AEPD (Spain) - PS/00003/2020

From GDPRhub
AEPD - PS/00003/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(c) GDPR
Article 83(5) GDPR
Article 22 LOPDGDD
Type: Investigation
Outcome: Violation Found
Started:
Decided: 26.10.2020
Published: 26.10.2020
Fine: 5000 EUR
Parties: n/a
National Case Number/Name: PS/00003/2020
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: Francesc Julve Falcó

The Spanish DPA (AEPD) imposed a fine of €5000 on a betting company because its installation of cameras did not comply with Article 5(1)(c) GDPR.

English Summary

Facts

On October 16th 2019, due to complaints from neighbours about the cameras facing the public space, the local police came to check the content of the recordings, but they were not allowed access to the images.

On December 18th 2019, the AEPD informed the company of the complaint and requested more information regarding the video surveillance system.

PLAY ORENES S.L. invoked article 22 LOPDGDD, which allows the capture of images of the public highway, in some cases, with the aim of preserving the security of people and goods.

From the inspection of the frames taken from the system's viewing monitor, which through 4 cameras facing the outside, it was verified that the entire width of the street was captured, as well as the vehicles parked.

It is also recorded as a proven fact that the claimant removed 3 of the 4 cameras facing outwards, following the claim. However, a camera has been maintained which captures images of the street and the parked vehicles.

Dispute

Must video surveillance installations that record images of public space respect Article 5 (1) (c) GDPR?

Holding

The AEPD held that the installation of a video surveillance system under Article 22 LOPDGDD must always comply with the principle of minimization of data, set out in Article 5 (1) (c) GDPR.

The aggravating circumstance taken into account was: the intentionality or negligence of the infringement (Art. 83 (2) (b) GDPR); while as mitigating circumstances: the adoption of measures taken by the person responsible to mitigate the damage (Article 83 (2) (c) GDPR), collaboration with the Agency in responding to the complaint (Article 83 (2) (f) GDPR), not linking the activity of the offender to the processing of personal data (Article 76 (2) (b) LOPDGD), the non-existence of profits obtained as a result of the infringement (Article 76 (2) (c) LOPDGDD and, having the figure of the data protection delegate even though it is not obligatory for the company (Article 76 (2) (g) LOPDGDD).

Furthermore, the AEPD requested the company in question to prove that it had removed the camera that still recorded images of the street, in accordance with Article 58(2)(d) GDPR.

Comment

The company PLAY ORENES S.L. made use of the reduction of 20% of the amount of the sanction, proceeding to the voluntary payment so that the amount was reduced to EUR 4000.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                            1/19











     Procedure Nº: PS / 00003/2020

RESOLUTION R / 00522/2020 OF TERMINATION OF THE PROCEDURE BY PAYMENT
                                   VOLUNTARY


In the sanctioning procedure PS / 00003/2020, instructed by the Spanish Agency for
Data Protection to PLAY ORENES, S.L., considering the claim presented by
CITY COUNCIL OF *** LOCALITY. 1, and based on the following,



                                 BACKGROUND

FIRST: On March 12, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning procedure to PLAY ORENES, S.L ..
The initiation agreement has been notified and after analyzing the allegations presented, dated

September 29, 2020, the resolution proposal was issued that follows
transcribe:

<<



Procedure number: PS / 00003/2020
926-300320

       Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following:


                                 BACKGROUND


FIRST: On October 16, 2019, you entered this Spanish Agency

of Data Protection a letter presented by CITY OF
*** LOCALITY. 1 (hereinafter, the claimant), through which it formulates
claim against PLAY ORENES, S.L. with NIF B73002099 (hereinafter, the

claimed), for the installation of a video surveillance system installed in STREET
*** ADDRESS.1, with respect to which there are indications of a possible breach of the

provided in the data protection regulations.

       The reasons that support the claim are the following:


       «That different residents of this town have repeatedly stated before
this City Council that the company Play Orenes S.L.U, with NIF B73002099, company

dedicated to sports betting, has installed in its premises located in *** LOCALIDAD.1,
Calle *** ADDRESS. 1, video surveillance cameras that due to their positioning and

characteristics seem to be covering an important part of the public road, more


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/19








beyond the strict access that by monitoring the facade of the building could
considered adequate.


       Faced with this situation, and after assessing the situation with the Municipal Police,
decided to go to check this point at said local, in order to confirm the

existence of privacy masks. In person at the premises, on August 9,
We were not allowed access to the images, for which purpose a record of the
municipal police of the date. "


SECOND: Prior to the admission for processing of this claim, a

transferred the claimed, in accordance with the provisions of article 65.4 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD), being notified on 11/21/2019.

