RGPD, y 22 de la LOPDGDD.
En tal sentido, el artículo 22 de la LOPDGDD prevé en relación con la videovigilancia
un sistema de “información por capas”.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/18
La primera capa ha de referirse, al menos, a la existencia del tratamiento
(videovigilancia), la identidad del responsable, la posibilidad de ejercitar los derechos
previstos en los artículos 15 a 22 del RGPD y dónde obtener más información sobre el
tratamiento de los datos personales.
Esta información se contendrá en un dispositivo colocado en un lugar suficientemente
visible y debe suministrarse por adelantado.
La información de la segunda capa debe estar disponible en un lugar fácilmente
accesible al afectado, ya sea una hoja informativa en una recepción, cajero, etc…,
colocada en un espacio público visible o en una dirección web, y ha de referirse al
resto de elementos del artículo 13 del RGPD.
4.- No pueden captarse imágenes de la vía pública, puesto que el tratamiento de
imágenes en lugares públicos, salvo que concurra autorización gubernativa, sólo
puede ser realizado por las Fuerzas y Cuerpos de Seguridad.
En algunas ocasiones, para la protección de espacios privados, donde se hayan
instalado cámaras en fachadas o en el interior, puede ser necesario para garantizar la
finalidad de seguridad la grabación de una porción de la vía pública.
Es decir, las cámaras y videocámaras instaladas con fines de seguridad no podrán
obtener imágenes de la vía pública salvo que resulte imprescindible para dicho fin, o
resulte imposible evitarlo por razón de la ubicación de aquéllas. Y, en tal caso
extraordinario, las cámaras sólo podrán captar la porción mínima necesaria para
preservar la seguridad de las personas y bienes, así como de sus instalaciones.
Las cámaras instaladas no pueden obtener imágenes de espacio privativo de tercero
y/o espacio público sin causa justificada debidamente acreditada, ni pueden afectar a
la intimidad de transeúntes que transiten libremente por la zona.
No está permitida, por tanto, la colocación de cámaras hacia la propiedad privada de
vecinos con la finalidad de intimidarlos o afectar a su ámbito privado sin causa
justificada.
En ningún caso se admitirá el uso de prácticas de vigilancia más allá del entorno
objeto de la instalación y en particular, no pudiendo afectar a los espacios públicos
circundantes, edificios contiguos y vehículos distintos de los que accedan al espacio
vigilado.
No pueden captarse ni grabarse imágenes en espacios propiedad de terceros sin el
consentimiento de sus titulares, o, en su caso, de las personas que en ellos se
encuentren.
Resulta desproporcionado captar imágenes en espacios privados, tales como
vestuarios, taquillas o zonas de descanso de trabajadores.
5.- Las imágenes podrán conservarse por un plazo máximo de un mes, salvo en
aquellos supuestos en que se deban conservar para acreditar la comisión de actos
que atenten contra la integridad de personas, bienes o instalaciones.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/18
En este segundo supuesto, deberán ser puestas a disposición de la autoridad
competente en un plazo máximo de 72 horas desde que se tuviera conocimiento de la
existencia de la grabación.
6.- El responsable deberá llevar un registro de actividades de los tratamientos
efectuados bajo su responsabilidad en el que se incluya la información a la que hace
referencia el artículo 30.1 del RGPD.
7.- El responsable deberá realizar un análisis de riesgos o, en su caso, una evaluación
de impacto en la protección de datos, para detectar los derivados de la implantación
del sistema de videovigilancia, valorarlos y, en su caso, adoptar las medidas de
seguridad apropiadas.
8.- Cuando se produzca una brecha de seguridad que afecte a los tratamientos de
cámaras con fines de seguridad, siempre que exista riesgo para los derechos y
libertades de las personas físicas, deberá notificarlo a la AEPD en un plazo máximo de
72 horas.
Se entiende por brecha de seguridad la destrucción, pérdida o alteración accidental o
ilícita de datos personales transmitidos, conservados o tratados de otra forma, o la
comunicación o acceso no autorizado a dichos datos.
9.- Cuando el sistema esté conectado a una central de alarma, únicamente podrá ser
instalado por una empresa de seguridad privada que reúna los requisitos
contemplados en el artículo 5 de la Ley 5/2014 de Seguridad Privada, de 4 de abril.
