AEPD (Spain) - E/13223/2021
|AEPD (Spain) - E/13223/2021|
|Relevant Law:||Article 5 GDPR|
Article 32 GDPR
Ley Orgánica 4/2015 de protección de la seguridad ciudadana
Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales.
|National Case Number/Name:||E/13223/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Jennifer Vidal|
The Spanish DPA held that, in the context of the Covid-19 pandemic, the registration of a data subject’s ID by a police officer, using a photograph taken with a cellphone owned by the police unit, did not violate the GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject filed a complaint with the Spanish DPA (AEPD) against the Local Police of the Municipal Council of La Puebla del Río, Seville after a police officer took a photograph of their ID with a cell phone. The data subject claimed that the device was privately owned by the police officer.
The context involved restrictive measures due to the Covid 19 pandemic, and the City of La Puebla del Río had its perimeter closed, with entry and exit controls for vehicles. The police officers managed to identify that the data subject was from a different location, and their ID was required and photographed, based on public safety regulatory legislation. The device was actually owned by the police unit, and was not the private property of the agent. Upon completion of police registration procedure, the photograph was removed from the device.
The purpose of taking the photograph was to obtain an image of the ID without physically handling it, and carry out the necessary checks in accordance with Article 16 of the Spanish Citizen Safety Law (Ley Orgánica 4/2015, de 30 de marzo, de protección de la seguridad ciudadana) to comply with specific health and security measures in the context of the pandemic.
Holding[edit | edit source]
The AEPD held that as long as data protection principles in the GDPR and the Spanish Data Protection Act (Ley Orgánica 3/2018 Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales - LOPDGDD) were observed, state security bodies could process data to achieve their inherent objectives, including prevention, investigation, detection or repression of criminal offenses. The AEPD concluded that in this case, given the exceptional context related to the pandemic, a police agent's use of a cell phone which is owned by the police unit to photograph ID documents complied with the security measures established in Article 32 GDPR, and therefore dismissed the case.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 File No.: E/13223/2021 RESOLUTION OF FILE OF ACTIONS Of the actions carried out by the Spanish Data Protection Agency before the CITY COUNCIL OF LA PUEBLA DEL RÍO- Seville, Local Police, (hereinafter, “the claimed party"), by virtue of the claim filed by D. AAA, (hereinafter, “the claimant party”), and based on the following: ACTS FIRST: On 05/03/21, this Agency received a document submitted by the claimant, in which he indicated, among others, the following: “The local police of Puebla del Río, in a police control, on the afternoon of Sunday, March 2, May, with his mobile he took a photograph of my ID, without any explanation. SECOND: On 05/28/21 and 06/09/21, this Agency addressed two separate documents requesting information on the claim received, to the City Council de la Puebla del Rio, (Local Police), in accordance with the provisions of article 65.4 of Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of digital rights, (“LOPDGDD”). THIRD: On 07/29/21, the Local Police of Puebla del Rio, sends to this Agency written response, in which, among others, indicates the following: “That during the afternoon shift on 05/02/21 the agents were ready to surveillance of compliance with the limitations and restrictions in force in the D. Law 21/2020, of August 4, which establishes the sanctioning regime for the non-compliance with the prevention and containment measures applicable in Andalusia before COVID-19, in accordance with the Decree of the President 13/2021, of 22 of April, which extends the measures established in Decree 9/2021, of 18 March, which establishes measures in the area of the autonomous community of Andalusia in application of R.D. 926/2020 of October 25, which declares the state of alarm to contain the spread of infections caused by SARS- VOC-2. That the town of La Puebla del Río was closed at that time perimeter, with which, the agents prepared to control entry and exit of vehicles in the polygon of the municipality. When a vehicle is stopped, being identified its driver, being these agents of the authority totally authorized to request or take data from people for reasons of investigation, preventive or for those cases that occur in the context of that the individual may be incurring in some type of illegality or infraction of the law, in accordance with Organic Law 4/2015. March 30, Security Protection Citizen, which establishes in its articles 16.1 and 9.2, that citizens must It is mandatory to provide your personal data or ID when the agents of the Security Forces and Bodies require their identification when there are indications that they have been able to participate in the commission of an offense and when it is considered reasonably necessary to prove your identity to prevent the commission of a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 2/6 crime. All this in accordance with the provisions of Organic Law 3/2018, of 5 December, Protection of Personal Data and Guarantee of Digital Rights, the European Directive 2016/680, of