On 12/18/2019 he had a written reply entry from the complained in which he states
what:


       «[…] 4. Number and characteristics of the cameras. In the case of
       fictitious cameras must provide the invoice, purchase receipt or any other
       document that serves to prove that they are fictitious.

       The aforementioned establishment has a total of 16 CCTV cameras. In
       As for fictitious cameras, inform that the establishment does not have

       none of them. (See ANNEX Nº1: Installation sketch and quadrant of
       camera shots).


       5. Scope of the cameras and places where they are installed, proving
       by means of photography of the images captured by the cameras, as
       displayed on the monitor or equivalent system, that the space of

       capture so as not to affect adjoining land and homes, public roads or
       any other foreign or reserved space.


       Of the four cameras that the establishment has oriented towards the
       access points, indicate that one of them is installed inside the
       establishment and the other three on the façade focusing only on the two

       pedestrian accesses and minimally the public road as you can see
       in the attached frames, dated 2.019-11-25 / 17: 14 hours.


       6. Indicate the conservation period of the registered images.


       The term of conservation of the images of the recorder is of 19 days;
       maximum programmed capacity depending on the quality and number of cameras
       that this recorder supports.





C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/19








       In our Privacy Policy regarding Video Surveillance of all
       Centro de Play Orenes, S.L., it is determined that the images will be kept

       a maximum period of 30 days.

       (See ANNEX No. 2: Privacy Policy for video surveillance)


       7. Any other information that you consider of interest to assess the
       adaptation of the installation of video surveillance cameras to the regulations

       of data protection.


               It should be noted that, on the part of our Security Department,
       so far this year a total of 760 Police Trades have been processed,
       received from both the National Police Corps and the Civil Guard. In large

       part of said requests, were aimed at interests unrelated to this
       Company, and if in favor of Citizen Security. Make mention of, that, in
       These requests for collaboration have required us to provide the

       images captured by the exterior cameras accesses of the different
       establishments, being able to clarify how it can be accredited, numerous
       criminal acts investigated by police units throughout Spain in

       for the safety of citizens.


               With regard to data protection, I attach the description of the
       treatment, as well as their impact assessments describing the measures
       technical and organizational that are part of the treatment, as well as the

       different risk analyzes carried out on it.
       (See ANNEX No. 3: Registration of treatment activities: Video surveillance)

       (See ANNEX Nº4: Basic risk analysis: Video surveillance)


       (See ANNEX No. 5. Risk analysis and need for DPIA: Video surveillance). »


THIRD: The claim was admitted for processing by resolution of January 8
2020.


FOURTH: On March 12, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure for the claimed party, with
in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in the

Article 83.5 of the RGPD.

FIFTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written
allegations in which it shows that:


       «[…] FIRST.- Of the nullity of the procedure.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/19








       It is manifested in the antecedents of the notified resolution that by this
       Administration, prior to the admission for processing of the claim
       that has given rise to the present sanctioning procedure, was transferred to

       PLAY ORENES S.L. of the existing claim- filed by the
       City Council- and this in accordance with the provisions of article 65.4 of the
       Organic Law 3/2018, of December 5, Protection of Personal Data and
       guarantee of digital rights (hereinafter LOPDGDD), being
       notified such claim on 11/21/2019:


        Well, the truth and truth is that Play has never been notified
       ORENES SL any claim, and only on the date indicated
       (11/21/2019) we were sent a "request for information" (CVS:
       *** CVS.1), a copy of which is attached as document number 1:


       In response to that request for information - and not to any claim-,
       this company filed a reply on 12/18/2019, whose
       copy is attached as document nº2.

       Therefore, PLAY ORENES has never had knowledge of a claim
       any regarding the cameras installed in your establishment nor therefore

       he has been able to make any allegation in his defense.

       In view of the foregoing, it is evident that this Administration has not acted, such as
       and as indicated, in accordance with article 65.4 of the LOPDGDD,
       violating the right of defense of my client, who has seen how

       respond to a request for information, a procedure has been initiated
       sanctioner based on a claim for which he has not even had
       knowledge or ability to defend oneself.

