AEPD (Spain) - EXP202202088
|AEPD - PS-00219-2022
|Article 5(1)(c) GDPR
Article 13 GDPR
Article 83(5) GDPR
|National Case Number/Name:
|European Case Law Identifier:
|AEPD (in ES)
The Spanish DPA held that camera surveillance of public spaces by data controllers is generally prohibited , which corroborates the principle of data minimisation.
English Summary[edit | edit source]
Facts[edit | edit source]
A private individual (data subject) filed a complaint to the Spanish DPA regarding another private individual (controller) operating camera surveillance aimed towards the public and private space of third parties. The controller did operate multiple cameras from his home, and had in a previous procedure been warned for not adequately informing that the area is video-monitored. Since the last procedure, the controller had installed a new camera, excessively catching public space. The controller, on the other hand, argued that the cameras, with the exception of a minimal and insignificant strip of the public highway, did not capture any public/private space of third parties.
Holding[edit | edit source]
The Spanish DPA held that the controllers newly installed cameras excessively captured public and private space of third parties and moreover that there was no justification for this, which constitutes a breach of Article 5(1)(c) GDPR. Furthermore, the nature of the breach is not deemed as grave. However, the court noted that the controller should have been aware of the requirements of operating camera surveillance due to a previous procedure with the DPA (as previously mentioned in the facts), which the court took into account and hence concluded that the controller acted negligently. Subsequently, the court imposed the controller with a 1000€ in accordance with Article 83(5) GDPR. Finally, the court prompted that it is the responsibility of the controller to ensure compliance with existing legislation.
Comment[edit | edit source]
As mentioned, the controller had already been warned by the DPA in a previous procedure concerning the need to inform of the presence of cameras. Taking this into consideration, the controller should already be well aware of the rules and yet not long after infringed the regulation, which must be considered as acting in negligence. In addition, the imposing fine incentivizes the controller to cautiously follow the rules in the future, and fortifies the responsibility of controllers to comply with the regulation and makes it evident that the DPA will reprimand negligent behavior.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7 File No.: EXP202202088 RESOLUTION OF PUNISHMENT PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: A.A.A. (*hereinafter, the complaining party) dated January 27, 2022 filed a claim with the Spanish Data Protection Agency. The claim is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the part claimed). The grounds on which the claim is based are as follows: The claimant states that she filed a claim against the respondent before this SPANISH DATA PROTECTION AGENCY, which gave rise to the procedure ***PROCEDURE.1 in which the defendant was warned for the lack of installation of the obligatory informative poster of the video-monitored area. It states that the respondent has installed new cameras in his home, other than those already analyzed in said procedure, and that they are oriented in a significant and not punctual, to the adjoining public road, which is a passageway to other farms and without being adequately signposted through the mandatory informative posters of video-surveillance area. Provides a plurality of images of the location of the cameras and a video (Annex YO). SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred to the claimed party in time and form at the address indicated by the claimant on 02/18/22, so that proceed to its analysis and inform this Agency within a month of the actions carried out to adapt to the requirements set forth in the regulations of Data Protection. The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, of the Common Administrative Procedure of the Administrations Public (hereinafter, LPACAP), was returned by the Official Postal Service with the indication "unknown". THIRD: After requesting the effective address associated with the DNI of the person claimed to the AET, gives you a new transfer to the following address *** ADDRESS.1, receiving a brief answer of reply on what is required by this Agency, being reiterated the request for information dated 04/01/22, without any response in this regard. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/7 FOURTH: On April 27, 2022, in accordance with article 65 of the LOPDGDD, the claim filed by the claimant was admitted for processing. FIFTH: On June 2, 2022, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure against the claimed party, in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of the Public Administrations (in hereinafter, LPACAP), for the alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD. SIXTH: On 06/27/22 the first brief of allegations to the Agreement of Start of the sanctioning procedure, arguing the following: “That, from the warning issued in Procedure No.: ***PROCEDURE.1, this part acquired special sensitivity with the regulations in force regarding data protection. For this reason, it contracted the installation and maintenance of the two video surveillance cameras with a specialized company as Securitas Direct Spain, SAU. Attached as Document 1 is the invoice for the company for the contracted services. The contract by the company has not yet been contributed to this part as of the date of presentation of allegations, however, this party undertakes to attach it to this Agency as soon as it has it in its possession if they consider it pertinent. That the cameras installed in the home comply with article 5.1 c) RGPD and with what is stipulated in the Video Surveillance Guide and in the practical files published by this Agency. The cameras do not capture images of