AEPD (Spain) - PS/00054/2020: Difference between revisions

From GDPRhub
No edit summary
 
(4 intermediate revisions by 2 users not shown)
Line 7: Line 7:
|DPA_With_Country=AEPD (Spain)
|DPA_With_Country=AEPD (Spain)


|Case_Number_Name=PS/00062/2020
|Case_Number_Name=PS/00054/2020
|ECLI=
|ECLI=


|Original_Source_Name_1=AEPD  
|Original_Source_Name_1=AEPD
|Original_Source_Link_1=https://www.aepd.es/es/documento/ps-00062-2020.pdf
|Original_Source_Link_1=https://www.aepd.es/es/documento/ps-00054-2020.pdf
|Original_Source_Language_1=Spanish
|Original_Source_Language_1=Spanish
|Original_Source_Language__Code_1=ES
|Original_Source_Language__Code_1=ES
Line 17: Line 17:
|Type=Investigation
|Type=Investigation
|Outcome=Violation Found
|Outcome=Violation Found
|Date_Decided=28.01.2021
|Date_Decided=19.02.2021
|Date_Published=
|Date_Published=
|Year=2021
|Year=2021
|Fine=5000
|Fine=None
|Currency=EUR
|Currency=


|GDPR_Article_1=Article 13 GDPR
|GDPR_Article_1=Article 5(1)(c) GDPR
|GDPR_Article_Link_1=Article 13 GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1c
|GDPR_Article_2=Article 83(2) GDPR
|GDPR_Article_2=Article 13 GDPR
|GDPR_Article_Link_2=Article 83 GDPR#2
|GDPR_Article_Link_2=Article 13 GDPR
|GDPR_Article_3=Article 83(5) GDPR
|GDPR_Article_Link_3=Article 83 GDPR#5




|National_Law_Name_1=Article 22 LOPDGDD
|National_Law_Link_1=https://www.boe.es/eli/es/lo/2018/12/05/3/con


|Party_Name_1=PREDASE SERVICIOS INTEGRALES S. L.
|Party_Name_1=
|Party_Link_1=
|Party_Link_1=
|Party_Name_2=
|Party_Name_2=
Line 52: Line 52:
}}
}}


The Spanish DPA (AEPD) fined a data protection services consultancy, Predase Servicios Integrales S.L., € 5,000 for having a web form to collect personal data without providing adequate information on the processing of the data collected (Article 13 GDPR).
The Spanish Data Protection Agency (AEPD) imposed a warning sanction on a private individual for the installation of a video surveillance system without informing the subjects who may be recorded of the data processing, in violation of Article 13 and Article 5 (1) (c) GDPR.
 
==English Summary==
==English Summary==


===Facts===
===Facts===
A citizen's complaint brought to the agency's attention that the website of the company Predase Servicios Integrales S.L. offered consultancy services related to personal data protection functions using the AEPD logo to pretend that its system was validated by the Spanish Data Protection Agency. In addition, the website had a form to fill in with personal data to contact the company. This form did not contain adequate information on how the data would be processed, for how long, neither by which controller.
The complainant lodged a complaint with the AEPD about the installation of video surveillance cameras in the neighbours' doorway, from which several entrances to homes could be monitored, and believed that excessive and disproportionate use was being made of the video surveillance system in relation to data protection regulations.


The respondent claimed that the form was not operational, as no data was collected from it, and that is why he included the company's e-mail address next to the form.
The defendant responded that the installation of the video surveillance system was necessary to protect himself and his family from neighbourhood disputes caused by non-payment by his tenants.
 
Due to the fact that the website was no longer accessible when the AEPD carried out the checks, the inoperability of the form alleged by the defendant could not be ascertained.
===Dispute===
===Dispute===
Is the lack of information in the collection of data by a website form an infringement of Article 13 GDPR?
Is the installation of a video surveillance system in a community of neighbours, without the authorization of the rest of the neighbours, a breach of Article 13 GDPR?