       In this sense, the jurisprudence of the Third Chamber of the Supreme Court has

       declared that no one can be condemned without being heard (Sentences, among
       others, of November 30, 1995, November 5, 2001, June 17,
       2002 and June 28, 2002), finding the nullity of the act from which it derives
       this defenselessness justified in the fact that my client has not been
       given the opportunity to make their own arguments and to use
       the pertinent means of proof for the defense of their rights and interests

       legitimate protected by the article. 24.1. of the Spanish Constitution.

       Serve in this regard the Judgments of the Constitutional Court numbers 31/1984,
       48/1984, 70/1984, 48/1986, 155/1988 and 58/1989: […]


       For all of the above we understand that this file does not conform to the
       legally established procedure since it has not been
       compliance with article 65. 4 LOPDGDD and this despite the fact that this
       Administration reiterates on several occasions -at the initiation of this
       sanctioner - that it has proceeded to do so.


       It is enough for this Administration to check its registration and content of the
       telematic notification on its day made (11/21/2019) to check what


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/19








       this company defends: it only moved to PLAY ORENES S.L. A request of
       information.


       The agreement to initiate this sanctioning procedure includes in its
       factual background FIRST, SECOND and THIRD the processing of
       a prior file in accordance with the aforementioned article 65 LOPDGDD,
       admission to processing of a claim from a third party and after that it understands that
       this sanctioning procedure must be initiated.


       However, this is not true and therefore the resolution that initiates this
       sanctioning file nor the previous file do not adjust to the reality of
       the facts or article 65 LOPDGDD.

       Therefore, it is in accordance with the law that the agreement of

       initiation of the notified sanctioning procedure, proceeding to file the
       procedure, since it brings cause of a previous file that is not
       complies with the legally established procedure (article 65 and related),
       consequently suffering from a defect of nullity or failing that
       voidability ex article 47 and 48 of Law 39/2015, of October 1.


       SECOND.- Compliance with the exception established by article 22 of
       the LOPDGDD

       This Administration states that the claim that has given rise to the
       present procedure - to insist that we were never notified - is based on the

       "Alleged illegality of the installation by my client of a system
       surveillance system, composed of four cameras located in the premises located in
       CALLE *** ADDRESS. 1, which could capture images of the public thoroughfare of
       disproportionately, capturing not only the entire width of the sidewalk (if
       well it is narrow) (in all of them) but also to parked vehicles

       adjoining it (in two of those installed on the façade) ”.

       In this sense, it is worth recalling article 22 of the LOPDGDD, which establishes the
       next:
       "1. Individuals or legal entities, public or private, may carry out the
       image processing through camera or video camera systems with

       the purpose of preserving the safety of people and property, as well as
       your instalations.

       2. Images of public roads may only be captured to the extent that
       it is essential for the purpose mentioned in the previous section.


       However, it will be possible to capture the public road in an extension
       when necessary to guarantee the safety of goods or
       strategic facilities or infrastructure related to transport, without
       that in no case may involve the capture of images inside a

       private address. "

       Well, due to the nature of the business of this company and following the
       indications of the LOPD, my represented conforms to the exception

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/19








       contemplated by article 22 that allows the recording of a minimum portion
       of the public thoroughfare whenever it is essential to guarantee the purpose
       of security.


       It serves as a justification, that on some occasions and due to the design of
       the public thoroughfare, when cameras are installed on the façade,
       these minimally or partially capture the sidewalks, since they are not
       few occasions that criminals take advantage of parked vehicles
       at the entrance of the establishment to hide and rob or assault

       our employees and customers at the entrance or exit of the establishment. In
       In this sense, it should be remembered that we are facing an establishment that combines
       the hospitality industry and the gaming industry, being necessary to collect almost
       daily of the machines installed in it causing the personnel of
       collection - and even clients - are or may be the object of robberies to their

       departure. That is why compliance with the security purpose of the
       cameras requires a plus or reinforcement always within the allowed margins
       by article 22.

       In proof of the foregoing, it is attached as document No. 3,
       report from the security department of my client where it is justified

       the need to guarantee the security of the establishment through
       placement of certain cameras and their compliance with the
       legally required measures.

       As indicated in the attached report, the implementation of the

       Security in each establishment is the decision of the security department
       in collaboration with the data protection officer of the Orenes Group,
       thus guaranteeing compliance with legal requirements in both areas
       normative. It is a decision that responds to technical and specialized criteria,
       measuring in any case the scope of the exception regulated in article 22.


