AEPD (Spain) - PS-00224-2022
From GDPRhub
| AEPD - PS-00224-2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | [5(1)(f) GDPR] [6 GDPR] [32(1) GDPR] Article 89(2) |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 01.02.2022 |
| Decided: | 24.02.2023 |
| Published: | 21.03.2023 |
| Fine: | 70,000 EUR |
| Parties: | SUPERCOR, S.A. Two employees of SUPERCOR |
| National Case Number/Name: | PS-00224-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Appealed - Overturned AEPD (Spain) REPOSICION-PS-00224-2022 |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Natasha |
The DPA fined SUPERCOR, S.A. €70,000 for installing video surveillance cameras in a staff break room used by employees without proper notice or consent.
English Summary
Facts
On 1 February 2022, two employees of SUPERCOR, S.A. filed complaints with the Spanish DPA (AEPD) after being dismissed based on video footage from a camera installed in a break room. The camera was installed without notifying employees or obtaining their consent. SUPERCOR claimed the room was used for storing damaged goods and argued that the surveillance was necessary to investigate internal theft.
However, during the investigation, the company’s HR manager had referred to the room as the “break room” during employee interviews and in dismissal notices. SUPERCOR later explained that this was an error.
The data subjects argued that SUPERCOR did not provide any signage or notification regarding the video surveillance.
SUPERCOR maintained that the surveillance was justified under Article 6 GDPR, arguing that it had a legitimate interest for the processing of personal data due to the alleged thefts.
Holding
The AEPD found SUPERCOR in violation of Article 6 GDPR, as the company did not properly balance its legitimate interest in investigating theft with the employees' right to privacy. The DPA determined that there were less invasive alternatives available to investigate the alleged theft.
The DPA rejected SUPERCOR’s defense that the room was a room for damaged goods determining that it was a break room, regularly used by employees for rest and meals, thus making the surveillance unlawful under Article 89.2 of the Spanish implementation of the GDPR (LOPDGDD). The DPA found that the room was indeed used for rest and meals, as the employees provided photographs showing a microwave, a fridge, and evidence of the employees changing clothes in the room.
Additionally, SUPERCOR violated Article 5(1)(f) GDPR, which requires the protection of personal data through appropriate security measures. SUPERCOR failed to implement proportional measures and infringed the principles of data minimization and proportionality under Article 5(1)(c) GDPR.
The DPA concluded that SUPERCOR did not explore less invasive methods, such as monitoring only work areas. The AEPD held that the monitoring of the staff break rooms was not proportional nor adequate and violated Article 25 GDPR and Article 32 GDPR.
The DPA further noted that the intention behind installing cameras in a break room aggravated the violation under Article 83(2)(b) GDPR, emphasizing the breach of privacy rights.
Comment
In the AEPD Decision PS/00127/2018 another company was fined for installing video surveillance in staff break rooms, citing the same principles under Article 6(1) GDPR and Article 89(2) LOPDGDD.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
File No.: EXP202202563 RESOLUTION OF SANCTIONING PROCEDURE From the procedure instructed by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: A.A.A. (hereinafter, the complainant 1) and B.B.B. (hereinafter, the complainant 2) on February 1 and 2, 2022 filed a claim with the Spanish Data Protection Agency. The claims are directed against the entity SUPERCOR, S.A., with NIF A78476397 (hereinafter, the respondent or SUPERCOR). The grounds on which the claims are based are the following: The complaining parties state that they provided services as employees of the entity SUPERCOR and that, on ***DATE.1, they received a letter of dismissal for an alleged “serious and culpable breach” based on a series of images captured by the video surveillance systems of the establishment in which they carried out their work. They indicate in this regard that they were informed about the installation of this video surveillance system, but without stating in said information that there were security cameras in the “break room”, which also did not have any information posters; which contravenes, in their opinion, the provisions of article 20.3 of the Workers' Statute and the doctrine of the Constitutional Court, expressed in Judgment 29/2013, of February 11, and violates the fundamental rights of workers. With their claims they provide, among others, the following documentation: . Copy of the dismissal letters from complainants 1 and 2. The content of these documents is extracted in Proven Fact Five. . Photograph that includes the information document on the “Video surveillance cameras”, through which the complainants state that the information does not refer to the installation of cameras in the break rooms, but rather specifies that they exist in work areas. The content of this document is outlined in Proven Fact Six. . Photograph, in a general view, of the notice board installed in the “break room” mentioned in the complaint to highlight that there was no information poster about the video surveillance system. However, this photograph is not clear enough to distinguish the content of the documentation displayed, although it can be seen that it contains information C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es union. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), these claims were forwarded to the respondent party, so that it could proceed to analyze them and inform this Agency within one month of the actions taken to comply with the requirements provided for in the data protection regulations. The transfer, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was collected on 03/03/2022 and 21/03/2022, for the claims of complaining parties 1 and 2, respectively, as recorded in the acknowledgments of receipt that appear in the file. On 21 and 26/04/2022, this Agency received written responses to the claims made by the complaining parties. In relation to the facts that have motivated the claims, the following is basically indicated: . The system currently has the following cameras: - Camera 1, located at (...) - Camera 2, located at (...) - Camera 3, located at (...) - Camera 4, located at (...) - Camera 5, located at (...) - Camera 6, located at (...) - Camera 7, located at (...) - Camera 8, this is (...) - Camera 9, located at (...) - Camera 10, located at (...) - Camera 11, located at (...) - Camera 12, located at (...) - Camera 13, located at (...) - Camera 14, located at (...) - Camera 15, located at (...) - Camera 16, located at (...) - Camera 17, located at (...) - Camera 18, located at (...) - Camera 19, located at (...) - Camera 20, located at (...) - Camera 21, located at (...) - Camera 22, located at (...) (...) . Information on video surveillance and, specifically, on the existence of cameras for workplace monitoring, is information that is provided to all workers. . There are signs regarding information on video surveillance, both outside and inside the establishment, where the corresponding information is displayed, communicating it to interested parties through layers C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/30 3/30 in accordance with the provisions of current legislation on data protection. The “additional information”, referring to the second information layer, can be consulted by interested parties on the website “***URL.1”, accessible to the general public. There is also information specifically aimed at workers on the information boards and on the website “***URL.2”. . The documentation provided contains information regarding the notification that was made at the time to the workers' representatives (trade union organisations) through the Inter-centre Committee. . Technical and organisational measures have been established to guarantee the security of the images captured by the video surveillance system, in order to avoid their alteration, loss, processing or unauthorised access. . The establishment has a "control room", where the recording and viewing equipment for the images is located, with access only by authorised personnel (it is provided with a physical access control system - lock with key - and access to the system by password). . The workers' representatives, as well as the workers themselves, were informed about the use of video surveillance systems in order to maintain control of the security of people, goods, installations and merchandise owned by my representative, as well as the application of the provisions of art. 20.3 of the Workers' Statute and despite everything, several workers had knowingly committed criminal acts. . The period of conservation of the images, and although the current regulations on data protection establish that the deletion of the images must occur within a period of no more than one month, is much shorter, being 15 days. . The workplace has an area exclusively enabled for employees to change clothes and dress in their work uniform, and which is none other than the changing room. It is understood that if workers use a space for a purpose other than that for which it is intended, they do so at all times under their own responsibility. . The claim arises from facts constituting a crime, which give rise to the termination of employment of the claimant, since there were well-founded suspicions about significant losses of merchandise caused by employees of the establishment. . The aforementioned "break room" mentioned by the claimant is not such, but rather a "Loss Room", which "is used unilaterally by the workers of said center, as a break room." . The camera was installed in the "Scrap Room" on ***DATE.2, within the framework of an internal investigation to find out what was happening in the establishment and was uninstalled on ***DATE.3, so it was in operation C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/30 for three and a half months. The images captured by this camera and during this period revealed the theft of property from the entity claimed by several employees. . The scope of the recordings was limited to the duration of the internal investigation, it ceased as soon as the workers were identified, and it was not used for any other purpose than the taking of disciplinary measures. . The installation of the camera in the "scrap room" of the establishment pursued a