===Holding===
===Holding===
The AEPD decided to impose a penalty of EUR 5000 for breach of Article 13 GDPR.  
The AEPD held that the video surveillance system was excessive in relation to the purposes alleged by the defendant. It imposed a warning sanction and ordered that the system should only be operational when the defendant or his family were living at the address where the camera was located.
 
Aggravating factors were taken into account:
 
The intentional or negligent nature of the infringement (Article 83(2)(a) GDPR), since it is a company that offers advice, among other matters, on data protection, which requires greater diligence in complying with the obligations of the matter with respect to which it claims to advise.


The continuous nature of the infringement (Article 76 (2) (a) LOPDGDD), given that the complaint filed was dated 20 March 2008 and the diligence of the inspection actions that corroborates the maintenance of the situation on the website www.predase.es was carried out on 7 February 2020.
Given that the defendant is a natural person, that there is no evidence of recidivism and that, furthermore, he has shown cooperation with the AEPD in repairing the possible damage caused, it was decided to impose a warning sanction.
 
The following were taken into account as extenuating circumstances:
 
Lack of recidivism, since there is no record of any previous data protection infringement by the respondent (Article 83(2)(e) GDPR).
 
It is a micro-enterprise within the meaning of the Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises.
==Comment==
==Comment==
As for the alleged misleading advertising by including the AEPD logo, the AEPD decided that it was not within its competence to assess the legality of the advertising in terms of data protection.
''Share your comments here!''


==Further Resources==
==Further Resources==
Line 88: Line 77:


<pre>
<pre>
                                                                            1/16
                                                                                1/14




Line 99: Line 88:




      Procedure Nº: PS / 00062/2020
      Procedure Nº: PS / 00054/2020




              RESOLUTION OF SANCTIONING PROCEDURE
                RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and based on
Of the procedure instructed by the Spanish Agency for Data Protection and based on
Line 108: Line 97:




                                BACKGROUND


FIRST: A.A.A. (hereinafter, the claimant) dated March 20, 2019
                                  BACKGROUND
filed a claim with the Spanish Agency for Data Protection. The
claim is directed against PREDASE SERVICIOS INTEGRALES SOCIEDAD


LIMITED with NIF B02547164 (hereinafter, the claimed). The reasons on which it bases
FIRST: On September 6, 2019, you entered this Agency
the claim are as follows:
Española de Protección de Datos a document submitted by A.A.A., on behalf of


"[….] SECOND. - On the Internet page with the domain name
by B.B.B. (hereinafter, the claimant), through which he makes a claim against
«Www.predase.es», and under the trade name «PREDASE», are offered, among others,
C.C.C. with NIF *** NIF.1 (hereinafter, the claimed one), for the installation of a system
video surveillance in the property located at *** ADDRESS.1 - *** LOCALIDAD.1
(OURENSE), with respect to which there are indications of a possible breach of the
provided in the regulations for the protection of personal data.


regulatory compliance services within the scope of Regulation (EU) 2016/679 and
Organic Law 3/2018. […]


THIRD. - Scrolling down the sidebar of the browser on the page of
The reasons that support the claim are the following:
start, you have access to various links related to the presence in different


Internet social networks of the natural or legal person acting under the name
"Don C.C.C., installs surveillance camera in the stairwell, without authorization
commercial «PREDASE».
for our part, no mention, that he is going to put a camera. The fact is that we
we feel totally intimidated and controlled by the owner of the house. Not in-


In relation to data protection services, it stands out, in the margin
we have the end, because there is no vandalism, and this control of knowing our
left of the screen, the image of a padlock that includes the legend «RGPD /
entrances and exits of the farm, makes us think that it is for a bad purpose because of his
LOPD », […]
Part, because we know that it shows people our entrances and exits of the building.
Well, this man is the owner of a house with 2 houses, one of them is the one that
I have rented, and a place that is to use and enjoy it. For which there is no


Community of owners. And without further ado he has placed this camera that I am attaching a photo-
spellings. There is no sign of said camera […] "