La Agencia Española de Protección de Datos ofrece a través de su página web
[https://www.aepd.es] acceso a:
. la legislación en materia de protección de datos personales, incluyendo el RGPD
y la LOPDGDD (apartado “Informes y resoluciones” / “normativa”),
. la Guía sobre el uso de videocámaras para seguridad y otras finalidades,
. la Guía para el cumplimiento del deber de informar (ambas disponibles en el
apartado “Guías y herramientas”).
También resulta de interés, en caso de realizar tratamientos de datos de bajo riesgo, la
herramienta gratuita Facilita (en el apartado “Guías y herramientas”), que, mediante
unas preguntas concretas, permite valorar la situación del responsable respecto del
tratamiento de datos personales que lleva a cabo, y en su caso, generar diversos
documentos, cláusulas informativas y contractuales, así como un anexo con medidas
de seguridad orientativas consideradas mínimas.
v
Infracción administrativa
La reclamación se basa en la presunta ilicitud del sistema de videovigilancia instalado
por la parte reclamada en el local donde desarrolla su actividad empresarial, en
relación con la grabación de sonidos.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/18
No resulta controvertido en este caso el hecho de que la parte reclamada es la titular y
responsable del sistema de videovigilancia denunciado y, por tanto, la responsable de
los tratamientos de datos que conlleva la utilización de dicho sistema. Y tampoco el
hecho de que entre los tratamientos de datos realizados se contempla la recogida y
almacenamiento de datos personales relativos a la voz de empleados y clientes.
Consta probado en las actuaciones, asimismo, que dicha instalación se realiza con
fines de seguridad y control laboral.
Por ese motivo, con fecha 20/08/2018, la parte reclamada comunicó a los trabajadores
afectados, entre los que figura la parte reclamante, la instalación del sistema de
videovigilancia, con captación y grabación de imágenes y sonido, “con la finalidad de
dar cumplimiento al operativo de seguridad y para prevenir riesgos que afecten a la
seguridad y protección de las personas, locales y bienes patrimoniales” y para el
“control de la calidad y rendimiento laboral de los trabajadores así como verificación
del cumplimiento… de sus obligaciones y deberes laborales”.
La parte reclamada no aporta justificación suficiente sobre estos tratamientos de datos
(grabación de sonidos). No tiene en cuenta la parte reclamada los limites previstos en
el artículo 20.3 de la Ley del Estatuto de los Trabajadores (LET); lo establecido en el
artículo 89.3 de la LOPDGDD, que admite la grabación de sonidos únicamente cuando
resulten relevantes los riesgos y respetando los principios de proporcionalidad e
intervención mínima; ni la doctrina del Tribunal Constitucional, ya expresada, según la
cual la grabación de conversaciones entre trabajadores o entre éstos y clientes no se
justifica por la verificación del cumplimiento por el trabajador de sus obligaciones o
deberes.
El citado artículo 89 de la LOPDGDD, más allá de la prohibición de utilizar estos
sistemas de videovigilancia y grabación de sonidos en “lugares destinados al
descanso o esparcimiento de los trabajadores o los empleados públicos, tales como
vestuarios, aseos, comedores y análogos”, expresamente y con carácter general,
establece el sometimiento de tales sistemas al marco legal y con los límites inherentes
al mismo, ya señalados anteriormente. Ello implica que no puede entenderse como
legítimo, sin más condición, cualquier sistema que no incluya aquellos espacios.
En este caso, además, consta que uno de los micrófonos se instaló en el office
utilizado por los trabajadores. Según ha quedado probado, el sistema incluyó la
instalación de cuatro micrófonos “ocultos”: en el acceso al restaurante, en la sala
donde están ubicadas las mesas y barra del establecimiento (más de 30 mesas de
distintas dimensiones -entre y seis puestos- y 12 puestos de barra), en un office y en
una estancia de pequeño tamaño cuyo uso no está especificado en el plano. Por tanto,
resulta que alguno de estos dispositivos podría vulnerar la prohibición de instalar
“sistemas de grabación de sonidos… en lugares destinados al descanso o
esparcimiento de los trabajadores…, tales como vestuarios, aseos, comedores y
análogos”, establecida en el citado artículo 89 de la LOPDGDD.