public roads except for a minimum strip of accesses to my home. They don't catch either images of adjoining land and houses or any other foreign space, only images of my private garage are captured. Attached as Document (...) the images of the minimum fringes captured by the cameras. That the cameras installed comply with the duty of information contained in article 13 RGPD, since it is reported the existence of a system of video surveillance. Two sufficiently visible information posters have been placed in access to guarded areas. Attached as a Document (...) are the images of the two informative posters”. SEVENTH: On 07/04/22, the instructor of the procedure agreed to practice the following tests: -Require the contribution of screen printing of what is captured with the camera(s) in question. -Contribution of photography with the informative poster(s), as well as contribution of duly completed form available to any affected party. EIGHTH: On 07/21/22 a new brief of allegations is received from the party claimed arguing essentially the same as the previous time, although providing the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/7 screen print of what in your case is captured with the camera(s) installed on your private property. NINTH: On 07/26/22, a “Resolution Proposal” was issued, in which constitutes the bad orientation of one of the cameras object of the claim, as well as the insufficiency in the allegations put forward, proposing a sanction encrypted in the amount of €1000 for the infringement of art. 5.1 c) GDPR. Of the actions carried out in this procedure and the documentation in the file, the following have been accredited: PROVEN FACTS First. The facts bring cause of the claim dated 01/27/22 through the which translates the following: "You have installed new cameras in your home, different from those already analyzed in said procedure, and that they are oriented in a significant and not punctual way, to the adjoining public road, which is a passageway to other farms and without there being properly signposted by means of the mandatory area information posters video surveillance”—folio nº 1--. Second. It is identified as the main person in charge B.B.B., with DNI ***NIF.1. Third. There is evidence of the presence of an informative poster indicating that it is video-monitored area, providing documentary evidence that proves such end (Written Annex I test 2º 07/21/22). Fourth. The capture of public space is accredited, with the camera of the exterior façade that is insufficiently masked. Fifth. No allegation has been made about the exterior chamber object of claim located in a transit area that is included in the Document Attachment No. 1 of the claim. FOUNDATIONS OF LAW Yo In accordance with the powers that article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), grants each control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve this procedure the Director of the Spanish Protection Agency of data. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/7 Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Agency for Data Protection will be governed by the provisions in Regulation (EU) 2016/679, in this organic law, by the provisions regulations issued in its development and, as long as they do not contradict them, with a subsidiary, by the general rules on administrative procedures." II In the present case, we proceed to analyze the claim dated 01/27/22 by means of which is transferred "placement of cameras without proper signage to public space” (folio nº 1). “has placed new devices (cameras) that focus on public roads and the interior of the houses of other neighbors, controlling at all times the entrances/exits of apartment number 26 as shown in the documents attached to this claim” (folio No. 1). The art. 5.1 c) RGPD provides the following: The personal data will be: “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"). It should be remembered that individuals are responsible for ensuring that the systems installed comply with current legislation, proving that it complies with all the requirements demanded by the regulations in force. The installation of this type of device must have the mandatory sign informative, indicating the purposes and responsible for the treatment in your case of the data of a personal nature. In any case, the cameras must be oriented towards the particular space, avoiding intimidating neighboring neighbors with this type of device, as well as control traffic areas of the same without just cause. Also with this type of device it is not possible to obtain image(s) of space public, as this is the exclusive competence of the Security Forces and Bodies of the Condition. It should be remembered that even in the case of a "simulated" camera, the same should preferably be oriented towards private space, since it is considered that this type of device can affect the privacy of third parties, which are seen intimidated by it in the belief of being the subject of permanent recording. On the part of individuals, it is not possible to install devices for obtaining images of public space and/or transit of third parties, outside the cases allowed in the normative. The purpose of this type of device must be the security of the property and of its inhabitants, avoiding the affectation of rights of third parties that are seen intimidated by them. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/7 III On 07/21/22, a written statement of allegations from the respondent was received, expressed in essence that the system conforms to current legislation, being the same duly informed by means of an informative poster in this regard. In support of his argument, he provides documentary evidence that proves the orientation of the camera and the presence of an informative poster where the information about the presence of it. Examining the photographs provided, an excessive uptake of public space close to the area of his private property in the two chambers installed, with which the capture made is considered disproportionate. In the case of the camera oriented towards the “garage” area, it is enough to limit the space towards the door area and a small portion of public space, while in the case of the camera on the facade of the property, it should be limited to private space of the same, avoiding through the masking affect the area traffic nearby. It should be remembered that the installation of this type of device by individuals must be carried out in strict compliance with the current legal framework, especially when he had already been warned by this body, for some facts similar that had involved an analysis of the requirements in terms of video- surveillance. The intended purpose of the system is perfectly compatible with the limitation of the angle of the cameras towards their exclusive private area, so that the impact towards the traffic zone next to the property is minimized (eg. contributing new images to this organism). Any action that may involve a criminal act on the property of the claimed party is fulfilled with the exclusive capture of his private property, for example by obtaining images of the access area, being unnecessary a control of the transit area near the house. The claimed party must answer about all the cameras installed in especially those located in a transit area on a facade of the house (Doc. nº 1 Written claim) on which he omits any comment, which was clearly facing public transit area. The known facts constitute an infraction, attributable to the party claimed, for violation of the content of art. 5.1 c) RGPD, as they are the same disproportionately directed towards public and/or private space of third parties. IV C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/7 The art. 83.5 RGPD provides the following: “Infringements of the provisions following will be sanctioned, in accordance with section 2, with administrative fines EUR 20,000,000 maximum or, in the case of a company, an amount equivalent to a maximum of 4% of the total global annual turnover of the previous financial year, opting for the highest amount: a) The basic principles for the treatment including the conditions for the consent under articles 5,6,7 and 9 (...)”. In the present case, it is taken into account that it is an individual, although the same was already warned by this body (***PROCEDURE.1) of the need to report the presence of video-surveillance cameras, so it must be aware of the requirements made, being a system that is affecting areas that exceed their private space, reason that justifies imposing a sanction €1,000 for violation of art. 5.1 c) RGPD, by having a camera system oriented towards public and/or private space without just cause, sanction located in the lower scale for this type of behavior, but taking into account the negligent conduct of the defendant. SAW The text of the resolution establishes the infractions committed and the facts that have given rise to the violation of the regulations for the protection of data, from which it is clearly inferred what measures to adopt, without prejudice that the type of specific procedures, mechanisms or instruments for implement them corresponds to the sanctioned party, since it is responsible for the treatment who fully knows your organization and has to decide, based on the proactive responsibility and risk approach, how to comply with the RGPD and the LOPDGDD. Therefore, in accordance with the applicable legislation and having assessed the criteria for graduation of sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE B.B.B., with NIF ***NIF.1, for an infraction of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of €1,000 (one thousand euros). SECOND: ORDER compliance within ONE MONTH of the following corrective measures, in accordance with article 58.2 RGPD: -Proceed to mask the cameras so that space is not captured any public, limited to their private property. -Removal of any camera that affects the transit area, accrediting such before this Agency through documentary evidence (eg photography). THIRD: NOTIFY this resolution to Don B.B.B.. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/7 FOURTH: Warn the sanctioned party that he must make the imposed sanction effective once Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common Public Administrations (hereinafter LPACAP), within the payment term voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, through its entry, indicating the NIF of the sanctioned and the number of procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened on behalf of the Agency Spanish Department of Data Protection in the banking entity CAIXABANK, S.A.. In case Otherwise, it will be collected in the executive period. Received the notification and once executed, if the date of execution is between the 1st and 15th of each month, both inclusive, the term to make the payment voluntary will be until the 20th day of the following month or immediately after, and if between the 16th and last day of each month, both inclusive, the payment term It will be until the 5th of the second following month or immediately after. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from counting from the day following the notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following the notification of this act, as provided in article 46.1 of the aforementioned Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the firm resolution in administrative proceedings if the The interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact by writing addressed to the Spanish Agency for Data Protection, presenting it through Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica- web/], or through any of the other registers provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the documentation proving the effective filing of the contentious appeal- administrative. If the Agency was not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would end the precautionary suspension. 938-120722 Sea Spain Marti Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es