April 27, 2016. That at that moment he is informed of the reason for his stop, stating, being this gentleman from a different locality, in this case from the municipality *** LOCATION.1 (Sevilla), who is informed of the prohibition that at that time was the municipality where it was located, being also informed that it would be proposed for sanction. However, your National Identity Document is requested to be identified fully, taking the photo of the DNI with the mobile device belonging to the body of this local police headquarters taking into account the existing circumstances and not doing as this man exposes with a private mobile in order to protect and guarantee that said procedure complies with the measures of confidentiality and security established for the protection of data and personal information, such as establishes article 5 of the RGPD When our work of inspection, identification and sanction is finished, we proceed to the elimination of the photograph of our mobile device belonging to this Corporation, to ensure that the security measures continue to be guaranteed. confidentiality and security established for the protection of personal data”. FOURTH: On 09/27/21, by the Director of the Spanish Agency for Data Protection agreement is issued for the admission of claims processing presented, in accordance with article 65 of the LPDGDD Law, having appreciated possible rational indications of a violation of the rules in the field of powers of the Spanish Data Protection Agency. FOUNDATIONS OF LAW I.- Competition: By virtue of the powers that article 58.2 of Regulation (EU) 2016/679, of the Parliament- European Act and of the Council, of 04/27/16, regarding the Protection of Natural Persons regarding the Processing of Personal Data and the Free Movement of es- Data (RGPD) recognizes each Control Authority and, as established in the art. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), the Director of the Spanish Data Protection Agency is competent to resolve this procedure. I lie. Sections 1) and 2), of article 58 of the RGPD, list, respectively, the investigative and corrective powers that the supervisory authority may provide to the effect, mentioning in point 1.d), that of: "notifying the person in charge or in charge of the treatment of alleged infringements of these Regulations” and in 2.i), that of: “impose an administrative fine under article 83, in addition to or instead of the measures mentioned in this section, according to the circumstances of each case." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 3/6 II.- Summary of the facts: According to the claimant, in a control carried out by the Local Police of the town of the Puebla del Rio (Seville), on 05/02/21, the agents required him to they will identify When he showed them his ID, one of the agents took a photograph of the document and returned it. - For its part, the Local Police of the town of Puebla del Rio indicates, in its written response to this Agency, several things to take into account in this case: - That the police control was carried out in compliance with the limitations and restrictions in force in Decree Law 21/2020, of August 4, which establishes establishes the sanctioning regime for non-compliance with the measures of prevention and containment applicable in Andalusia against COVID-19. - That the town of La Puebla del Río (Seville), was at that time closed perimeter for cases of contagion, with which, the agents are They arranged to control the entry and exit of vehicles from the town. - That these agents were authorized to request and take data from the persons in accordance with Organic Law 4/2015. of March 30, Protection of Citizen Security, (articles 16.1 and 9.2.) - That the respondent is informed of the reason for his stop, being this Mr. a town other than Puebla del Rio, so you are informed of the prohibition that at that time was the municipality where found and that he will be proposed for sanction for it. - That your ID is requested to be identified, taking a photograph of your DNI with the mobile device belonging to the Local Police Headquarters, in compliance with the security measures established by the pandemic. - That when the police work was finished, the photograph was removed of the mobile device. III.- About the possible infringement of the RGPD by taking the photograph of the DNI of the claimant with a mobile phone by the Local Police of Puebla del Rio. As established in section III of the "Preamble" of Organic Law 4/2015, of March 30, protection of citizen security (LOPSC), "(...) the competent authorities to agree on different actions aimed at the maintenance and, where appropriate, the restoration of citizen tranquility in assumptions of public insecurity, regulating with precision the budgets, the and the requirements to carry out these procedures, in accordance with the principles, among others, of proportionality, minimal interference and non-discrimination (...)”