legitimate objective, specifically, to discover who was committing those illegal acts, with the sole purpose of taking the disciplinary measures that were applicable within the framework of the employment relationship. Furthermore, it points out that there was no possibility of establishing a less intrusive measure. . All installation of security cameras must respect the principle of proportionality between the asset to be protected and the assets of third parties that may be affected, and the data collected for processing must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Therefore, it understands that at no time has the principle of data minimization been violated in accordance with the provisions of article 5.1.c) of the GDPR, and that the installation of the camera that has given rise to the claim is a measure in accordance with the events that were occurring, and that, therefore, there is a legitimate justification for adopting the measures that were carried out in this case, there being no other option to establish a less intrusive measure than the one adopted at the time. With its claim, it provides, among others, the following documentation: . Intervention parts corresponding to the installation of “a zig-zag camera with its recorder in the waste room” on ***DATE.2 and its removal on ***DATE.3. . Photographs of what the SUPERCOR entity calls the “Waste Room”, where the recordings that led to the dismissal of the complaining parties were made. As can be seen, this room has a table, an air conditioner, a toaster, a refrigerator and a microwave. The photos show two notice boards and several packing boxes. THIRD: On 04/29/2022 and 05/01/2022, in accordance with article 65 of the LOPDGDD, the claims submitted were admitted for processing. FOURTH: On 05/13/2022, the General Subdirectorate of Data Inspection accessed the information relating to the SUPERCOR entity in “Axesor” (“Monitor Report”). (...). FIFTH: On 07/21/2022, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the SUPERCOR entity, in accordance with the provisions of articles 63 and 64 of the LPACAP, for the alleged violation of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es Article 6 of the GDPR, classified in article 83.5.a) of the same Regulation, and classified for the purposes of prescription as very serious in article 72.1.b) of the LOPDGDD. In the opening agreement, it was determined that the sanction that could be imposed, taking into account the evidence existing at the time of the opening and without prejudice to what results from the investigation, would amount to a total of 70,000 euros (seventy thousand euros). Likewise, it was noted that the alleged violations, if confirmed, may lead to the imposition of measures, according to the aforementioned article 58.2 d) of the RGPD. SIXTH: After notification of the aforementioned opening agreement in accordance with the rules established in the LPACAP, the respondent party submitted a written statement of allegations in which it requests the filing of the procedure. In relation to the facts that motivated the opening of the procedure, SUPERCOR reiterates the indications expressed in its written response to the transfer procedure and adds the following considerations: . The “Video surveillance policy” contemplates the prohibition of installing cameras in areas where privacy is reserved, such as toilets, changing rooms, dining rooms and rest areas. . The report details the circumstances that led to the internal investigation carried out to verify why goods were missing from the establishment. Specifically, it states that the centre in question received some products that were destined for another centre, which had disappeared when the purchasing department tried to recover them. According to the complainant, an inventory of the received goods was made, comparing it with the delivery note, and the lack of the same was detected. It adds that, for this reason, at first the Security Delegate decided to install a camera in the warehouse, which made it possible to verify the removal of products by some employees that were not put up for sale. It points out that the verification of these images led to the suspicion that the workers who were removing goods from the warehouse were depositing them in the "Scrap Room" of the establishment, which led to the installation of a camera in the aforementioned "Scrap Room", temporarily, as confirmed by the documentation already provided. . Due to the small size of the “Scrap Room” (4.5 m2), a camera was installed that focused on the small desk, the entrance door and the refrigerator, whose only function is to deposit the scraps of perishable products, and not for the staff of the center to store drinks and food for their personal use. At the entrance to this room, which also gives access to the control center and a small warehouse, there is an informative video surveillance sign. . The size of this room, whose space is reduced by the scrap merchandise (provides photographs), does not allow it to be used as a rest room for the number of workers who must use it simultaneously (two employees per shift), in accordance with the stipulations of Annex V, of R.D. 486/1997, of April 14, which establishes the minimum health and safety provisions in the workplace. The complainant highlights the importance of the comfort of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/30 furniture that should exist in a rest room for at least two people, which is not the case of the “waste room”. In this regard, SUPERCOR warns that, although the aforementioned “Storage Room” is not a break room for the reasons stated, “the HR department administrator who interviewed the three people involved in the theft and who were shown the images captured by the camera installed to clarify the facts within the framework of the investigation, confirms that the three people involved referred to this room as a break room, and this was reflected in the dismissal letter. However, it is nothing more than a human and involuntary error in terms of the description of said space, collecting the statements of the three workers who referred at all times to said room as the break room”. The respondent party also points out that “workers are told that they can take their work break outside the establishment, but never in any space within the workplace”; and that the use by them of this room as a space for their rest or as a changing room was carried out under their responsibility, unilaterally and for a purpose other than that for which it was intended, which constitutes an irregular use of it. With its written allegations, the respondent entity provides three photographs of the room it calls the “waste room”, with which it intends to prove the very narrow area occupied by said space and the impossibility of being used as a rest room for the recreation of the workers (in the photo it can be seen that the room has a table, a chair, an air conditioning unit, a toaster, a refrigerator and a microwave); and a photograph of the information poster installed in the access area to this room. Likewise, it provides a copy of the report carried out by the National Prevention and Safety Directorate of SUPERCOR, on the “improper use of the waste room: ***REPORT.1”. The content of this report, which appears signed by the “(...)”, coincides with what was expressed by the respondent party in its written allegations, which reproduces said report almost literally. SEVENTH: On 16/12/2022, during the trial phase, the claims filed and their documentation, as well as the documents obtained and generated during the admission phase for processing of the claims, were considered reproduced for evidentiary purposes; and the allegations to the agreement to initiate the sanctioning procedure formulated by SUPERCOR and the accompanying documentation were considered presented. Furthermore, it was agreed to require the SUPERCOR entity to provide the following information and/or documentation: a) Copy of the informative notices and signage on the video surveillance system currently available in the establishment to which the actions refer, whether they are directed to the general public or to the workers of the establishment, providing details on their location and a photograph proving this location. b) Copy of the report of the “(...)”, submitted to the Human Resources Department of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/30 7/30 SUPERCOR on ***DATE.4, which is mentioned in the dismissal letters delivered to the complaining parties, both dated ***DATE.1. c) Copy of the documentation prepared by the Human Resources Department of SUPERCOR on the occasion of the dismissal of the complaining parties, especially the formalized documentation (written documentation or audio files) to record the pre-dismissal interviews held by the aforementioned Department with said parties, which are mentioned in the written statement of allegations to the opening of the procedure submitted by that entity on 08/08/2022. In response to the request referred to in letter a), the respondent provided a copy of the notice on video surveillance available on the corporate intranet, the information provided to employee representatives and photographs of the specific video surveillance signage installed at the workplace subject to the proceedings. Regarding the report of the “(...)” referred to in section b) above, the respondent states that it provided “photographs of the handwritten report in which the notes made by the person responsible can be seen regarding the correlation of the facts that give rise to this claim and which at the time led to the dismissal of the current claimant” (it is an almost illegible handwritten notebook, in which there are notes that appear to correspond to the information taken from the examination of the recorded images referred to in the claim; dates are indicated, products are listed and instructions such as “dressed in street clothes”, “puts 1 bag in”, “changes clothes” are included); and also states that it leaves “at the Agency’s disposal the “original notebook” in which the aforementioned report was written by the person in charge and which, as we have mentioned, recounts in chronological order the events that led to the dismissal of the employee.” In relation to what is indicated in section c) referenced, the respondent states the following: “On the other hand, and in relation to section 3.c) of the request made by the Agency to my representative, where the documentation prepared by the Human Resources Department is requested, on the occasion of the dismissal, we wish to point out that there