       THIRD.- Disproportionality of the sanction

       In a subsidiary manner, and in the event that this Administration
       the commission of some type of infraction by this company will be appreciated,
       the disproportionality of a penalty of 20,000 euros would be flagrant, the

       which is absolutely disproportionate and devoid of all motivation, resulting
       be arbitrary.

       This Administration does not justify the reasons that support the seriousness of
       such sanction, taking into account that:


       - No claim of any kind was ever notified - preventing my
       represented to be able to exercise their right of defense-

       - There is no recidivism


       For this reason, the principle of proportionality established by the
       Article 29.3 of Law 40/2015 of October 1, on the Legal Regime of the
       Public Sector, which provides that, in the imposition of sanctions, the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/19








       Public Administrations must observe the due suitability and necessity
       of the sanction to be imposed, and its adaptation to the seriousness of the constitutive act
       of the offense; operating for graduation guilt, intentionality,
       persistence, damages caused, or recidivism. In this sense,
       warn this Administration that it is not appropriate to try to justify the

       graduation and severity of the sanction proposed here, bringing up the
       existence of 16 files - which, as indicated, are of a non-existent nature
       sanctioning - related to video surveillance systems installed in
       establishments owned by my client.

       - Absolute good faith for my client. If the above is not enough, we

       we find that the present procedure comes from the answer
       exhaustive on the part of my client of a request for information, the
       which and surprisingly, according to this Administration, it was about
       a claim (See document nº1).


       It would not be idle to recall that the principle of proportionality performs,
       in the field of Administrative Penalty Law, a capital role and this does not
       only as an expression of some abstract powers of application of the Law
       in terms of equity, but because of the concrete fact that sanctions against
       impose are defined in our ordinance, generally, of
       extremely flexible way, in such a way that the same behavior can

       deserve the imposition of very diverse sanctions and that move in
       very wide margins and that, for the same reason, can result, in practice,
       extraordinarily diverse amount and period. The principle of
       proportionality imposes that since the sanctioning activity of the
       I administer a discretionary activity, but a typically activity
       legal or application of the rules, (as recognized by our Court

       Supreme Court in Judgments of December 23, 1981 [RJ 1981, 5453], December 3,
       February 1984 [RJ 1984, 1027] and April 19, 1985 [RJ 1985, 1716]), the
       factors that must govern its application depend on what is available
       the Legal System in each sector in particular and, very especially, in
       the concurrent circumstances.


       The Supreme Court has declared in its Judgment of July 29, 2014
       (Contentious-Administrative Chamber, Section 1), regarding the principle of
       proportionality, which:

       "The principle of proportionality plays, in the field of Law
       Administrative Penalty, a capital role and this not only in terms of expression

       of some abstract powers of application of the Law in terms of equity,
       but because of the concrete fact that the sanctions to be imposed are found
       defined in our system, in general, in a highly
       flexible, in such a way that the same conduct may merit the imposition of
       very diverse sanctions and that move in very wide margins and that, for

       the same, they can result, in practice, of amount and period
       extraordinarily diverse. The principle of proportionality requires that the
       not being the sanctioning activity of the Administration an activity
       discretionary, but a typically legal activity or application of the
       norms, (as recognized by our Supreme Court in Judgments of 23

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/19








       December 1981 [RJ 1981, 5453], February 3, 1984 [RJ 1984, 1027] and
       April 19, 1985 [RJ 1985, 1716]), the factors that must preside over its
       application are based on the provisions of the Legal System in

       each sector in particular and, very especially, in the circumstances
       concurrent. "

       It should be remembered, as the Sentence of the Supreme Court of the Balearic Islands refers,
       Contentious-Administrative Chamber, Section 1, of July 25, 2006, which:
       “The Constitution, which has recognized the legitimacy of sanctions

       administrative, has taken good care to underline the regulated nature of the
       sanctioning power of the Administration: not that the Administration has
       "Freedom" to choose between different solutions, but equally fair
       - legally indifferent-. All the actions of the Administration in the
       sanctioning ground is therefore regulated. "


       It is evident that in the present case there are no circumstances that
       justify the imposition of such a serious sanction and perhaps for that reason
       motivate for this Administration
       .
       Be that as it may, and despite not having an express requirement on the part of this

       Administration, in order to demonstrate the good faith of my client,
       states that he proceeded to withdraw the outer chambers of the
       establishment, as evidenced by document no. 4. […] '.