BEDROOM. - By clicking on the image of the said padlock, you are linked to a
Attach photo report showing the location of the camera.
publication in the public profile of «PRÉDASE» on the social network Google+, in which
A quadrilateral appears that groups the graphic symbols of «PRÉDASE» and of the
SPANISH AGENCY FOR DATA PROTECTION, without distinguishing between them,


and adding to the set the contact details of the natural or legal person that
SECOND: Prior to the admission for processing of this claim, a
acts under said trade name. […]


SIX.- In this sense, the grouping of the graphic symbols of «PRÉDASE» and of
transferred the defendant, in accordance with the provisions of article 65.4 of the Law
the SPANISH AGENCY FOR DATA PROTECTION, considered as a whole
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD). The aforementioned transfer was returned by
“Absent” and “surplus (not picked up in office)” on 10/31/2019. The day 07/11/2019 was
made a reiteration that was again returned as "absent" and "surplus (no
withdrawn in office) ”on 11/27/2019.


homogeneous within the same quadrilateral, without distinguishing between its components, and
adding to the set the contact details of the natural or legal person acting
under said trade name, could be constitutive of an illegal act consisting of
generate “the appearance that action is being taken in the name, on behalf of or in
collaboration with the Spanish Agency for Data Protection ”, in relation to the
publication or indiscriminate communication of its offer of services in the field of


data protection to your entire network of contacts in the social network Google+ and to
THIRD: The claim was admitted for processing by resolution of 18
Anyone responsible and in charge of the treatments who visit your page of
February 2020.
Internet for the purpose of contracting professional compliance services
normative in this area.


FOURTH: On June 8, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure to the claimed, by the
alleged infringements of articles 5.1.c) and 13 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), typified in the
Article 83.5 of the same rule.
C / Jorge Juan, 6 www.aepd.es
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/16
28001 - Madrid sedeagpd.gob.es 2/14




Line 168: Line 157:




SEVENTH. - As a consequence, this alleged misleading and illegitimate use of the
FIFTH: As the notification of the initiation agreement was unsuccessful, the
graphic symbol of the SPANISH DATA PROTECTION AGENCY can
proceeded to publish a notification announcement on the Single Edictal Board of the Bulletin


suppose an aggressive practice in terms of data protection, generating the
Official of the State on July 8, 2020, in accordance with the provisions of the
image of a false endorsement of the aforementioned supervisory authority in relation to the services
Article 44 of Law 39/2015, of October 1, on Administrative Procedure
offered by the natural or legal person acting under the trade name
Common of Public Administrations (hereinafter, LPACAP).
«PRÉDASE».


EIGHTH. - This practice has its supposed continuation in a second performance
SIXTH: On September 1, 2020, the instructor of the procedure agreed to the
opening of a period of practice of tests, requiring the Command of the


that presumably could incur in letter c) of the Additional Provision
Civil Guard of Ourense so that, within 30 days, it would issue the corresponding
sixteenth of the Organic Law 3/2018, which considers aggressive practice in
report where it was found:
of data protection the performance of «commercial practices in which the
decision-making power of the addressees by referring to the possible imposition
of sanctions for breach of the personal data protection regulations »:


 Effective address of the claimed at the indicated address.


"It can not be true!!!!! You are not yet adapted to the new general regulation of
data protection (GDPR). DO NOT wait to be sanctioned, find out at C /
*** ADDRESSB.1 or *** URL.1 ”[…]


NINTH.- As a corollary of what has been stated so far, the facts and factual elements
 Existence of a video surveillance device in the aforementioned property.


related in the present document could suppose a presumed conjunction of
 Presence of an informative poster adapted to the regulations in force.
aggressive practices regarding data protection, through interference
undue not only in the image and powers of the Spanish Protection Agency
of Data, but also in the autonomy of the will of those responsible and
those in charge of the treatments, through an alleged distortion of the spirit of the


legal regulations on data protection.


TENTH. - The Internet page with the domain name "*** URL.1" does not facilitate the
 Orientation of the installed cameras and their catchment area. If allowed by the
general information established in article 10 of Law 34/2002, of July 11, on
claimed, it is requested that they be observed and informed about the images displayed
information society and electronic commerce services.
on the monitor.


 Any other aspect that is considered appropriate to review.