were no interviews prior to the time of the dismissal, but rather a final interview in which the facts were communicated to the employee and the corresponding dismissal letter was presented to her. Likewise, we wish to state that there are no recordings or videos of said interview, so it is not possible to provide said information, although the communication was made to the Inter-Centre Committee, and for this record we attach to this document and as document no. 3, the communication sent to the Trade Union Delegate informing him of the events that occurred in the aforementioned workplace and which led to the dismissal of the worker. Likewise, we attach as document no. 4 the certificate of (...), which shows that at the time of the dismissal the trade union delegate was present and was aware of the events in which the worker incurred. Finally, and as already stated in our previous writings, the “break room” mentioned in the dismissal letter was nothing more than a grammatical error, since as already stated, the workplace subject to the request has a space exclusively used for employees to change clothes and dress in their work uniform, which is the “staff changing rooms”, so the use of this place (SAVE ROOM), in which the workers carried out said conduct, was a unilateral act on their part and at all times was under their C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es responsibility, since there was an inappropriate and irregular use of said Save Room. In this regard, and for greater transparency, we are attaching to this document the errata document signed by (...), in which he declares that the term break room was used incorrectly (document no. 5)”. Among other documentation, he is providing a copy of the letter addressed to a Trade Union Delegate giving an account of the facts in which the claimant 1 is involved, in which the result of the verifications of the images captured by the video cameras installed in the centre in question is explained and the facts verified between ***DATE.5 are detailed. The information provided on these facts coincides literally with that included in the respective dismissal letter, including the reference to the “staff room used for break”. This documentation also includes a certification issued by the (...) of the respondent party with the following text: “Errata It is stated that it was a mistake to name the waste room as a break room, since as has already been shown in said workplace there is no break room, but there is a space enabled for staff to change clothes, which is the changing room area”. EIGHTH: On 02/24/2023, a resolution proposal was made to the effect that the respondent party be sanctioned, for an infringement of article 6 of the GDPR, classified in Article 83.5.a) of the same Regulation, and classified for the purposes of prescription as very serious in article 72.1.b) of the LOPDGDD, with a fine of 70,000 euros (seventy thousand euros). NINTH: The proposed resolution outlined in the Eighth Background was notified to the respondent party on the same date, 02/24/2023, and was given a period to submit allegations. On 03/10/2023, a written statement of allegations to the proposed resolution was received in which the respondent party again requested the filing of the procedure, reiterating that its purpose was none other than to find out which employees were committing acts, that it had respected proportionality, the minimization of data, the limitation of the retention period and the suitability of the measure implemented for the purpose pursued, highlighting in this regard the same circumstances highlighted in its previous writings. Thus, it points out once again that the installation of the camera was motivated by an internal investigation, following the detection of losses of merchandise, that its use was temporary and that it was the only control measure to be able to prove the illegal acts that the complaining parties were committing, there being no other less invasive way. On these issues, the Supreme Court of Justice of Galicia Judgment 4136/2021, of June 11, which allows the installation of cameras in the event of well-founded suspicions of illegal acts, is cited; the Constitutional Court Judgment 119/2022, of September 29, which allows these recordings without having to comply with the duty to inform when there are indications of the commission of illegal acts and there is no other less invasive way C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/30 9/30 of confirming the illegality of the worker's conduct; and the Supreme Court Judgment 285/2022, of March 30, which allows as justification for the dismissal of a worker the proof of the cameras installed with the purpose of reducing and avoiding losses to the trade. As regards the evidence relating to the purpose of the room in which the camera in question was installed, the respondent alleges that in previous writings he provided the plans of the establishment, in which, according to the respondent, the existence of a “Scrap Room” and a space used as a “Changing Room” were clearly visible. These plans show the ground floor of the establishment, which consists of the shop area open to the public, the checkout line and the operational area of the centre, where the management of the centre is established and the “Scrap Room”, which has a work station for the staff in charge of managing the establishment’s scrap merchandise. He reiterates that, due to the small size of this room, which is reduced by the space occupied by the merchandise, it is logical to think that in such a small space the workers of this workplace could take a break (he provides the plans of the centre). It also highlights again that the centre had “changing rooms” for employees to change clothes, “not having to carry out this action outside the place provided for this purpose, and if they do so it will be in a free manner and always under their responsibility, as has been the case that has given rise to this claim”. Therefore, it continues to maintain that the complaining parties acted deliberately, voluntarily and unilaterally when they proceeded to change clothes in the “Sales Room”. Based on the above, the respondent party understands that it has not violated article 89.2 of the LOPDGDD, since in no case did it install a camera in the workers' rest areas. On the other hand, it shows its disagreement with what is indicated in the resolution proposal, on the non-contribution of the report prepared by the (...) of the entity, since it provided photographs of the handwritten report prepared by the same, with the notes of the investigated facts. It clarifies that, “despite not having a more elaborate report, this is the only proof of the description and sequence of events” that led to the dismissal of the complaining parties as a result of their unlawful action against the interests of the respondent party. Regarding the degree of the sanction, SUPERCOR considers the proposed fine to be disproportionate for facts that cannot be classified as very serious and requests that a lower degree of sanction be imposed, in accordance with the provisions of article 29.4 of Law 40/2015, of October 10, on the Legal Regime of the Public Sector (LRJSP), and article 74 of the LOPDGDD, classifying the present case as a minor infringement and imposing a fine of 40,000 euros, or up to 10 million euros or up to 2% of the total annual turnover, as provided for in article 83.4 of the GDPR for serious infringements. Regarding the proposed fine of 70,000 euros, SUPERCOR understands that no argument is given regarding this amount or why a lower amount is not imposed, considering this circumstance as a reason for lack of defence, as it does not know the criteria that have been taken into account to determine that amount. The aforementioned entity understands that the sanctions must be established taking into account the infringement actually committed, assessing the personal rights that have been affected, the benefits obtained, the possible recidivism, the intentionality and any other relevant circumstance, as well as the grading criteria included in article 29.3 of the LRJSP; and argues the following: . The personal rights that have been affected have been the image of the claiming parties, although the only purpose of obtaining it has been to prove the illegal act that was being committed. . Regarding the benefits obtained, it indicates that SUPERCOR has not obtained any profit as a result of the measure adopted, since the only reason was to stop suffering economic damage as a result of the illegal actions of the complaining parties. . There has been no recidivism. . The only intention was to discover the facts that were being committed and to adopt the necessary disciplinary measures. Therefore, it understands that intentionality cannot be considered an aggravating factor, as the Agency refers to in its resolution proposal, since there was no other less intrusive measure to prove the commission of the crime. With the written allegations, the respondent party provides a copy of the floor plans of the establishment in question, ground floor and basement. The first of these is distributed between the sales room, checkout line and complementary services, among which are indicated “C. Control”, “C. Inf.”, “Office”, “Cleaning”, “C. Cleaning” and “C. Garbage”. The basement, dedicated entirely to complementary services, is distributed into “Cold storage room”, “Freezing room”, “Warehouse”, “Freight elevator”, “Men's changing room” and “Women's changing room”. The space occupied by the supposed “waste room” on the ground floor has no indication of its name or intended use. From the actions carried out in the present procedure and from the documentation in the file, the following have been proven: PROVEN FACTS FIRST: The respondent party, dedicated to the sale of food, perfumery and drugstore products, has an establishment open to the public called “(...)”, located in ***LOCALITY.1. SECOND: The centre indicated in the First Proven Fact has a video surveillance system C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/30 for which the respondent is responsible. (...). THIRD: In XXXX, the respondent suspected the theft of goods (merchandise) in the aforementioned establishment by employees of the same centre. In this regard, the respondent has stated that this establishment received some products that were destined for another centre, which had disappeared when the purchasing department tried to recover them. According to the respondent, the lack of products was detected by comparing the inventory of the received merchandise with the delivery note. The company adds that, for this reason, a camera was initially installed in the warehouse, which allowed the removal of products by some employees that were not put up for sale to be verified, with the suspicion that the stolen goods were stored in a room in the centre; and that, for this reason and to carry out an internal investigation, on ***DATE.2 it was decided to install a camera in said room, which is accessed through the corridor that also leads to other rooms in the centre, located in an area of exclusive access to the entity's staff. Said camera was uninstalled on ***DATE.3. The room in which this additional camera was installed has a table, a chair, an air conditioning unit, a toaster, a refrigerator and a microwave. In the photos of the interior of this room provided by the complaining and respondent parties, two notice boards and several packing boxes can be seen. On one of the notice boards, trade union information is displayed, among other things. In relation to this room, the respondent has stated that “it is used unilaterally by the workers of said centre, as a rest room”. FOURTH: The complaining parties provided service as employees of the respondent party in the centre “(...)”