| AEPD - PS-00219-2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR Article 13 GDPR Article 83(5) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 27.01.2022 |
| Decided: | |
| Published: | |
| Fine: | 1000 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS-00219-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | solbergi |
The Spanish DPA held that camera surveillance of public spaces by data controllers is generally prohibited , which corroborates the principle of data minimisation.
English Summary
Facts
A private individual (data subject) filed a complaint to the Spanish DPA regarding another private individual (controller) operating camera surveillance aimed towards the public and private space of third parties. The controller did operate multiple cameras from his home, and had in a previous procedure been warned for not adequately informing that the area is video-monitored. Since the last procedure, the controller had installed a new camera, excessively catching public space. The controller, on the other hand, argued that the cameras, with the exception of a minimal and insignificant strip of the public highway, did not capture any public/private space of third parties.
Holding
The Spanish DPA held that the controllers newly installed cameras excessively captured public and private space of third parties and moreover that there was no justification for this, which constitutes a breach of Article 5(1)(c) GDPR. Furthermore, the nature of the breach is not deemed as grave. However, the court noted that the controller should have been aware of the requirements of operating camera surveillance due to a previous procedure with the DPA (as previously mentioned in the facts), which the court took into account and hence concluded that the controller acted negligently. Subsequently, the court imposed the controller with a 1000€ in accordance with Article 83(5) GDPR. Finally, the court prompted that it is the responsibility of the controller to ensure compliance with existing legislation.
Comment
As mentioned, the controller had already been warned by the DPA in a previous procedure concerning the need to inform of the presence of cameras. Taking this into consideration, the controller should already be well aware of the rules and yet not long after infringed the regulation, which must be considered as acting in negligence. In addition, the imposing fine incentivizes the controller to cautiously follow the rules in the future, and fortifies the responsibility of controllers to comply with the regulation and makes it evident that the DPA will reprimand negligent behavior.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7
File No.: EXP202202088
RESOLUTION OF PUNISHMENT PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: A.A.A. (*hereinafter, the complaining party) dated January 27, 2022
filed a claim with the Spanish Data Protection Agency. The
claim is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the part
claimed). The grounds on which the claim is based are as follows:
The claimant states that she filed a claim against the respondent before this
SPANISH DATA PROTECTION AGENCY, which gave rise to the
procedure ***PROCEDURE.1 in which the defendant was warned for the lack
of installation of the obligatory informative poster of the video-monitored area.
It states that the respondent has installed new cameras in his home, other than
those already analyzed in said procedure, and that they are oriented in a
significant and not punctual, to the adjoining public road, which is a passageway to other
farms and without being adequately signposted through the mandatory
informative posters of video-surveillance area.
Provides a plurality of images of the location of the cameras and a video (Annex
YO).
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party in
time and form at the address indicated by the claimant on 02/18/22, so that
proceed to its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements set forth in the regulations of
Data Protection.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP), was returned by the Official Postal Service with the
indication "unknown".
THIRD: After requesting the effective address associated with the DNI of the person claimed to the AET,
gives you a new transfer to the following address *** ADDRESS.1, receiving a brief
answer of reply on what is required by this Agency, being reiterated the
request for information dated 04/01/22, without any response in this regard.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/7
FOURTH: On April 27, 2022, in accordance with article 65 of the
LOPDGDD, the claim filed by the claimant was admitted for processing.
FIFTH: On June 2, 2022, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against the claimed party,
in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1,
of the Common Administrative Procedure of the Public Administrations (in
hereinafter, LPACAP), for the alleged infringement of Article 5.1.c) of the RGPD, typified
in Article 83.5 of the RGPD.
SIXTH: On 06/27/22 the first brief of allegations to the Agreement of
Start of the sanctioning procedure, arguing the following:
“That, from the warning issued in Procedure No.:
***PROCEDURE.1, this part acquired special sensitivity with the regulations
in force regarding data protection. For this reason, it contracted the installation and
maintenance of the two video surveillance cameras with a specialized company
as Securitas Direct Spain, SAU. Attached as Document 1 is the invoice for the
company for the contracted services.
The contract by the company has not yet been contributed to this part as of the date of
presentation of allegations, however, this party undertakes to attach it to
this Agency as soon as it has it in its possession if they consider it pertinent.