Likewise, despite having a personal data collection form,
nor does it provide a privacy policy in order to comply with
what is established in articles 12 (right of transparency) and 13 (right of
information) of Regulation (EU) 2016/679 of the European Parliament and of the Council,
of April 27, 2016, regarding the protection of natural persons in what


regarding the processing of personal data and the free circulation of these data and
SEVENTH: On September 16, 2019, the Civil Guard Command of
which repeals Directive 95/46 / EC (General Regulation for the protection of
Ourense sends the report issued by the Commander of the Acctal Post. of the Guard
data)."
Civil of *** LOCALIDAD.1 on September 12, 2020. The content of the report is the


Along with the claim, it provides screenshots of the web, of the social network Google+
following:


and Facebook for evidential purposes of what is stated in the brief. It also incorporates
"[…]1. In relation to the effective address of the claimed and if it is the indicated address
copy of the Notarial Acta Deed granted before the notary of the city of
the complaint informs that the claimed person does not reside in the place where he / she is
*** LOCALIDAD. 1, D. B.B.B., dated March 18, 2019, Protocol No. 620, of the
installed the video surveillance system. It resides on the street *** ADDRESS. 2
content of the website that leads to the PREDASE profile on the social network
belonging to the town of *** LOCALIDAD.2 (Madrid) and with telephone number
GOOGLE +.


[…].


SECOND: On April 23, 2019, proceedings are carried out in this Agency to
2 On the existence of a video surveillance device in the aforementioned property; I know
to state that, after an analysis of the web page that is the object of the
informs that a video camera installed on the aforementioned portal has been found
building, located on the wall opposite the entrance door to the portal, this being a


common area, from where the stairs that give access to the two floors start
superiors that make up the only dwellings in the building.


C / Jorge Juan, 6 www.aepd.es
3º Regarding the presence of an informative poster adapted to the regulations in force.
28001 - Madrid sedeagpd.gob.es 3/16
It is reported that there are 2 informational signs, one of them in located on a door


metal just below the chamber and the other located on the wall adjacent to the place
where the camera is about ten feet away. It means that the two
Announcement signs are similar.


4th As has been outlined in point 2, regarding the orientation of the cameras
installed and catchment area of these. It is reported that there is only one camera, the


which is located on the wall opposite the entrance door to the building's portal.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/14




Line 237: Line 223:




claim (www.predase.es), does not have the same identification of your
responsible or information on privacy policy.




THIRD: The claim was admitted for processing on April 29, 2019.


Supposedly this camera captures the images inside the portal. Regarding the
type of images that are recorded is unknown, since the holder does not reside and does not allow
the observation.


FOURTH: In view of the facts reported in the claim and the documents
provided by the claimant, the Subdirectorate General for Data Inspection proceeded
to carry out preliminary investigation actions to clarify the


facts in question, by virtue of the investigative powers granted to the
4th (Sic.) The person responsible for the recorded images is D. C.C.C. and it is specified
control authorities in article 57.1 of Regulation (EU) 2016/679 (Regulation
on the poster.
General Data Protection, hereinafter RGPD), and in accordance with the
established in Title VII, Chapter I, Second Section, of Organic Law 3/2018,
of December 5, Protection of Personal Data and guarantee of rights
digital (hereinafter LOPDGDD).


5th Photographic Annex is attached. "


As a result of the investigative actions carried out, the report prepared
by the acting inspector reveals the following:


 “Regarding the use of the logo of this Agency together with
Attach the following photos:


the logo and contact information of PREDASE, this is confirmed by
 Photographic image of the portal of the property where the camera and the two
the notarial deed presented by the claimant of the content of the page
posters.
web that leads to the PREDASE profile on the GOOGLE social network + done appear
grouped together, and as a whole, the PREDASE logo, the logo of this Agency, the
European flag, and PREDASE contact information.