. FIFTH: On ***DATE.1, the complaining parties received a letter of dismissal for a “serious and culpable breach” based on a series of images captured by the video surveillance systems of the establishment in which they carried out their tasks. Said letter is signed by the complaining party and by the Personnel Department of the respondent party. The dismissal letter delivered by the respondent party to the complaining party 1 indicates: “...this company has taken the decision to sanction you for the commission of a very serious offence, in such a way that the employment relationship that links you with Supercor, S.A. is extinguished from the moment of receipt of this letter. As you know, the Security Department of our centre has specialised video surveillance systems in order to ensure the safety of people and property, as was recently reminded to the legal representation bodies of the workers, it is reported within the Nexo application... and it was posted on the notice board of your Work Centre... being used, where appropriate, to impose disciplinary sanctions for breach of the employment contract... C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/30 ...from the Purchasing Department a series of products were sent by mistake to a Centre other than yours... an attempt was made to recover the merchandise, which was not found in your Centre... it was found that there was no sales operation that justified its disappearance. As a result of this, the (...) of Supercor is informed of what happened... so that using the measures available to them they could send their conclusions on what happened to this Personnel Department. As a result, on Friday XXXXXX a report was sent to this Personnel Department detailing the following events. The images were checked through the security cameras installed by the Security Department... . On Monday XXXXXX... he entered the staff room used for rest (a room next to the office equipped with a refrigerator so that staff can bring in personal food and drinks that members of the store bring to eat during their regular break), a chair and a table; This place being exclusively for staff rest, she closes the door and immediately begins to take off part of her work uniform... She then finishes undressing in this rest room... She finishes dressing in her street clothes (without going down to the changing room located on the floor below the store...) and then leaves the rest room, now without the uniform, to leave the center... On Tuesday XXXXXX... at 3:47 p.m., she enters the staff rest room, closes the door, and again proceeds to take off part of her work uniform. Minutes earlier, she entered and left the rest room, where another coworker was eating during her regular time... Once inside the room... She then proceeds to dress in her street clothes...; to leave the break room with the employee... who enters while you are in the room... On Friday XXXXXX... you enter the staff room designated for break time, close the door... On Sunday XXXXXX... you enter the staff room designated for break time, close the door...”. The content of the dismissal letter from claimant 2 is similar to that outlined above. The same refers to the capture of images in “the staff break room”: On Tuesday XXXXXX... at 2:51 p.m., you enter the staff break room (a room next to the office equipped with a refrigerator so that the staff can bring in the personal and private food and drinks that the members of the store bring to eat during the regulatory break, a chair and a table; this place being exclusively intended for the staff's rest)... On Sunday XXXXXX... you enter the break room... already with part of your uniform changed, you finish changing your shoes in said break room to leave again... Immediately afterwards at 8:23 p.m. you enter the break room..., leaving at 8:27 p.m. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es the break room... On Monday XXXXXX..., to immediately afterwards enter the break room... English:break and starts to prepare... At 16.25 hours, while Da... was in the break room changing from work clothes and dressing in her street clothes, you enter... Later, at 16.33 you leave the break room with your colleague...”. SIXTH: The “(...)” centre has an announcement for staff with information about the “Video surveillance cameras” with the following text: “Due to the adaptation of the video surveillance systems to the current regulations on data protection, the company management reminds all its workers that the continuous recording systems that exist in the shopping centre and work areas, whether they are access, transit, sales, processing or storage, dock or parking, have the purpose of controlling the security of people, goods, installations and merchandise for sale. In addition, they may be legally used to detect irregular actions, whether carried out by persons outside the company or by personnel providing services to it, and may be used, where appropriate, to impose disciplinary sanctions for breach of the employment contract...”. LEGAL BASIS I In accordance with the powers granted to each supervisory authority by article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this organic law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures”. II The image is personal data The physical image of a person, according to article 4.1 of the GDPR, is personal data and its protection, therefore, is the subject of said Regulation. Article 4.2 of the GDPR defines the concept of “processing” of personal data. Images generated by a camera or video camera system are personal data, so their processing is subject to data protection regulations. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/30 14/30 It is therefore pertinent to analyse whether the processing of personal data (images of individuals) carried out through the reported video surveillance system is in accordance with the provisions of the GDPR. III Infringement. Regulatory framework Article 6.1 of the GDPR establishes the assumptions that allow the processing of personal data to be considered lawful. “1. The processing will only be lawful if at least one of the following conditions is met: a) the interested party gave his consent for the processing of his personal data for one or more specific purposes; b) the processing is necessary for the execution of a contract to which the interested party is a party or for the application at the request of the latter of pre-contractual measures; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first paragraph shall not apply to processing carried out by public authorities acting in the exercise of their duties.” The permanent implementation of a video camera system for security reasons has a legitimate basis in the LOPDGDD, whose explanatory statement indicates: “Along with these assumptions, others are included, such as video surveillance... in which the lawfulness of the treatment comes from the existence of a public interest, in the terms established in article 6.1.e) of Regulation (EU) 2016/679”. Regarding the treatment for video surveillance purposes, article 22 of the LOPDGDD establishes that natural or legal persons, public or private, may carry out the treatment of images through camera or video camera systems in order to preserve the security of people and property, as well as their facilities. This same article 22, in its section 8, provides that “The treatment by the employer of data obtained through camera or video camera systems is subject to the provisions of article 89 of this organic law”. This article 89 of the LOPDGDD, referring to the “Right to privacy in relation to the use of video surveillance and sound recording devices in the workplace”, establishes the following: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 15/30 “1. Employers may process images obtained through camera or video camera systems for the exercise of the functions of monitoring workers or public employees provided for, respectively, in article 20.3 of the Workers' Statute and in the civil service legislation, provided that these functions are exercised within their legal framework and with the limits inherent to it. Employers must inform workers or public employees and, where appropriate, their representatives, in advance, and in an express, clear and concise manner, about this measure. In the event that the flagrant commission of an unlawful act by workers or public employees has been detected, the duty to inform will be deemed to have been fulfilled when at least the device referred to in article 22.4 of this organic law exists. 