       The report issued by D.A.A.A. ,, member of the Department of Security and

responsible for the Treatment of images of the establishments of the Orenes Group,
attached as document No. 3 indicates, fundamentally, that the company is
complies with the data protection regulations in the installation of its
video surveillance being sometimes necessary to capture a minimum portion of the track
to guarantee the safety of goods and people, that the Forces and Corps

Security have required your contribution of images for the investigation of
criminal acts, that Madrid stands as the area with the highest crime rate
crimes that affect customers and employees and that for technical reasons, is not
It is possible to redirect the capture angle of the installed cameras.

SIXTH: On 09/03/2020, the procedure instructor agreed to open the

a period of testing, being considered reproduced, for evidentiary purposes
the claim filed by the claimant, the data obtained and generated by the
Subdirectorate General for Data Inspection and the allegations presented by the
reclaimed.


SEVENTH: A list of documents in the document is attached as an annex.
process.


       Of the actions carried out in this procedure and of the

documentation in the file, the following have been accredited:



                                PROVEN FACTS
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/19











FIRST: Existence of a video surveillance system installed in a
gambling establishment located in CALLE *** ADDRESS. 1, composed of 16 cameras,
4 of them facing the outside (3 located on the facades and 1 on the porch of the
entrance access) as reflected in the content of the writing and the photographs
that accompany the answer made by the claimed to the prior transfer of the

claim filed. It is credited, through the frames taken from the monitor
system viewing and provided by the claimant, who, through the
mentioned 4 cameras facing outwards, the entire width of the
sidewalk (although narrow), as well as the vehicles parked in 2 of them.


SECOND: The person in charge of the video surveillance system is PLAY ORENES S.L.

THIRD: The defendant has proceeded to the withdrawal of 3 of the 4 oriented cameras
towards the outside (specifically the 3 installed on the facades), as
accredits in the photographs that accompany the letter, allegations to the agreement of
start, presented on June 11, 2020.



                           FOUNDATIONS OF LAW



                                           I

       The Director of the Agency is competent to resolve this procedure
Spanish Data Protection, in accordance with the provisions of art. 58.2 of
Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter

RGPD and in art. 47 and 48.1 of LOPDGDD.


                                           II

       In the present case, it is appropriate to examine the claim presented by the

*** Town Hall of LOCALIDAD.1 on October 16, 2019 in which the
installation of a video surveillance system in a PLAY ORENES establishment

S.L. located in the street *** ADDRESS.1 of the town that «that by its
positioning and characteristics seem to be covering an important part of the
public road, beyond the strict access than by the surveillance of the facade of the

real estate could be considered adequate ”.



       Article 5.1.c) of the RGPD provides that personal data will be

«Adequate, relevant and limited to what is necessary in relation to the purposes for which
that are processed (“data minimization”). »




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/19








        This offense is classified in Article 83.5 of the RGPD:


        «Infringements of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the

total annual global business volume of the previous financial year, opting for
the highest amount:


        a) the basic principles for the treatment, including the conditions for the

            consent in accordance with articles 5, 6, 7 and 9;

        b) the rights of the interested parties in accordance with articles 12 to 22; […]. »



        For the purposes of the statute of limitations of the offense, it is considered very
serious and prescribes after three years, in accordance with article 72.1 of the LOPDGDD, that
states that:


        "In accordance with the provisions of article 83.5 of Regulation (EU) 2016/679
are considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:



        a) The processing of personal data violating the principles and guarantees
            established in article 5 of Regulation (EU) 2016/679.






























C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/19








                                            III

       In accordance with the evidence available in the present

sanctioning procedure, it is considered that the defendant has established a system of
Poorly oriented video surveillance with regard to 4 outward-facing cameras. From
the aforementioned cameras 3 of them (those placed on the facades) have been removed,
as stated in the Third Proven Fact; presumably subsisting located in
the arcade of access to the premises, a camera that captures images not only of the entrance to the
establishment and a minimum of adjacent sidewalk, but also reaches in its

Approach the vehicles parked in front of the entrance.

       Regarding the allegations presented, it corresponds to make the following
considerations:


        Regarding the request for annulment of the procedure
       motivated by an alleged violation of the right of defense of the defendant
       considering that the claim has not been transferred, it should be noted, in
       First, that the transfer of the claim contained in article 65.4 of the
       LOPDGDD is configured as an optional procedure in the opinion of the Agency

       Spanish Data Protection Agency in an attempt to inform the
       responsible or in charge that said body has been sent some
       facts that could imply the violation of the regulations for the protection of
       data, and all this with the aim that by said person in charge or
       manager can provide information or justification that allows adopting

       a reasoned decision about whether or not to admit the claim or
       complaint and the subsequent official opening of an investigation file
       or a sanctioning procedure.

