| AEPD - PS-00436-2021 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 13(1) GDPR Article 13(2) GDPR Article 12 GDPR Article 22.4 LOPDGDD (Processing for video surveillance purposes) Article 28 (Responsibility) Spanish Law on the Common Administrative Procedure of Public Administrations |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 21.04.2021 |
| Decided: | |
| Published: | 28.06.2022 |
| Fine: | n/a |
| Parties: | A.A.A. (Complainant) B.B.B. (Controller, Local Pub) |
| National Case Number/Name: | PS-00436-2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | MW |
The Spanish DPA declined to sanction a local pub for failing to post signage warning of video surveillance. The pub's signs had been stolen and replaced at least three times, including once on the same day the complaint was filed.
English Summary
Facts
The controller was a local pub with surveillance cameras on its exterior. The complainant alleged that the controller had these cameras installed for "many months" without putting up signs that warned passersby and disclosed the contact details of the controller. The controller had been the subject of previous claims for the same alleged violation.
The controller responded that the complaint was filed by the same neighbor who had filed the first complaint, and it was filed the same day their GDPR-compliant signs had been stolen. The signs had been stolen three times. Because of the minimal value of the signs (roughly €7), the controller had not filed a police report, but they provided invoices from the copy shop where they had replacements printed.
Holding
The DPA noted that, in cases of video surveillance, Article 22.4 LOPDGDD provides that the duty of disclosure in Article 12 GDPR may be fulfilled by placing a sign near surveillance cameras that identifies the existence of data processing, the identity of the controller, and the possibility of exercising the rights forseen in Articles 15 to 22 GDPR. Failure to provide this information constitutes a "serious infraction" per Article 83.5 GDPR.
However, the DPA held that the controller could not be sanctioned per Article 28.1 of Law 40/2015, of October 1, on the Regime Legal of the Public Sector (Responsibility), which requires that only parties responsible for an adiminstrative infraction by way of fraud or negligence be subject to sanction. The DPA reasoned that because the controller had failed to comply only as a result of repeated acts of vandalism and had quickly acted to remedy the infraction after each incident, there was no fraud or negligence on the part of the controller.
Comment
This case is the result of either a series of improbable coincidences or a very creative and motivated vandal.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7 File No.: PS/00436/2021 RESOLUTION OF PUNISHMENT PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On 04/21/2021, it had entry in this Spanish Agency of Data Protection a document presented by A.A.A. (hereinafter the part claimant), through which he makes a claim against B.B.B. (PUB ***PUB.1) with NIF ***NIF.1 (hereinafter, the claimed party), due to a possible breach of the provided in the data protection regulations. The claim indicates the following, in relation to the data protection regulations Personal data: “The local Pub ***PUB.1 located on the street..., has installed two security cameras surveillance on the facade of the building for many months. not on the facade It has no sign that warns of the installation of the cameras on public roads. [...] Together with the claim, it provides two photographs dated March 4 and April 8 and 9, 2021 where you can see that in the upper part of the facade of the establishment there are two cameras. SECOND: These facts have already been the subject of a claim before this Agency, processing file E/05824/2020 and, subsequently, PS/00353/2020 in the that the file of actions was determined when the claimed person accredited the existence of Informative posters at the entrance of the access door to the premises. Prior to admitting this claim for processing, the Agency requested the requested to provide, on the one hand, current photographs of the poster or posters information on the video-monitored area and their location, both on the facade outside as elsewhere; and, on the other hand, a responsible declaration in which manifest the existence of the aforementioned cartels. The request for information was notified on 06/15/2021, as stated in the Delivery Notice issued by Correos, without this Agency having received any reply. Subsequently, it proceeded to reiterate the request for information and was notified on 07/22/2021, but no response has been received from the respondent. THIRD: On 08/26/2021, the Director of the Spanish Protection Agency Data agreed to admit the claim filed by the claimant for processing. FOURTH: On 11/15/2021, the Director of the Spanish Protection Agency of Data agreed to initiate a sanctioning procedure against the claimed party, in accordance with C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/7 the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of article 13 of the RGPD, typified in article 83.5 of the GDPR. FIFTH: Having been notified of the aforementioned initiation agreement, the party complained against submitted a written pleadings in which, in summary, it stated that: ““Coincidentally” he reported us the day after (or a few days) after we have stolen the posters from the street cameras. We have several more robberies, this It is the third time in a year that the posters are ripped from the facade. The first signs were installed from February 19, 2020 (...). Then we have made copies and we have installed them on 3 more occasions, coinciding with the theft of the