2. In no case will the installation of sound recording or video surveillance systems be permitted in places intended for the rest or recreation of workers or public employees, such as changing rooms, toilets, dining rooms and the like. 3. The use of systems similar to those referred to in the previous sections for the recording of sounds in the workplace will be permitted only when the risks to the safety of facilities, property and people derived from the activity carried out in the workplace are relevant and always respecting the principle of proportionality, the principle of minimum intervention and the guarantees provided for in the previous sections. The suppression of the sounds preserved by these recording systems will be carried out in accordance with the provisions of section 3 of article 22 of this law. Regarding the legitimacy for the implementation of video surveillance systems in the workplace, Royal Legislative Decree 1/1995, of 24/03, which approves the revised text of the Workers' Statute Law (LET), whose article 20.3 states: “3. The employer may adopt the measures it deems most appropriate for surveillance and control to verify the worker's compliance with his or her work obligations and duties, taking into account in their adoption and application the due consideration for his or her dignity and taking into account, where appropriate, the real capacity of workers with disabilities.” The Constitutional Court, in its ruling 98/2000, dated 10/04/2000, highlights in its legal basis 6 that “The jurisprudence of this Court has repeatedly insisted on the full effectiveness of the fundamental rights of the worker within the framework of the employment relationship, since this cannot in any way imply the deprivation of such rights for those who provide services in productive organizations, which are not alien to the constitutional principles and rights. However, the mere manifestation of the exercise of the power of control by the employer is not enough for the right of the worker to be sacrificed. These business limitations have to be those that are indispensable and strictly necessary to satisfy a business interest worthy of protection and guardianship, so that if there are other possibilities of satisfying said interest that are less aggressive and affect the right in question, the latter must be used and not those that are more aggressive and affective. It is, in short, about the application of the principle of proportionality.” In order to check whether a restrictive measure of a fundamental right passes the proportionality test, it is necessary to determine whether it meets the following three requirements or conditions: . If such a measure is likely to achieve the proposed objective (suitability test); . If it is necessary, in the sense that there is no other more moderate measure to achieve such purpose with equal effectiveness (necessity test); C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 16/30 . If it is balanced or considered, because it results in more benefits or advantages for the general interest than damage to other goods or values in conflict (proportionality test). Thus, among the surveillance and control measures allowed is the installation of security cameras, although these systems must always respond to the principle of proportionality, that is, the use of video cameras must be proportional to the aim pursued, that is, to guarantee security and compliance with work obligations and duties. In short, although article 20.3 of the Workers' Statute authorizes the employer to adopt the measures it deems most appropriate for surveillance and control to verify the worker's compliance with his or her work obligations and duties, this adoption must necessarily take into account the specific rights of workers, respecting the right to privacy and the fundamental right to data protection. In the terms of the aforementioned article 89 of the LOPDPGDD, employers are allowed to process images obtained through camera or video camera systems for the exercise of the functions of control of workers provided for in article 20.3 of the Workers' Statute "provided that these functions are exercised within their legal framework and with the limits inherent to it." In accordance with the above, employers must inform workers or public employees and, where appropriate, their representatives, in advance, in an express, clear and concise manner, about this measure. In short, the processing must be appropriate and proportional to the purpose for which it is directed. The relevance of the data processing must occur both at the time of data collection and in the subsequent processing of the same, so that the camera or video camera system installed cannot obtain images affecting the privacy of employees, making it disproportionate to capture images in private spaces, such as changing rooms, lockers or workers' rest areas. This is expressly established in the aforementioned article 89 of the LOPDGDD in relation to the installation of video surveillance systems: “2. In no case will the installation of sound recording or video surveillance systems be permitted in places intended for the rest or recreation of workers or public employees, such as changing rooms, toilets, dining rooms and the like. According to this article, surveillance in workplaces must not include places reserved for the private use of employees or that are not intended for the performance of work tasks (such as services, showers, changing rooms or rest areas). IV Obligations regarding video surveillance In accordance with the above, the processing of images through a video surveillance system, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 17/30 must comply with the following requirements in order to comply with current regulations: 1.- Natural or legal persons, public or private, may establish a video surveillance system for the purpose of preserving the security of people and property, as well as their facilities. It must be assessed whether the intended purpose can be achieved in another way that is less intrusive for the rights and freedoms of citizens. Personal data should only be processed if the purpose of the processing could not reasonably be achieved by other means, recital 39 of the GDPR. 2.- The images obtained cannot be used for a subsequent purpose incompatible with that which motivated the installation of the video surveillance system. 3.- The duty to inform those affected, as provided for in articles 12 and 13 of the GDPR and 22 of the LOPDGDD, must be fulfilled in the terms already indicated. 4.- Images of public roads cannot be captured, since the processing of images in public places, unless there is government authorization, can only be carried out by the Security Forces and Corps. In some cases, for the protection of private spaces, where cameras have been installed on facades or inside, it may be necessary to record a portion of the public road to guarantee the purpose of security. That is, cameras and video cameras installed for security purposes may not obtain images of public roads unless it is essential for this purpose, or it is impossible to avoid it due to their location. And, in such extraordinary cases, the cameras may only capture the minimum portion necessary to preserve the security of people and property, as well as their facilities. The installed cameras cannot obtain images of third party private spaces and/or public spaces without a duly accredited justified cause, nor can they affect the privacy of pedestrians who move freely through the area. Therefore, the placement of cameras on the private property of neighbours with the aim of intimidating them or affecting their private sphere without justified cause is not permitted. In no case will the use of surveillance practices be permitted beyond the environment of the installation and in particular, they may not affect the surrounding public spaces, adjacent buildings and vehicles other than those that access the monitored space. Images may not be captured or recorded in spaces owned by third parties without the consent of their owners, or, where appropriate, of the people who are in them. It is disproportionate to capture images in private spaces, such as C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es changing rooms, lockers or workers' rest areas. 5.- The images may be kept for a maximum period of one month, except in those cases in which they must be kept to prove the commission of acts that threaten the integrity of people, property or facilities. In this second case, they must be made available to the competent authority within a maximum period of 72 hours from when the existence of the recording became known. 6.- The controller must keep a record of the processing activities carried out under his responsibility, which includes the information referred to in article 30.1 of the GDPR. 7.- The controller must carry out a risk analysis or, where appropriate, an impact assessment on data protection, to detect the risks arising from the implementation of the video surveillance system, assess them and, where appropriate, adopt the appropriate security measures. 8.- When a security breach occurs that affects the processing of cameras for security purposes, provided that there is a risk to the rights and freedoms of natural persons, he must notify the AEPD within a maximum period of 72 hours. A security breach is understood to be the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or the unauthorized communication or access to such data. 9.- When the system is connected to an alarm centre, it may only be installed by a private security company that meets the requirements set out in article 5 of Law 5/2014 on Private Security, of April 4. The Spanish Data Protection Agency offers through its website [https://www.aepd.es] access to: . the legislation on personal data protection, including the GDPR and the LOPDGDD (section “Reports and resolutions” / “regulations”), . the Guide on the use of video cameras for security and other purposes, . the Guide to compliance with the duty to inform (both available in the “Guides and tools” section). Also of interest, in the case of low-risk data processing, is the free tool Facilita (in the “Guides and tools” section), which, through specific questions, allows the data controller’s situation to be assessed with respect to the processing of personal data that it carries out, and where appropriate, generate various documents, information and contractual clauses, as well as an annex with indicative security measures considered minimum. C/ Jorge Juan, 6 28001 – Madrid www.aepd.es sedeagpd.gob.es V 18/30 19/30 Administrative infringement The claim is based on the alleged illegality of the video surveillance camera installed in the area designated for staff rest at the centre where the complaining parties worked as SUPERCOR employees. The documentation included in the proceedings states that SUPERCOR itself defines this area of the establishment as follows: “...staff room used for rest (room next to the office equipped with a fridge so that staff can bring in personal and personal food and drinks that members of the store bring to eat during the required break), a chair and a table; this place being exclusively intended for staff rest...” It is not controversial in this case that the respondent party is the owner and responsible for the video surveillance system complained of and, therefore, responsible for the data