       In this process, the main thing is to provide the person in charge of the
       opportunity to defend oneself regarding the facts contained in the claim

       and this is what has been fulfilled in the present case with the letter sent on
       11/21/2019, where it is communicated to PLAY ORENES S.L. that «This Agency
       has been aware of the existence of video surveillance cameras
       located in CALLE *** DIRECCIÓN.1, which could be in breach of the
       data protection regulations […] For this reason, you are requested to, in the

       within a month from receipt of this letter, certify that the installation
       of the cameras is in accordance with the data protection regulations giving
       answer, at least, to the following points […] '. That is, although it has not
       given transfer of the claim in its entirety as such, if it has been requested
       information based on the facts that are related to the regulations

       of data protection duly identified. In this case, therefore, no
       defenselessness has occurred, since the defendant has had knowledge
       of the situation allegedly likely to violate the regulations of
       protection of data that the claimant has made known to the AEPD.

       The doctrine that the Constitutional Court has been maintaining in relation to

       defenselessness is that in order for it to be invoked it is necessary to
       It is a material defenselessness that implies that it has caused damage
       real and effective. (among others, SSTC 90/1988, 43/1989, STC, 105/1995, 118/1997,
       91/2004).

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/19












         In addition, it is necessary to point out that in this case what is requested is a

         answer to the AEPD and not that the person in charge or manager responds to who
         has filed the claim or complaint.




































































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/19










        Regarding the possibility, protected in article 22 of the

       LOPDGDD that, in order to guarantee the safety of people and
       goods, which enables the capture of public thoroughfares to the extent that it is
       It is essential to point out that, indeed, this possibility is collected for,
       taking into account section 1 of the aforementioned article «natural or legal persons,
       public or private ”.


       Now, the determining factor at this point, for a
       conjunction with the principle of data minimization stated in the article
       5.1.c) of the RGPD, is that it must be "to the extent that it is
       essential ”, which means that, if for security reasons it were
       necessary to capture public roads - a faculty that is generally attributed

       to the Security Forces and Bodies in accordance with the provisions of the
       Organic Law 4/1997 which regulates the use of video cameras by the
       Security Forces and Bodies in public places and their regulations on
       development — because it is the space adjacent to the property (access area or
       perimeter) this should be kept to a minimum; in the case of a sidewalk you can

       capture a portion of it in the part adjacent to that access or perimeter,
       but it will not be provided to capture the entire width of the same or
       reach parked cars so that passersby and motorists
       who park their vehicles are not unduly affected by their right to
       protection of the physical image ..


       The possibility of expanding the catchment of public roads established by the
       Article 22.2, refers to strategic assets or entities (having to understand
       these to those defined as such in the National Catalog of Infrastructures
       Strategic) or transport infrastructures, a category in which there is no
       find a business dedicated to gambling. Therefore, not belonging to

       business of the claimed to the category of good or strategic entity or
       transport infrastructure, must respect the criteria of minimum capture of
       the public highway, and this regardless of the area where the business is located
       (This aspect has resulted from a free and voluntary decision of the
       company), since an unequal application of the aforementioned criterion would entail

       unequal consideration (and therefore possible discrimination) in the
       rights of people who pass through a certain area with respect to
       those of others.

       Therefore, in accordance with the foregoing, the defendant is empowered to order

       of a video surveillance system facing outwards (and even located
       abroad) whose purpose is to guarantee the safety of the property, employees and
       clients, but taking into account that, in the event of needing to capture
       public thoroughfare, this capture must be limited to the essential minimum that
       it is located adjacent to the access and perimeter.







C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/19








        Regarding the allegation related to the
       disproportionality of the proposed financial sanction, it is necessary to bring
       collation what is collected in the agreement to initiate this procedure. In this
       initial agreement has not been collected at any time the aggravation of

       recidivism, but the concurrent circumstances considered for the purposes
       modulating the proposed sanction are: as aggravating factors, the intentionality or
       negligence in the infringement (article 83.2.b) RGPD) and the lack of measures
       taken by the person in charge or in charge of the treatment to alleviate the damages and
       damages suffered by the interested parties (article 83.2.c); as mitigating factors, the
       collaboration with this Agency in the heart of this procedure by having

       answered to the transfer of the claim (article 83.2.f) RGPD), non-existence
       that of linking the activity of the offender with the performance of treatments
       of personal data (article 76.2.b) LOPDGDD), non-existence of benefits
       obtained as a result of the commission of the offense (article 76.2.c)
       LOPDGDD) and have the figure of the data protection delegate not yet
       belonging to the set of entities obliged to have the aforementioned figure

       (article 76.2.g) LOPGDD).