Regarding the denounced fact of the publication in the social network FACEBOOK and the
Enlarged photographic image of the poster.
indicated in the claim according to the sixteenth additional provision, letter c) that
establishes aggressive practice in terms of data protection:


EIGHTH: On the occasion of the knowledge of the claimed effective address, confirmed
by the Planning and Institutional Relations Service of the Tax Agency in


“Carry out commercial practices in which the decision-making power of the
the consultation carried out, on October 2, 2020, a copy of the
recipients by referring to the possible imposition of sanctions for
report issued by the Civil Guard, as well as a copy of the agreement to initiate the
breach of personal data protection regulations ”.
present proceeding.


It is found that in PREDASE's FACEBOOK profile, dated March 12
The defendant presented, on October 21, 2020, an answering brief where
makes the following statements:


2019, the following content was published:


"It can not be true!!!!! You are not yet adapted to the new general regulation of
“[…] Reasons why a security camera is placed on the portal of said
data protection (GDPR). DO NOT wait to be sanctioned, find out at C /
edifice.
*** ADDRESS.1 or *** URL.1. "


- On the second floor of said building there are some tenants of the company […]


Access to this publication is still available as of this report. Diligence is recorded in
(before). These men were evicted for non-payment in April 2019 by the
the SIGRID system with the screen print of the publication.
Court […]. In May of the same year the property was rented to me again by a man who
He claims to be the administrator of a company called […] (after), which is my surprise
that they send me a message on my mobile and it turns out that they are the same tenants who already
They had been evicted a month earlier mocking me and mocking that
they were back in the house, changing the name of the company. All this for


 It is also verified that the website of PREDASE, a company of
Of course, it was communicated at that time to my lawyer and the court.


advice, among other issues, on data protection, lacks policy
- In August 2019, in our holiday stay, on the first floor of the
privacy and collect data in your contact form without the need for the
property; One night at dawn, one of the
acceptance of treatment.
people who are on the second floor rented (very aggressive and pushy). In that


At that moment my wife and I had an attack of anxiety and fear. These
events occurred on 08/07/2019 01:50 AM and 08/08/2019 05:30 AM, which
were testified in an appearance procedure before the Civil Guard and attested
No. […], which is communicated to the Court […].




C / Jorge Juan, 6 www.aepd.es
- The most important reason why I have thought about putting a security camera is
28001 - Madrid sedeagpd.gob.es 4/16
to fully protect my family and me in case at some point they coincide
in the portal or on the stairs of the building so that the worst would not happen.






C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/14




Line 307: Line 293:




It is recorded in the SIGRID diligence system with the only content page of the site
Web.




The ownership of the website is also not reported as stated in article 10 of
Law 34/2002, of July 11, on services of the information society and
e-commerce, mentioning the trademark as a company name
PREDASE
 On June 28, 2019, it is received at this Agency, with registration number


032629/2019, letter sent by ORANGE ESPAGNE, S.A.U. informing that the
- Upon my arrival in Madrid, I contact the AEPD to find out if I could proceed with the
ownership of the line *** TELEPHONE. 1 that appears on the website corresponds to
installation of a security camera in the portal of the building (where the
C.C.C., with DNI *** NIF.1 and installation address on the street *** ADDRESS.1,
camera currently). After exposing the location of the camera and the range of
*** LOCALITY. 1.


the same, the answer by this organism was affirmative, informing me of
that I had to put all my personal data: responsible, exercise your rights
of data protection before and the information on the treatment of personal data;
as stated in the posters that were provided to me in the same AEPD and posts
visible in the portal of the building, where they are currently warning of
said camera, which was installed in August 2019 without going into operation until


 After conducting a search in the Central Mercantile Registry, the
on 09/21/2019.
PREDASE SERVICIOS INTEGRALES SOCIEDAD LIMITADA, with registered office
coinciding with the one that appears on the website denounced and in which the owner of the
Contact telephone number that appears on the website is the sole administrator.


- It is not in my interest at all to save images of who enters or leaves the building,
only to ensure the full safety of my family […]. I have not shown any kind of
image or personal data of these gentlemen. Therefore, the images


A report from the Mercantile Registry is recorded in the SIGRID system, as an associated object
provided by the camera are erased absolutely and daily.
Central.