processing that involves the use of said system. Nor is the fact that the data processing carried out by the respondent party includes the collection and storage of personal data relating to the image of employees collected within the area indicated above, specifically, the image of complainants 1 and 2. It is also proven in the proceedings that the installation of the video surveillance system is carried out for security and labour control purposes. Also, initially this system did not include the installation of any camera in the indicated staff rest area. When collecting and using the images obtained in the staff rest area, the respondent party does not take into account the limits provided for in article 20.3 of the Workers' Statute Law (LET), which allows the recording of images for the exercise of labour control functions when these functions respect the legal framework and the limits inherent to it, such as respect for the dignity of the worker; and also the provisions of article 89.2 of the LOPDGDD, which prohibits, in any case, the installation of video surveillance recording systems "in places intended for the rest or recreation of workers..., such as changing rooms, toilets, dining rooms and the like". Consequently, in this case, the general prohibition established in article 89.2 of the LOPDGDD, on the capture of images in a staff rest area, has been violated. The respondent party has denied in its allegations that the room in which the additional camera was installed is a room used for staff rest, stating that it is a “waste room” used by workers as a rest room unilaterally and under their responsibility. It argues, in this regard, that the small space of this room does not allow it to be used as a rest room for the number of employees who can use it in each shift in accordance with the regulations governing health and safety at work. However, it does not provide any evidence to prove the purpose of this space as a “waste room”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 20/30 And to save the fact that this room is defined as a rest room in the documentation prepared by the respondent entity itself, as in the dismissal letters that are listed in the Fifth Proven Fact, SUPERCOR has stated in its allegations at the opening of the procedure that the indication of this use, as a rest area, was produced by a human and involuntary error of the administrative of the Personnel Department who interviewed the complaining parties to clarify the facts, who prepared the dismissal letters reflecting in them the description of said space made by the complaining parties. Later, during the evidence phase, the respondent party has indicated that “there were no interviews prior to the moment of dismissal, but a final interview in which the facts are communicated to the worker and the corresponding dismissal letter is presented to her.” Therefore, if there were no interviews with the complaining parties prior to the time of dismissal and the dismissal letter had already been prepared when the Personnel Department met with said parties to communicate the end of the employment relationship, it is not possible that the repeated document reflects the statements of the workers involved, nor that these statements would have led to any error. During the aforementioned phase of evidence, the respondent party qualifies this alleged error as a “grammatical error” and provides a document (“Certificate”) signed by (...), presented as an “Errata”. This document states that it was a mistake to name the “waste room” as a rest room because the centre already has a space used as a changing room; this last circumstance does not exclude the centre from also having a rest area. Also in the evidence phase, the respondent party has provided a copy of the letter addressed to a Union Delegate giving an account of the facts in which the complainant 1 is involved, in which the room in question is described as a “staff room used for rest”. It is also interesting to note that the definition of the aforementioned room as a rest area for workers in the dismissal letters is presented as the result of the investigation carried out by the (...) of SUPERCOR, included in a report dated ***DATE.4 that said manager sent to the Personnel Department. The dismissal letter states: “As a result of this, on Friday XXXXXX a report was sent to this Personnel Department detailing the following facts. The images were checked... On Monday XXXXXX, while you were on duty as a morning and afternoon shift store manager, at 4:12 p.m., you entered the staff room used for rest (a room next to the office equipped with a refrigerator (so that staff can bring in personal food and drinks that members of the store bring to eat during their regular break), a chair and a table; this place being exclusively for staff rest, you closed the door...”. This report has not been provided to the proceedings by SUPERCOR, despite the fact that it was expressly requested by the instructor of the procedure in the evidence phase. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 21/30 In short, SUPERCOR has not provided any evidence that contradicts what was expressed by the entity itself in the documentation that is included in the proceedings, which was prepared by itself. It is concluded that the images that have given rise to the claims were captured in an area designated for the rest of the employees of the defendant party. In any case, judging by the equipment in the room, which has a table, a chair, an air conditioning unit, a toaster, a refrigerator, a microwave and a notice board with union information, there are more than enough indications to understand that the room was used by the workers as a rest room. Likewise, the information provided to this Agency by SUPERCOR suggests that it was aware of the use that was being made of the room by the workers, without having justified having prohibited it. It is interesting to highlight in this regard what was stated by the High Court of Justice of Catalonia, Social Chamber, in Judgment 2298/2022, of April 12, Rec. 7352/2021, on a case of installation of a video surveillance camera in a warehouse that was used by the company's workers as a changing room with the knowledge of the person responsible for it: “On the other hand, in view of these proven facts, it is irrelevant whether the room where the cameras were installed was the warehouse or any other, since the important thing is that it was used as a changing room by decision of the current appellant, which is why it is included in the factual assumption of the prohibition established in article 89.2 of Organic Law 3/2018, apart from the fact that, in any case, it is clear that the fact of having cameras installed in the room of the workplace intended for the workers' changing room, entails an evident violation of the fundamental right to privacy recognized in article 18.1 CE, even independently of the aforementioned article 89.2 of Organic Law 3/2018. And, of course, in the face of all this, it is not relevant that the plaintiff could know that the cameras were installed, since this circumstance does not affect her fundamental right to privacy.” And not only that. The capture of these images to control compliance by the claimant parties with their work obligations and duties is also considered disproportionate, as it has not been justified that the intended purpose could not have been achieved by other less intrusive means. It is taken into account that the recording of images in the indicated areas represents a greater intrusion into privacy. The defendant considers that the use made of the video surveillance system pursues a legitimate objective, such as the protection of its assets and the control of compliance by the claimant parties with their work duties and obligations, that the installation of the camera in question was temporary and only for the development of an internal investigation justified by suspicions of theft of assets by employees. However, this Agency understands that the establishment in question already had a global video surveillance system that allowed the viewing and recording of images in all public areas, as detailed in the background of this act, without the respondent having justified the reasons that led it to C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 22/30 supplement said system with the installation of an additional camera in the workers' rest area, nor that the installation of this camera was essential to obtain the intended results regarding the theft of items owned by the respondent. Nor has SUPERCOR justified that said conclusions could not have been obtained without this additional camera, using only the system installed in the areas where the capture of images is permitted together with other instruments at its disposal. Proof of this is that SUPERCOR has stated that, at first, it verified the lack of products by carrying out an inventory of the merchandise received at the centre and also that it initially used images taken in the warehouse area to verify that some employees were removing merchandise that was not put up for sale. In a similar situation, the National Court, Social Chamber, in Judgment 251/2021, of 11/30/2021 (Rec. 226/2021) has declared: “This principle of proportionality assumes that these systems can be used when other prevention, protection and security measures, of a physical or logical nature, that do not require the capture of images are clearly insufficient or inapplicable in relation to the legitimate purposes mentioned above, that is, a balance must be struck between the damages caused (intrusion into people's privacy) and the benefits of their use (labor control, company assets, etc.) and, therefore, the allegation of a generic "legitimate business interest in protecting its assets and preventing theft" is not enough to carry out a control such as the one agreed upon, without any specific prior justification.” The SUPERCOR entity has not stated anything contrary to any of the arguments expressed in this Legal Basis in its written allegations to the proposed resolution, in which it has limited itself to reiterating (I) that the action carried out was the only possible measure to prove the illegal acts that were being committed, without justifying it in any way; (II) that the plans provided prove the existence of a "waste room", when they do not contain any indication about the use of this room; (iii) or that the use of said space as a changing room was carried out by the claimant parties unilaterally. On the other hand, he now warns in this written statement of allegations to the proposed resolution that the report of (...) of the entity cited in the Dismissal Letters does not exist, that the only description of the facts is in the manuscript that was provided during the evidence phase, despite the fact that in his response to the request for evidence he indicated that he was making available to the Agency the notebook "in which the aforementioned report was written", which he did not provide, as explained. Also, in this written statement of allegations, in support of his claim to file the proceedings, he cites several judgments that do not modify the approach and conclusion expressed in this act. Among them, the Judgment of the Superior Court of Justice of Galicia 4136/2021, of June 11, which allows the installation of cameras in the event of well-founded suspicions of illicit acts, which respects as necessary the double concurrence of required information and weighing. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es The Constitutional Court's ruling 119/2022, of September 29, which allows these recordings without having to comply with the duty to inform when there are indications of the commission of illegal acts, there is no other less invasive way to confirm the illegality of the worker's conduct and the places of rest are respected. This ruling states: “Consequently, within the general framework of the control of compliance with an employment contract, and for these purposes only, the employer may install a video surveillance system. The installation and use of the system will not require the consent of the workers, but it does require a duty to inform them in advance and expressly about its existence and purpose. The location of the cameras must respect the privacy of places intended for rest or recreation, or that have a reserved nature. However, the use of the captured images to verify or prove the flagrant commission of an illicit act will not require the prior duty of information, which may be deemed to have been fulfilled when a sign informing of the existence of the system, the person responsible for it and its purpose has been placed in a visible place. (...) In the specific circumstances of the case, it can be stated that the installation of the video surveillance system and the subsequent use of the captured images was a justified, suitable, necessary and proportionate measure. (i) The measure was justified, because there were sufficient indicative suspicions of irregular conduct by the worker - already described - which had to be verified. (ii) The measure can be considered suitable for the intended purpose, which was none other than the verification of the possible illegality of the conduct, which was confirmed precisely by viewing the images. (iii) The measure was necessary, since it does not seem that any other less invasive and equally effective measure could be adopted to prove the labour infringement. Any other measure would have warned the worker, thus rendering the company's action useless. (iv) Finally, the measure can be considered proportionate. At this point, various elements of judgment must be considered. Thus, firstly, the cameras were not installed in places of rest, leisure or of a reserved nature, where there was a reasonable expectation of privacy, but were installed in work areas open to the public. Secondly, the cameras were not installed surreptitiously, but were located in visible places, both for the workers of the establishment and for the general public. Thirdly, the cameras were not used on a general or indefinite basis, or to carry out a prospective investigation, but to verify the possible existence of irregular conduct detected the previous day. Therefore, the degree of intrusion into the sphere of the worker's privacy (art. 18.1 CE), in terms of space and time, cannot be considered unbalanced compared to the rights and interests of the company in the detection and sanctioning of conduct that violates contractual good faith, within the framework of the exercise of the rights to private property and freedom of enterprise, recognized in arts. 33 and 38 CE, respectively." And the Supreme Court ruling 285/2022, of March 30, which admits as justification for the dismissal of a worker the evidence of the cameras installed with the purpose of reducing and avoiding losses to the trade, although this ruling refers to the installation of cameras in workplaces: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 23/30 “The controversial issue was to determine whether the video surveillance evidence provided in the judicial process by the company should have been admitted to justify the disciplinary dismissal of one of its workers, motivated by the commission of irregularities in relation to the cash register at his workplace. The company had installed fixed cameras at certain points of sale to try to reduce and prevent the unknown loss in retail trade. The staff representatives were previously informed of the 24/30 changes in the location of the cameras and the installation of new video surveillance equipment at certain points with specifications of the same, as well as the installation of adhesive signs informing them of the existence of cameras at the entrance to the establishments and in the . Consequently, in accordance with the foregoing, it is considered that the facts set forth violate the provisions of article 6 of the GDPR, due to the processing of personal data (collection and recording of images of the complaining parties) without a legal basis that legitimizes them, and therefore constitute the commission of an infringement classified in article 83.5.a) of the GDPR, which gives rise to the application of the corrective powers that article 58 of the aforementioned Regulation grants to the Spanish Data Protection Agency. Article 83.5.a) of the GDPR provides as follows: “Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of up to EUR 20,000,000 or, in the case of an undertaking, up to 4% of the total annual global turnover of the preceding financial year, whichever is higher: a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9;”. For the purposes of the limitation period for infringements, the infringement referred to in the previous paragraph is considered very serious in accordance with article 72.1 of the LOPDGDD, which states: “In accordance with the provisions of article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein and, in particular, the following are considered very serious and will be subject to a three-year statute of limitations: b) The processing of personal data without any of the conditions for the lawfulness of the processing established in article 6 of Regulation (EU) 2016/679 being met.” This is the classification that fits the specific conduct analysed in this case, so that the request expressed by the respondent party in its written allegations to the proposed resolution cannot be accepted, so that the facts set out are sanctioned in accordance with the provisions of article 83.4 and are classified as a serious to minor infringement according to articles 73 and 74 of the LOPDGDD. It should be noted that SUPERCOR has not indicated which infringement of those included in these articles of the LOPDGDD fits the infringing facts that are considered proven. In any case, it should be noted that the classification expressed in these articles is assessed solely for the purposes of prescription. VI Proposed sanction Article 58.2 of the GDPR states: “Each supervisory authority shall have all of the following corrective powers: (...) (d) to order the controller or processor to comply with the provisions of this Regulation, where appropriate, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es within them” 25/30 in a specified manner and within a specified period; (...) (i) to impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each particular case”. According to Article 83.2 of the GDPR, the measure provided for in Article 58.2.d) of the aforementioned Regulation is compatible with the sanction consisting of an administrative fine. With regard to the infringement of Article 6 of the GDPR, based on the facts set out, it is considered that the appropriate sanction to be imposed is an administrative fine. The fine imposed must be, in each individual case, effective, proportionate and dissuasive, in accordance with the provisions of Article 83.1 of the GDPR. Thus, the status of the respondent as a large company and its turnover (as stated in the proceedings (...)) are considered as a prior consideration. In order to determine the administrative fine to be imposed, the provisions of Article 83.2 of the GDPR must be observed, which states the following: “2. Administrative fines shall be imposed, depending on the circumstances of each individual case, as an additional or substitute for the measures provided for in Article 58, paragraph 2, letters a) to h) and j). When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of: a) the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing operation in question as well as the number of data subjects affected and the level of damage suffered by them; b) the intent or negligence of the infringement; c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects; d) the degree of responsibility of the controller or processor, taking into account any technical or organisational measures implemented by them pursuant to Articles 25 and 32; (e) any previous infringements committed by the controller or processor; f) the degree of cooperation with the supervisory authority with a view to remedying the infringement and mitigating any adverse effects of the infringement; g) the categories of personal data affected by the infringement; (h) the manner in which the supervisory authority became aware of the infringement, in particular whether the controller or processor notified the infringement and, if so, to what extent; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor in question in relation to the same matter, compliance with such measures; (j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” For its part, Article 76 “Penalties and corrective measures” of the LOPDGDD, with respect to paragraph k) of the aforementioned Article 83.2 GDPR, provides: “1. The sanctions provided for in sections 4, 5 and 6 of article 83 of Regulation (EU) C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 26/30 2016/679 shall be applied taking into account the grading criteria established in section 2 of the aforementioned article. 