That the cameras installed in the home comply with article 5.1 c)
RGPD and with what is stipulated in the Video Surveillance Guide and in the practical files
published by this Agency. The cameras do not capture images of public roads
except for a minimum strip of accesses to my home. They don't catch either
images of adjoining land and houses or any other foreign space,
only images of my private garage are captured. Attached as Document
(...) the images of the minimum fringes captured by the cameras.
That the cameras installed comply with the duty of information contained in
article 13 RGPD, since it is reported the existence of a system of
video surveillance. Two sufficiently visible information posters have been placed in
access to guarded areas. Attached as a Document (...) are the images of
the two informative posters”.
SEVENTH: On 07/04/22, the instructor of the procedure agreed to practice the
following tests:
-Require the contribution of screen printing of what is captured with the
camera(s) in question.
-Contribution of photography with the informative poster(s), as well as contribution of
duly completed form available to any affected party.
EIGHTH: On 07/21/22 a new brief of allegations is received from the party
claimed arguing essentially the same as the previous time, although providing the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/7
screen print of what in your case is captured with the camera(s) installed on your
private property.
NINTH: On 07/26/22, a “Resolution Proposal” was issued, in which
constitutes the bad orientation of one of the cameras object of the claim, as well as
the insufficiency in the allegations put forward, proposing a sanction encrypted in the
amount of €1000 for the infringement of art. 5.1 c) GDPR.
Of the actions carried out in this procedure and the documentation
in the file, the following have been accredited:
PROVEN FACTS
First. The facts bring cause of the claim dated 01/27/22 through the
which translates the following:
"You have installed new cameras in your home, different from those already analyzed in
said procedure, and that they are oriented in a significant and not punctual way,
to the adjoining public road, which is a passageway to other farms and without there being
properly signposted by means of the mandatory area information posters
video surveillance”—folio nº 1--.
Second. It is identified as the main person in charge B.B.B., with DNI ***NIF.1.
Third. There is evidence of the presence of an informative poster indicating that it is
video-monitored area, providing documentary evidence that proves such end (Written
Annex I test 2º 07/21/22).
Fourth. The capture of public space is accredited, with the camera of the
exterior façade that is insufficiently masked.
Fifth. No allegation has been made about the exterior chamber object of
claim located in a transit area that is included in the Document
Attachment No. 1 of the claim.
FOUNDATIONS OF LAW
Yo
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on the Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/7
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Agency for Data Protection will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations issued in its development and, as long as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."
II
In the present case, we proceed to analyze the claim dated 01/27/22 by
means of which is transferred "placement of cameras without proper signage to
public space” (folio nº 1).
“has placed new devices (cameras) that focus on public roads and the
interior of the houses of other neighbors, controlling at all times the
entrances/exits of apartment number 26 as shown in the
documents attached to this claim” (folio No. 1).
The art. 5.1 c) RGPD provides the following: The personal data will be:
“adequate, relevant and limited to what is necessary in relation to the purposes
for which they are processed ("data minimization").
It should be remembered that individuals are responsible for ensuring that the systems
installed comply with current legislation, proving that it complies with
all the requirements demanded by the regulations in force.
The installation of this type of device must have the mandatory sign
informative, indicating the purposes and responsible for the treatment in your case of the data
of a personal nature.
In any case, the cameras must be oriented towards the particular space,
avoiding intimidating neighboring neighbors with this type of device, as well as
control traffic areas of the same without just cause.
Also with this type of device it is not possible to obtain image(s) of space
public, as this is the exclusive competence of the Security Forces and Bodies of the
Condition.
It should be remembered that even in the case of a "simulated" camera, the same
should preferably be oriented towards private space, since it is considered
that this type of device can affect the privacy of third parties, which are seen
intimidated by it in the belief of being the subject of permanent recording.
On the part of individuals, it is not possible to install devices for obtaining
images of public space and/or transit of third parties, outside the cases allowed in
the normative.
The purpose of this type of device must be the security of the property and of
its inhabitants, avoiding the affectation of rights of third parties that are seen
intimidated by them.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/7
III
On 07/21/22, a written statement of allegations from the respondent was received, expressed in
essence that the system conforms to current legislation, being the same duly
informed by means of an informative poster in this regard.