same. Although the exterior information signs are stolen, there is a general poster of cameras of the alarm company, an informative poster nothing more go through the front door, and two others inside (...). The installation consists of 4 informative video surveillance posters (two external, plus the entrance and another internal), one of general information of the company of video surveillance. In addition, it consists of 6 cameras, and a single mobile phone of the owner to view the images. [...] The cameras that focus on the entrance, have informative posters on both sides of the facade, except when they are stolen from us, and the sign on the front door, so that from any direction of the street from which you access the area video surveillance, you receive information in advance (...). The installation map and photographs of posters and cameras; was already provided as document nº1 to the previous file, so we understand that it does not make sense send documents that are already in the possession of this administration. [...] The value of two video surveillance posters is minimal, and for this reason we have not denounced on previous occasions (...), and this time we are going to report it to the police and contribute the complaint. We have told them that there have been three robberies: - The first on the date of the complaint, which we will credit with the invoices of the copy shop that we attach. - The second right now, which we will prove with the complaint and the bills of the copy shop - There was another robbery, but we replaced the posters with several that the police brought us. data protection company. [...] C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/7 Provide the following documentation: - Two invoices from the copy shop dated 04/21/2021 and 12/02/2021, for the purchase of two video surveillance posters in each of them for a value of €7 each a. - A copy of the complaint filed by the respondent on 12/16/2021 in the which indicates, in summary, that between 04/19/2021 and 11/30/2021, at the PUB ***PUB.1, “Unknown person(s) have stolen him from the facade of the premises two posters announcing the area monitored by security cameras video surveillance." SIXTH: On 01/21/2022 the instructor of the procedure agreed to open a period practice tests, taking into account the previous actions of investigation, E/05768/2021, as well as the documents provided by the respondent in date 12/16/2021. SEVENTH: On 01/24/2022, a resolution proposal was formulated in which proposed to sanction the defendant with a fine of €1,500, for the infraction of the article 13 of the RGPD, since at the time of the claim it did not have Informative posters of the video-surveillance area on the facade of the PUB ***PUB.1. Likewise, in accordance with article 58.2.d) of the RGPD, the claimed party was ordered to proceed to place the corresponding signs outside the premises. EIGHTH: The respondent submitted a brief of allegations to the proposed resolution on 02/09/2022 where it states the following: “[...] In our letter we reiterated that although the posters were stolen exterior information, there is a general poster of cameras of the company of alarms, an information poster as soon as you walk through the front door, and another two on inside. [...] The cameras do not record, they only view, and that there is always company signage of vigilance. [...] At the time of making the first allegations, we contacted by telephone with the Agency, to show our maximum willingness to collaborate (...) That the neighbor is the same one who denounced us in the first instance and what underlies is a problem about the inconvenience generated by the activity. [...] C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/7 The first posters were installed on February 19, 2020, the day the company visited us, prior to installation and opening. How do we tell them? in the previous arguments. There has always been regulatory compliance. There are always posters that can be seen from the outside when the blind is raised, and before accessing the video surveillance area. [...]” Attach the following documentation: - Photographs where the location of the information posters of the area is observed video surveillance. It has placed two new badges on the facade of the premises. - A plan of the establishment in which it indicates where the cameras, posters and monitored areas. - Capture of the log of calls made to this Agency on 12/02/2021 and 02/08/2022. - A sworn statement signed by the respondent stating that “You have the Video Surveillance Signage installed in your establishment, always replace any missing signs before reopening; Of the actions carried out in this procedure and the documentation in the file, the following have been accredited: PROVEN FACTS FIRST: Existence of a video surveillance system installed in the PUB ***PUB.1 located in CALLE ***DIRIMIENTO.1 and made up of 6 chambers. two of the cameras are placed on the facade of the premises, without the mandatory sign informative video surveillance area in the same. This end is accredited by photographs provided by the claimant dated 4 of March and April 8 and 9, 2021 in which it is observed that there are effectively no on the facade of the property the aforementioned distinctive. Also, attach a copy of complaint in which it states that on 04/09/2021, the PUB ***PUB.1 "on the facade does not It has no sign that warns of the installation of the cameras on public roads. SECOND: It is identified as the main person in charge of the B.B.B. with NIF ***NIF.1. THIRD: In the allegations to the opening agreement, the respondent states that in the facade of the premises there were two informative posters, as can be seen in the photographs that he provided in PS/00353/2020 and in which the file of performances, but they have been stolen on several occasions. brings diverse supporting documentation, including an affidavit. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/7 FOURTH: The placement of two new posters on the façade of the local PUB ***PUB.1 as of 02/08/2022. FOUNDATIONS OF LAW Yo In accordance with article 58.2 of the RGPD and as established in articles 47 and 48.1 of Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee of digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve this procedure the Director of the Agency Spanish Data Protection. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Agency for Data Protection will be governed by the provisions in Regulation (EU) 2016/679, in this organic law, by the provisions regulations issued in its development and, as long as they do not contradict them, with a subsidiary, by the general rules on administrative procedures.” II In the present case, it is appropriate to examine the claim dated 04/21/2021 filed in this Agency in which the absence of an informative poster of video-surveillance area on the facade of the PUB ***PUB.1 located on CALLE ***ADDRESS.1, when there are two video surveillance cameras installed in it. Article 13 of the RGPD, sections 1 and 2, establishes the information that must be provided to the interested party at the time of collecting their data. In the case of treatments of personal data for surveillance purposes through camera systems or video cameras, the duty of information can be fulfilled by placing, in the video-monitored areas, an informative badge located in a sufficiently visible, both in open and closed spaces, and using forms in the that the planned information is detailed, which the person in charge must make available of those interested. In this sense, article 22.4 of the LOPDGDD provides that: “The duty of information provided for in article 12 of Regulation (EU) 2016/679 is understood fulfilled by placing an informative device instead sufficiently visible identifying, at least, the existence of the treatment, the identity of the person in charge and the possibility of exercising the rights foreseen in the Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the informative device a connection code or internet address to this information." This infringement is typified in article 83.5 of the RGPD: “The infractions of the following dispositions will be sanctioned, in accordance with the section 2, with administrative fines of a maximum of EUR 20,000,000 or, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/7 in the case of a company, an amount equivalent to 4% of the turnover global annual total of the previous financial year, choosing the highest amount: a) The basic principles for the treatment, including the conditions for the consent under articles 5, 6, 7 and 9; (...) For the purposes of the limitation period of the infraction, it is considered very serious and prescribes after three years, in accordance with article 72.1 of the LOPDGDD, which establishes that: a) The processing of personal data violating the principles and guarantees established in article 5 of Regulation (EU) 2016/679; (...) III On 02/09/2022, a written statement of allegations to the proposed resolution was received by the party claimed providing photographs dated 02/08/2022 in which two Informative posters of the video-monitored area on the facade of the PUB “***PUB.1”. Although it is true that at the time of the start of this sanctioning procedure there were no signs indicating the video surveillance system installed on the facade of the establishment, we are faced with an assumption of exemption from liability, in accordance with article 28 of Law 40/2015, of October 1, on the Regime Legal of the Public Sector. This precept enshrines one of the principles of sanctioning power, the “Responsibility”, by virtue of which “1. They can only be sanctioned for acts constituting an administrative infraction, natural persons and legal, as well as, when a Law recognizes them capacity to act, the groups affected, unions and entities without legal personality and assets independent or autonomous, who are responsible for them by way of fraud or guilt”. Analyzing the file as a whole, it can be seen that there is no fraud or negligence in the conduct of the defendant since it has been sufficiently proven (invoices, denounces, among others) that every time the informative posters of the zone under video surveillance, puts them back. Therefore, according to the above, The Director of the Spanish Data Protection Agency RESOLVES: FIRST: ORDER the FILE of this procedure due to the absence of culpability in the defendant's conduct. SECOND: NOTIFY this resolution to the claimant and the respondent. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/7 In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from counting from the day following the notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following the notification of this act, as provided in article 46.1 of the aforementioned Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the firm resolution in administrative proceedings if the The interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact by writing addressed to the Spanish Agency for Data Protection, presenting it through Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica- web/], or through any of the other registers provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the documentation proving the effective filing of the contentious appeal- administrative. If the Agency was not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would end the precautionary suspension. 938-270122 Sea Spain Marti Director of the Spanish Data Protection Agency