       Regarding the mentioned aggravations, the motivation rests, as
       stated in the initiation agreement, in a previous existence of the report-complaint
       raised by the Civil Guard of *** LOCALIDAD.2 and that was presented before
       the AEPD on February 11, 2019 due to the existence of a system of

       video surveillance in the premises located at C / *** ADDRESS.1 (the same system as
       which is the object of this sanctioning procedure) that would violate the
       provided in the data protection regulations. On the 26th of the same month
       sent the defendant a communication informing him of this
       extreme, from where to consult the requirements in this regard and that, if not

       the necessary measures, it could be incurring a criminal offense
       in the data protection regulations that could initiate actions
       investigating and sanctioning. To this communication the defendant replied,
       March 26, 2019, that the system met the requirements.

       Well, of the facts that have motivated the present procedure

       sanctioner, it is evident that the defendant did not implement any
       measure in this regard that would have allowed him to check and, therefore, correct,
       the excessive recording of the public road that is included in the Proven Fact
       First.

       Likewise, the mention of the 16 non-sanctioning files opened to the

       claimed serves to influence the idea of lack of diligence of the claimed in the
       failure to review a policy for installing video surveillance systems
       that has been warned on those occasions from the AEPD about its possible
       lack of adaptation to data protection regulations.









C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/19








        Based on the foregoing, and taking into account that according to the latest accounts
        annual presented (2018 financial year) it is clear that the company had an
        net of turnover of € XXX. and had an average number of

        permanent employees of 317.28 and of non-permanent employees of 174.58 - which excludes
        of the definition of SMEs in accordance with Regulation (EU) No. 651/2014 of
        On June 17, 2014, the Commission considered it proportionate to propose a
        penalty of 20,000 euros.

        Now, taking into account that the defendant has proceeded to withdraw 3 of the

        4 cameras (those located on the facades) that captured public roads excessively,
        It is considered that the concurrent circumstance of article 83.2.c) has to make
        from aggravating to mitigating, since measures have been adopted for that
        tending to avoid harm to those affected who would see their right to
        the protection of personal data when being captured by the system of

        video surveillance.


                                            IV

        In accordance with the provisions of the RGPD in its art. 83.2, when deciding to impose

an administrative fine and its amount in each individual case will take into account the
aggravating and mitigating factors that are listed in the indicated article, as well as
any other that may be applicable to the circumstances of the case.

        Consequently, the following have been taken into account as aggravating factors:


         The intentionality or negligence in the infringement (article 83.2.b) RGPD),

        On the other hand, the following have been taken into consideration as mitigating factors:


         The adoption of measures taken by the person in charge of the
        treatment to alleviate the damages suffered by the interested parties
        (article 83.2.c) RGPD)

         Collaboration with this Agency within this procedure

        having responded to the transfer of the claim (article 83.2.f) RGPD)

         There is no link between the offender's activity and the
        processing of personal data (article 76.2.b) LOPDGDD)


         Non-existence of benefits obtained as a consequence of the
        commission of the offense (article 76.2.c) LOPDGDD)

         Have the figure of the data protection delegate not yet

        belonging to the set of entities obliged to have the aforementioned figure
        (article 76.2.g) LOPGDD).

        Based on the foregoing, it is appropriate to propose adjusting the sanction to be imposed on the
claimed and set it at the amount of FIVE THOUSAND EUROS (€ 5,000).


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/19








       If the infringement is confirmed, it could be agreed to impose the responsible
adoption of appropriate measures to adjust its performance to the aforementioned regulations
in this act, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD,

according to which each supervisory authority may 'order the person in charge
of the treatment that the treatment operations conform to the provisions of the
this Regulation, where appropriate, in a certain way and within a
specified term ”.

       In such case, in the resolution adopted, this Agency may require the

responsible so that within the period to be determined:

        Prove that you have proceeded to remove the camera located in the
       entrance porch (private space of the establishment but outside the premises)
       from its current location, or to reorient it by reducing

       the pickup angle.

       It is noted that not meeting the requirements of this body may be
considered as an administrative offense in accordance with the provisions of the RGPD,
classified as an offense in its articles 83.5 and 83.6, being able to motivate such conduct the

opening of a subsequent administrative sanctioning procedure.