2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continued nature of the infringement. b) The link between the offender's activity and the processing of personal data. c) The benefits obtained as a result of the commission of the infringement. d) The possibility that the conduct of the affected party could have led to the commission of the infringement. e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having, when not mandatory, a data protection officer. h) The voluntary submission by the controller or person in charge to alternative dispute resolution mechanisms, in those cases where there are disputes between them and any interested party.” In the present case, the following grading criteria are considered to be concurrent as aggravating factors: . Article 83.2.b) of the GDPR: “b) the intention or negligence in the infringement”. The installation of the video surveillance camera that allowed the collection of images in a private space intended for the rest of the workers was carried out at the initiative of the respondent party, intentionally. In this regard, SUPERCOR has stated that its only intention was to discover the facts that were being committed and to adopt the necessary disciplinary measures, and, based on this, it understands that intention cannot be considered as an aggravating factor, since there was no other less intrusive measure to prove the commission of the crime. However, the intention that is valued as an aggravating factor is not related to the purpose pursued, but to the installation of cameras in a rest area for workers. . Article 76.2.b) of the LOPDGDD: “b) The connection of the offender's activity with the processing of personal data”. The high connection of the respondent party with the processing of personal data, of clients and workers, considering the activity that it carries out. Likewise, the following grading criterion is considered to be a concurrent mitigating factor: . Article 83.2.a) of the GDPR: “a) the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the processing operation in question as well as the number of data subjects affected and the level of damage they have suffered.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 27/30 . The number of data subjects: the use of the video surveillance system for work control affects only the workers of the specific centre in which the controversial video surveillance camera was installed. Considering the factors set out, the value of the fine for the infringement of article 6 of the GDPR is 70,000 euros (seventy thousand euros). The respondent party understands that the amount of the fine imposed is not argued without considering the grading criteria set out, which were already included with the same scope in the resolution proposal. To justify a reduction in the amount of the fine, it alleges that only the image of the complaining parties has been affected, a circumstance that has already been considered when grading the amount of the fine, as set out; and that the sole purpose of capturing these images was to prove the illegal act that was being committed, which is not denied in the procedure, but has been deemed insufficient to understand SUPERCOR's action as proportionate, since there were other measures to find out the allegedly illegal acts that were being committed. SUPERCOR also alleges the absence of recidivism for it to be considered as an attenuating circumstance. However, none of the grading factors considered are attenuated by the fact that the entity being sued has not been the subject of a sanctioning procedure previously. In this regard, the AN's Judgment, dated 05/05/2021, rec. 1437/2020, states: “It considers, on the other hand, that the non-commission of a previous infringement should be considered as an attenuating circumstance. Article 83.2 of the GDPR establishes that, for the imposition of the administrative fine, among others, the circumstance "e) any previous infringement committed by the controller or the person in charge of the treatment" must be taken into account. This is an aggravating circumstance, the fact that the condition for its application does not exist means that it cannot be taken into consideration, but it does not imply or allow, as the plaintiff claims, its application as an attenuating circumstance.” According to the aforementioned article 83.2 of the GDPR, when deciding whether to impose an administrative fine and its amount, “any previous infringement committed by the person responsible” must be taken into account. This is a regulatory provision that does not include the absence of previous infringements as a factor in grading the fine, which must be understood as a criterion close to recidivism, although broader. As regards the absence of benefits, also alleged as an attenuating circumstance by the respondent entity, it is taken into account that article 76.2 of the LOPDGDD, in its letter c), includes among the criteria that must be weighed when setting the amount of the sanction “the benefits obtained as a consequence of the commission of the infringement” and not the absence of these benefits. The same ruling of the National Court cited, dated 05/05/2021, refers to the need for the factual “assumption” contemplated in the regulation to be met so that a certain grading criterion can be applied, and, as has been said, the absence of benefits is not among the circumstances regulated in the cited article. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 28/30 This grading criterion is established in the LOPDGDD in accordance with the provisions of article 83.2.k) of the RGPD, according to which administrative fines will be imposed taking into account any “aggravating or mitigating factor applicable to the circumstances of the case, such as the financial benefits obtained or the losses avoided, directly or indirectly, through the infringement”, understanding that avoiding a loss has the same nature for these purposes as obtaining benefits. If we add to this that the sanctions must be effective, proportionate and dissuasive “in each individual case”, in accordance with the provisions of article 83.1 of the GDPR, admitting the absence of benefits as an attenuating circumstance is not only contrary to the factual assumptions contemplated in article 76.2.c), but also contrary to the provisions of article 83.2.k) of the GDPR and the principles indicated. Thus, assessing the absence of benefits as an attenuating circumstance would nullify the deterrent effect of the fine, to the extent that it reduces the effect of the circumstances that actually affect its quantification, giving the offender a benefit that he has not earned. It would be an artificial reduction of the sanction that could lead to the understanding that violating the rule without obtaining benefits, financial or of any other kind, will not produce a negative effect proportional to the seriousness of the offending act. In any case, the administrative fines established in the GDPR, in accordance with the provisions of Article 83.2, are imposed based on the circumstances of each individual case and, at present, the absence of benefits is not considered to be an appropriate and determining grading factor for assessing the seriousness of the infringing conduct. Only in the event that this absence of benefits is relevant to determining the degree of unlawfulness and culpability present in the specific infringing conduct may it be considered as an attenuating circumstance, in application of Article 83.2.k) of the GDPR, which refers to “any other aggravating or attenuating factor applicable to the circumstances of the case”. VII Adequacy measures Once the infringement has been confirmed, it is necessary to determine whether or not it is appropriate to require the controller to adopt appropriate measures to adjust its actions to the regulations mentioned in this act, in accordance with the provisions of the aforementioned article 58.2 d) of the GDPR, according to which each supervisory authority may “order the controller or processor to comply with the provisions of this Regulation, where appropriate, in a certain manner and within a specified period...”. The imposition of this measure is compatible with the sanction consisting of an administrative fine, as provided for in art. 83.2 of the GDPR. In this case, the video surveillance camera in question was temporarily used and uninstalled in XXXXXX. Based on this, it is not proposed that the defendant party be required to adopt additional measures to the fine. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 29/30 Therefore, in accordance with the applicable legislation and having assessed the criteria for grading the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: TO IMPOSE on SUPERCOR, S.A., with NIF A78476397, for an infringement of article 6 of the GDPR, classified in Article 83.5.a) of the same Regulation, and classified for the purposes of prescription as very serious in article 72.1.b) of the LOPDGDD, a fine of 70,000 euros (seventy thousand euros). SECOND: TO NOTIFY this resolution to SUPERCOR, S.A. THIRD: To warn the sanctioned party that he/she must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of art. 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of its payment, indicating the NIF of the sanctioned party and the procedure number that appears in the heading of this document, in the restricted account no IBAN: ES00 0000 0000 0000 0000 0000 (BIC/SWIFT Code: XXXXXXXXXXX), opened in the name of the Spanish Data Protection Agency in the banking entity CAIXABANK, S.A. Otherwise, it will be collected during the enforcement period. Once the notification has been received and enforced, if the date of enforceability is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, interested parties may, at their discretion, file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution or directly an administrative appeal before the Contentious-Administrative Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in article 46.1 of the aforementioned Law. Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final decision may be provisionally suspended by administrative means if the interested party expresses his intention to lodge an administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a letter addressed to the Spanish Data Protection Agency, presenting it through C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web/], or through one of the other registries provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. The interested party must also transfer to the Agency the documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will consider the precautionary suspension to be terminated. 938-181022 Mar España Martí Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es