Por otra parte, en la información facilitada a los trabajadores se hace referencia a la
“facultada de vigilancia empresarial”. Sobre esta cuestión, relativa a las posibilidades
en cuanto a la adopción de medidas de vigilancia que atribuye al empresario su poder
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/18
de dirección, interesa destacar algunos de los aspectos declarados en la Sentencia del
Tribunal Constitucional de fecha 10/04/2000, reseñada en el Fundamento de Derecho
III:
“…esa facultad ha de producirse en todo caso, como es lógico, dentro del debido respeto a la
dignidad del trabajador, como expresamente nos lo recuerda la normativa laboral (arts. 4.2.ey
20.3 LET)…”.
“Debe por ello rechazarse… que las conversaciones que mantengan los trabajadores entre sí y
con los clientes en el desempeño de su actividad laboral no están amparadas por el art.
18.1…”.
“…su limitación [de los derechos fundamentales del trabajador] por parte de las facultades
empresariales sólo puede derivar bien del hecho de que la propia naturaleza del trabajo
contratado implique la restricción del derecho (SSTC 99/1994, FJ 7, y 106/1996, FJ 4), bien de
una acreditada necesidad o interés empresarial, sin que sea suficiente su mera invocación para
sacrificar el derecho fundamental del trabajador (SSTC 99/1994, FJ 7, 6/1995, FJ 3 y 136/1996,
FJ 7)…
Estas limitaciones o modulaciones tienen que ser las indispensables y estrictamente
necesarias…”.
“…la mera utilidad o conveniencia para la empresa no legitima sin más la instalación de los
aparatos de audición y grabación, habida cuenta de que la empresa ya disponía de otros
sistemas de seguridad que el sistema de audición pretende complementar…”.
Tampoco explica qué puede aportar la grabación de conversaciones entre los
trabajadores, entre sí, entre los trabajadores y los clientes, o de éstos últimos entre sí,
en orden a acreditar aquellas circunstancias, que no aporte la sola grabación de
imágenes.
Asimismo, Interesa destacar nuevamente que la grabación de sonidos incluye la voz
de clientes de la parte reclamada (dos dispositivos instalados en la zona de clientes,
en el acceso al restaurante y en la sala donde están ubicadas las mesas y barra del
establecimiento), los cuales no tienen conocimiento de la existencia de los micrófonos.
En consecuencia, en este caso, se entiende desproporcionada la captación de la voz
tanto de los trabajadores como de clientes de la parte reclamada para la función de
videovigilancia pretendida, para el control del cumplimiento por los trabajadores de sus
obligaciones y deberes laborales. Se tiene en cuenta que la grabación de voz supone
una mayor intromisión en la intimidad.
Se considera que la parte reclamada realizó tratamientos de datos sin disponer de
base legítima, vulnerando lo establecido en el artículo 6 del RGPD, por lo que podrían
suponer la comisión de una infracción tipificada en el artículo 83.5 del RGPD, que
dispone lo siguiente:
“Las infracciones de las disposiciones siguientes se sancionarán, de acuerdo con el apartado
2, con multas administrativas de 20 000 000 EUR como máximo o, tratándose de una empresa,
de una cuantía equivalente al 4 % como máximo del volumen de negocio total anual global del
ejercicio financiero anterior, optándose por la de mayor cuantía:
a) los principios básicos para el tratamiento, incluidas las condiciones para el consentimiento a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/18
tenor de los artículos 5, 6, 7 y 9;”.
A efectos del plazo de prescripción de las infracciones, la infracción señalada en el
párrafo anterior se considera muy grave conforme al artículo 72.1.b) de la LOPDGDD,
que establece que:
“En función de lo que establece el artículo 83.5 del Reglamento (UE) 2016/679 se consideran
muy graves y prescribirán a los tres años las infracciones que supongan una vulneración
sustancial de los artículos mencionados en aquel y, en particular, las siguientes:
b) El tratamiento de datos personales sin que concurra alguna de las condiciones de licitud del
tratamiento establecidas en el artículo 6 del Reglamento (UE) 2016/.79”
SAW
Sanction
El artículo 58.2 del RGPD establece:
“Cada autoridad de control dispondrá de todos los siguientes poderes correctivos
indicados a continuación:
(...)
d) ordenar al responsable o encargado de tratamiento que las operaciones de
treatment comply with the provisions of this Regulation, where appropriate,
in a certain way and within a specified period;
(...)
i) imponer una multa administrativa con arreglo al artículo 83, además o en lugar de
las medidas mencionadas en el presente apartado, según las circunstancias de cada
caso particular”.