       In view of the above, the following is issued



                            MOTION FOR A RESOLUTION


       That the Director of the Spanish Agency for Data Protection
sanction PLAY ORENES, S.L., with NIF B73002099, for a violation of Article

5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of FIVE THOUSAND
EUROS (€ 5,000).

       That, under the provisions of article 58.2.d) of the RGPD, you are
ORDER the defendant that, within ONE MONTH from the date on which the

resolution in which it is agreed to be notified, proceed to withdraw the camera
located in the entrance porch of its current location, or to the reorientation
of the same reducing the angle of capture.



       Likewise, in accordance with the provisions of article 85.2 of the LPACAP,
You are informed that you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which
will mean a reduction of 20% of the amount thereof. With the application of this
reduction, the penalty would be set at FOUR THOUSAND EUROS (€ 4,000) and its
payment will imply the termination of the procedure. The effectiveness of this reduction

It will be conditioned to the withdrawal or resignation of any action or remedy in progress.
administrative against the sanction.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 17/19









       In case you choose to proceed to the voluntary payment of the amount
specified above, in accordance with the provisions of the aforementioned article 85.2,
You must make it effective by entering the restricted account number ES00 0000
0000 0000 0000 0000 opened in the name of the Spanish Agency for the Protection of

Data in the bank CAIXABANK, S.A., indicating in the concept the number
reference of the procedure that appears in the heading of this document and
the cause, by voluntary payment, of reduction of the amount of the sanction. Likewise,
You must send proof of admission to the General Inspection Subdirectorate for

proceed to close the file.


       By virtue of this, he is notified of the foregoing, and the

procedure so that within TEN DAYS you can claim whatever you consider
in his defense and present the documents and information he deems pertinent,
in accordance with article 89.2 of the LPACAP).



B.B.B.
HEAD OF AREA
PROCEDURE INSTRUCTOR







































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 18/19










                   ANNEX: Index of File PS_00003_2020



    1. Claim of C.C.C.
    2. Transfer of claim to PLAY ORENES, S.L.
    3. Answer to the request of D.D.D.
    4. Admission for processing to C.C.C.

    5. E / 02186/2019
    6. Check background
    7. Diligence
           A. opening to PLAY ORENES, S.L.
    8. Allegations of PLAY ORENES SL
    9. Notif. p. tests to PLAY ORENES, S.L.

 >>

SECOND: On October 16, 2020, PLAY ORENES, S.L. has proceeded to
payment of the penalty in the amount of 4,000 euros making use of the planned reduction
in the proposed resolution transcribed above.


THIRD: The payment made entails the waiver of any action or remedy in progress
against the sanction, in relation to the facts referred to in the
motion for a resolution.



                            FOUNDATIONS OF LAW

                                            I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of

control, and as established in art. 47 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said
Regulation; infractions of article 48 of Law 9/2014, of May 9, General

of Telecommunications (hereinafter LGT), in accordance with the provisions of the
article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and
38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.


                                            II

Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:





C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 19/19








      "1. Initiated a sanctioning procedure, if the offender acknowledges his
      responsibility, the procedure may be resolved with the imposition of the

      appropriate sanction.
      2. When the sanction is solely of a pecuniary nature or it fits
      impose a pecuniary sanction and a non-pecuniary sanction but it has
      justified the inadmissibility of the second, the voluntary payment for the alleged
      responsible, at any time prior to the resolution, will involve the

      termination of the procedure, except in relation to the reinstatement of the situation
      altered or to the determination of the compensation for damages
      caused by the commission of the offense.
      3. In both cases, when the sanction is solely of a pecuniary nature, the
      competent body to resolve the procedure will apply reductions of, at

      less, 20% on the amount of the proposed penalty, these being
      cumulative with each other. The aforementioned reductions must be determined in
      the notification of initiation of the procedure and its effectiveness will be
      conditioned to the withdrawal or resignation of any action or remedy in
      administrative against the sanction.

      The percentage of reduction foreseen in this section may be increased
      regulations. "


In accordance with the above, the Director of the Spanish Agency for the Protection of

Data
RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00003/2020, of
in accordance with the provisions of article 85 of the LPACAP.


SECOND: NOTIFY this resolution to PLAY ORENES, S.L ..

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the

National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.



                                                                                968-150719
Mar Spain Martí
Director of the Spanish Agency for Data Protection





C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es