. And so they are established in articles 9.2 and 16.1 of the LOPSC, regarding the obligation to display and allow verification of the DNI by agents of the Forces and State Security Corps: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 4/6 In article 9, on the obligations and rights of the holder of the National Document of Identity, indicates that: "two. All persons required to obtain the National Identity Document they are also to exhibit it and allow the verification of the security measures to those referred to in section 2 of article 8 when required to do so by the authority or its agents, for the fulfillment of the purposes set forth in section 1 of article 16. You must report your theft or loss as soon as possible. possible to the nearest Police station or post of the Security Forces and Bodies next". In its article 16, on the identification of persons, it is established that: 1. In the fulfillment of its functions of criminal investigation and prevention, as well as for the sanction of penal and administrative infractions, the agents of the Forces and Security Bodies may require the identification of the persons in the following assumptions: a) When there are indications that they may have participated in the commission of an offence. b) When, in view of the concurrent circumstances, it is considered reasonably necessary to prove their identity to prevent the commission of a crime. In these cases, the agents may carry out the necessary checks on public roads or in the place where the requirement, including the identification of persons whose face is not fully visible or partially for using any type of garment or object that covers it, preventing or making identification difficult, when necessary for the indicated purposes. In the practice of identification, the principles of proportionality, equal treatment and non-discrimination based on birth, nationality, racial or ethnic origin, sex, religion or belief, age, disability, sexual orientation or identity, opinion or any other condition or circumstance personal or social. Therefore, the State Security Forces and Bodies can process the data of citizens for the prevention, investigation, detection or prosecution of criminal offenses and for the performance of the functions of public interest that are their own. However, these treatments must be carried out respecting at all times, what is established in the regulations in force in matter of protection of personal data, the RGPD and the LOPDGDD, respectively. The GDPR, in its article 32, requires data controllers to adopt the corresponding security measures of a technical and organizational nature necessary to guarantee that the treatment is in accordance with current regulations, as well as such as ensuring that any person acting under the authority of the controller or of the person in charge and has access to personal data, they can only be processed following their instructions. Thus, in the present case, the collection of the personal data of a citizen for its identification, by the agents of the Local Police, must be carried out with C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 5/6 technical and organizational methods that guarantee the security and confidentiality of these, following the instructions of the data controller. In the present case, the Local Police of Puebla del Rio affirms that said photograph was made with an official mobile phone belonging to the Local Police Headquarters with the sole purpose of taking an image of the identity document and with it carry out the appropriate checks in accordance with article 16 of LO 4/2015, of March 30, protection of citizen security, avoiding the manipulation of the document, thereby complying with the health security measures established by the exceptional situation that was taking place. In addition to all this, we must take into account the fact that it was advised take extreme precautions and speed up interventions as much as possible due to the situation health emergency, using an exceptional means of identification such as take pictures with an official mobile phone belonging to the Local Police, made it possible, in the identification work, to reduce the interpersonal contact between the identified person and agents. All this together with the fact that, once the necessary verifications in the identification, the images taken with the mobile were erased without leaving any trace in any police file, according to confirms the police themselves. Therefore, based on the evidence available at this time, considers that the use of the official mobile phone of the acting unit for the decision of a photograph of the claimant's DNI complies with the security measures that marks article 32 of the RGPD, in the exceptional situation that was being producing. Therefore, by the Director of the Spanish Data Protection Agency, HE REMEMBERS: FIRST: PROCEED TO FILE these proceedings. SECOND: NOTIFY this resolution to the CITY COUNCIL OF LA PUEBLA DEL RÍO- Seville, Local Police, and D. A.A.A., In accordance with the provisions of article 50 of the LOPDGDD, this Re- The solution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common to Public Administrations, and in accordance with the provisions of the art. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may inter- optionally file an appeal for reconsideration before the Director of the Spanish Agency Data Protection Regulation within a month from the day following the notification of this resolution or directly contentious-administrative appeal before the Contentious-administrative Chamber of the National High Court, in accordance with the provisions placed in article 25 and in section 5 of the fourth additional provision of the Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, in the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 6/6 period of two months from the day following the notification of this act, in accordance with the provisions of article 46.1 of the aforementioned Law. Sea Spain Marti Director of the Spanish Agency for Data Protection. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es