Según lo dispuesto en el artículo 83.2 del RGPD, la medida prevista en el artículo
58.2.d) del citado Reglamento es compatible con la sanción consistente en multa
administrativa.
Con respecto a las infracciones del artículo 6 del RGPD, atendiendo a los hechos
expuestos, se considera que la sanción que correspondería imponer es de multa
administrativa.
La multa que se imponga deberá ser, en cada caso individual, efectiva, proporcionada
y disuasoria, conforme a lo establecido en el artículo 83.1 del RGPD.
In order to determine the administrative fine to be imposed, the
previsiones del artículo 83.2 del RGPD y del artículo 76 de la LOPDGDD, respecto al
apartado k) del citado artículo 83.2 RGPD.
En este caso, se consideran las siguientes circunstancias como agravantes:
. Artículo 83.2.a) del RGPD: “a) la naturaleza, gravedad y duración de la infracción,
teniendo en cuenta la naturaleza, alcance o propósito de la operación de tratamiento
de que se trate así como el número de interesados afectados y el nivel de los daños y
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/18
perjuicios que hayan sufrido”.
. La duración de la infracción, considerando que la instalación de los dispositivos
de captación y grabación de voz tuvo lugar en agosto de 2018.
. El número de interesados: la presunta infracción afecta a todos los trabajadores
y clientes de la parte reclamada.
Por otra parte, se estima que concurren como atenuantes las circunstancias
siguientes:
. Artículo 76.2.b) de la LOPDGDD: “b) La vinculación de la actividad del infractor con la
realización de tratamientos de datos personales”.
La escasa vinculación de la parte reclamada con la realización de tratamientos de
datos personales, considerando la actividad que desarrolla.
. Artículo 83.2.k) del RGPD: “k) cualquier otro factor agravante o atenuante aplicable a
las circunstancias del caso, como los beneficios financieros obtenidos o las pérdidas
evitadas, directa o indirectamente, a través de la infracción”.
La condición de pequeña empresa de la parte reclamada y su volumen de negocio.
(...).
Considerando los factores expuestos, la valoración que alcanza la multa por la
Infracción del artículo 6 del RGPD es de 20.000 euros (veinte mil euros).
Therefore, in accordance with the applicable legislation and having assessed the criteria for
graduation of sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency RESOLVES:
PRIMERO: IMPONER A MUXERS CONCEPT, SL, con NIF B87345369, por una
infracción del Artículo 6 del RGPD, tipificada en el Artículo 83.5.a) del RGPD, una
multa de 20.000 euros (veinte mil euros).
SEGUNDO: NOTIFICAR la presente resolución a MUXERS CONCEPT, SL
THIRD: Warn the sanctioned party that he must make the imposed sanction effective once
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) de la ley 39/2015, de 1 de octubre, del Procedimiento Administrativo
Common Public Administrations (hereinafter LPACAP), within the payment term
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
de 17 de diciembre, mediante su ingreso, indicando el NIF del sancionado y el número
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened on behalf of the Agency
Spanish Data Protection in the banking entity CAIXABANK, SA. In case
Otherwise, it will be collected in the executive period.
Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/18
voluntary will be until the 20th day of the following month or immediately after, and if
between the 16th and last day of each month, both inclusive, the payment term
It will be until the 5th of the second following month or immediately after.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month from
counting from the day following the notification of this resolution or directly
recurso contencioso administrativo ante la Sala de lo Contencioso-administrativo de la
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided in article 46.1 of the
aforementioned Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact by
writing addressed to the Spanish Agency for Data Protection, presenting it through
Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registers provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. También deberá trasladar a la Agencia la
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would end the precautionary suspension.
938-050522
Sea Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