 For all the above, it can be affirmed that the denounced facts are true and
[…] "
that the company responsible for the website referred to in the claim is PREDASE


SERVICIOS INTEGRALES SOCIEDAD LIMITADA. "
Attach 7 images captured from October 15 to 19, 2020 in
different times showing the camera's field of view


FIFTH: Consulted on March 10, 2020, the application of the AEPD was
verifies that the only sanctioning procedure in which the claim appears as
mercantile PREDASE SERVICIOS INTEGRALES SOCIEDAD LIMITADA with NIF


B02547164, is the present procedure.
NINTH: On December 11, 2020, a resolution proposal was formulated, in
which it is proposed that a penalty of warning be imposed on the defendant, for
an infringement of article 5.1.c) of the RGPD, typified in article 83.5 of the same


SIXTH: On March 17, 2020, the Director of the Spanish Agency for
standard, as well as to certify the adoption of measures. In this proposal
Data Protection agreed to initiate a sanctioning procedure to the claimed, by the
grants a period of 10 days for the claimed person to be able to consider in his
alleged infringement of article 13 of the RGPD, typified in article 83.5 of the aforementioned
defense, as well as present the documents and information that it considers
pertinent, in accordance with article 89.2 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP).


rule.


SEVENTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written
TENTH: In the event of a faulty first attempt to notify the proposed
allegations on June 25, 2020 where he requested the filing of the procedure
resolution by the Post Office, the aforementioned
sanctioning and revealed the following:
proposal. The notification took place on February 2, 2021 and the defendant has
submitted writing on February 15, 2021, in which it shows what


following:


"[...]
"[...]


Regarding the data form, it is not operational (nor has it ever been). Of
1º- On February 2, 2021, I received the proposed resolution of the letter that in its
In fact, it is an addition of a template in order to use the "blue popup" style of the
Contact Form. You can see that it does not display any error message in case of


do not enter data (or do it wrongly), nor does a satisfactory message in
day I sent to AEPD, the resolution proposal being a warning sanction.
shipping case. It just redirects directly to the home screen.


It is enough to note that if said form were functional and operative, the
I inform you that that same day the camera was disconnected, as
email address to the left of it (since it would be redundant
you have ordered me.


and unnecessary). "
2º- On January 2, 2021, I proceed to sue the company […], whose
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/16


legal representatives or administrators are A.A.A. and B.B.B ..


The reason for the lawsuit is the non-payment of the rents or amounts due,
requesting the court No1 of instruction of XXXXXXXX eviction from the 2nd floor


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/14




Line 378: Line 364:




[…] "


EIGHTH: On August 10, 2020, the procedure instructor agreed to the


opening of a period of practice of tests, being considered reproduced, for the purposes
evidence the claim filed by the claimant, the data obtained and
generated by the General Subdirectorate for Data Inspection and the allegations
presented by the claimed. As it was not possible to notify this opening of the period
test practice, due to the expiration of the electronic notification, on the 1st of


September 2020, a reiteration of the document was sent, which was notified on
of said property.
same day 1.


NINTH: On October 5, 2020, the
On February 3, 2021, I received the answer from the court that I contributed to my writing.
Checks carried out on September 21, 25 and 29 and October 5, 2020
on the web www.predase.es.


as evidence for the record, the legal grounds of which are listed therein, not
accommodating the enervation of the eviction action, leaving the view for the next
9/3/2021 and subsequent launch of direct eviction of the leased property for the
3/18/2021.


TENTH: On October 19, 2020, a resolution proposal was formulated,
proposing a penalty of warning be imposed on the defendant, for a
infringement of article 13 of the RGPD, typified in article 83.5 of the same rule.


In this proposal, a period of 10 days was granted so that the defendant could
Being grateful in advance and very satisfied with the proposed resolution,
allege whatever is considered in his defense, as well as present the documents and
I remain entirely at your disposal. "
information deemed relevant, in accordance with article 89.2 of the Law
39/2015, of October 1, of the Common Administrative Procedure of the
Public Administrations (hereinafter, LPACAP).




The proposed resolution was notified on October 30 and the defendant submitted
Enclosed Decree of February 3, 2021 issued by the Lawyer of the Administration
brief of allegations on November 13, stating the following:
of Justice of the Court of 1st Instance and Instruction of XXXXXXXX in Verbal Trial
of Eviction.