In support of his argument, he provides documentary evidence that proves the
orientation of the camera and the presence of an informative poster where the information about the
presence of it.
Examining the photographs provided, an excessive uptake of
public space close to the area of his private property in the two chambers
installed, with which the capture made is considered disproportionate.
In the case of the camera oriented towards the “garage” area, it is enough to limit
the space towards the door area and a small portion of public space,
while in the case of the camera on the facade of the property, it should be limited to
private space of the same, avoiding through the masking affect the area
traffic nearby.
It should be remembered that the installation of this type of device by
individuals must be carried out in strict compliance with the current legal framework,
especially when he had already been warned by this body, for some facts
similar that had involved an analysis of the requirements in terms of video-
surveillance.
The intended purpose of the system is perfectly compatible with the
limitation of the angle of the cameras towards their exclusive private area, so
that the impact towards the traffic zone next to the property is minimized (eg.
contributing new images to this organism).
Any action that may involve a criminal act on the property
of the claimed party is fulfilled with the exclusive capture of his private property, for
example by obtaining images of the access area, being unnecessary
a control of the transit area near the house.
The claimed party must answer about all the cameras installed in
especially those located in a transit area on a facade of the house (Doc. nº 1
Written claim) on which he omits any comment, which was clearly
facing public transit area.
The known facts constitute an infraction, attributable to the party
claimed, for violation of the content of art. 5.1 c) RGPD, as they are the same
disproportionately directed towards public and/or private space of third parties.
IV
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/7
The art. 83.5 RGPD provides the following: “Infringements of the provisions
following will be sanctioned, in accordance with section 2, with administrative fines
EUR 20,000,000 maximum or, in the case of a company, an amount
equivalent to a maximum of 4% of the total global annual turnover of the
previous financial year, opting for the highest amount:
a) The basic principles for the treatment including the conditions for the
consent under articles 5,6,7 and 9 (...)”.
In the present case, it is taken into account that it is an individual, although the same
was already warned by this body (***PROCEDURE.1) of the need to
report the presence of video-surveillance cameras, so it must be
aware of the requirements made, being a system that is affecting
areas that exceed their private space, reason that justifies imposing a sanction
€1,000 for violation of art. 5.1 c) RGPD, by having a camera system
oriented towards public and/or private space without just cause, sanction located in
the lower scale for this type of behavior, but taking into account the
negligent conduct of the defendant.
SAW
The text of the resolution establishes the infractions committed and
the facts that have given rise to the violation of the regulations for the protection of
data, from which it is clearly inferred what measures to adopt, without prejudice
that the type of specific procedures, mechanisms or instruments for
implement them corresponds to the sanctioned party, since it is responsible for the
treatment who fully knows your organization and has to decide, based on the
proactive responsibility and risk approach, how to comply with the RGPD and the
LOPDGDD.
Therefore, in accordance with the applicable legislation and having assessed the criteria for
graduation of sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: IMPOSE B.B.B., with NIF ***NIF.1, for an infraction of Article 5.1.c)
of the RGPD, typified in Article 83.5 of the RGPD, a fine of €1,000 (one thousand euros).
SECOND: ORDER compliance within ONE MONTH of the following
corrective measures, in accordance with article 58.2 RGPD:
-Proceed to mask the cameras so that space is not captured
any public, limited to their private property.
-Removal of any camera that affects the transit area, accrediting such
before this Agency through documentary evidence (eg photography).
THIRD: NOTIFY this resolution to Don B.B.B..
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/7
FOURTH: Warn the sanctioned party that he must make the imposed sanction effective once
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common Public Administrations (hereinafter LPACAP), within the payment term
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, through its entry, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened on behalf of the Agency
Spanish Department of Data Protection in the banking entity CAIXABANK, S.A.. In case
Otherwise, it will be collected in the executive period.
Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
voluntary will be until the 20th day of the following month or immediately after, and if
between the 16th and last day of each month, both inclusive, the payment term
It will be until the 5th of the second following month or immediately after.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month from
counting from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided in article 46.1 of the
aforementioned Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact by
writing addressed to the Spanish Agency for Data Protection, presenting it through
Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registers provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would end the precautionary suspension.
938-120722
Sea Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