"[...]


In view of all the actions, by the Spanish Agency for Data Protection
In the present proceeding, the following are considered proven facts,


FIRST: In points THIRD, FOURTH and SIX (since the point
FIFTH) of the complaint, interprets the alleged union of the PRÉDASE and
of the AEPD as an attempt of association in the face of potential clients.
Assuming that it is a mere question of structural organization of the design
web and graphic, any minimally informed person knows how to distinguish between


Spanish Agency for Data Protection and a service provider company
(call it PRÉDASE, AUDIDAT or any other).


  As indicated by the complainant and appears, clearly in capital letters, on the
header of said website, said image belongs to the SOCIAL NETWORKS of the
company (not to the services provided, estimates, invoices, or any other


document of a public nature that could, effectively, imply an improper use
of the AEPD logo).


  Indeed, said publication was made on March 12, 2019 and the link
corresponds to the social network Google+, which has not been operational since April 2,


2019 (it was canceled by Google on that date). Following your twisted reasoning
and personal, the use of the Facebook, Google or Twitter logos would also imply
a deception of any client who visited your website by giving rise to the mistake that




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/16




Line 447: Line 404:




PRÉDASE (as in your case AUDIDAT) are part of or act on behalf of said
Business.


SECOND: Again at the SEVENTH, EIGHTH and NINTH points the
complainant once again attributes judicial powers (which border on insult and


slander) by directly calling it "misleading, illicit, image of false authority,
aggressive practices or to restrict the ability to make decisions "(since the use of
adjective "presumed" preceding all these niceties does not lower the least or
reduces the seriousness of their accusations) which in any company is a simple
advertising campaign on social networks.




THIRD: In reference to the alleged breach of Article 10 of Law 34/2002 of
July 11, as you will have been able to verify (and according to assures you have captures of
screen 'certified' before a Notary Public) all contact information: Name (commercial),
address, phone and email are clearly visible. Not being mandatory for a
autonomous (name under which the company operated at the time of its


complaint) the registration in the Mercantile Registry.


However, and as you can see in the attached document (“Metadata
*** METADATA.1 ") and despite not being mandatory, a simple search in the
metadata of the web (and therefore publicly accessible in any search engine or
web browser) if the owner's data "C.C.C. - *** NIF.1" appears under the "meta


tag "*** META TAG.1.


Regarding the data form and as you will also have been able to verify in your
Flawless detective work, it is not operational (nor has it ever been). Of
In fact, it is an addition of a template in order to use the "blue popup" style of the
Contact Form. You can see that it does not display any error message in case of


do not enter data (or do it wrongly), nor does a satisfactory message in
shipping case. It just redirects directly to the home screen (I hope there
left this also duly registered in a notarial public deed).


It is enough to note that if said form were functional and operative, the
email address to the left of it (since it would be redundant


and unnecessary).


FOURTH: The denounced facts must be considered prescribed based on the
Sections 1 and 2 of Art. 30 of Law 40/2015 of October 1, on the Legal Regime
of the Public Sector, therefore applicable to the AEPD, in terms of the prescription of
infractions:




1. The infractions and sanctions will prescribe according to the provisions of the laws that
establish. If they do not set limitation periods, very serious offenses
They will prescribe after three years, the serious ones after two years and the minor ones after six months; the
Sanctions imposed for very serious offenses will prescribe after three years, those imposed


for serious offenses after two years and those imposed for minor offenses after one year.


2. The statute of limitations for offenses will begin to run from the day on which
that the offense had been committed. In the case of ongoing or
permanent, the term will begin to run from the end of the offending conduct.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/16




Line 518: Line 431:




For all the above we REQUEST:
C / Jorge Juan, 6 www.aepd.es
 
28001 - Madrid sedeagpd.gob.es 6/14
That the COMPLAINT IS Filed from the Spanish Data Protection Agency
based on both the lack of veracity of the facts denounced, and the
 
prescription of time limits from the date of the complaint.
 
 
 
 
LASTLY: From PRÉDASE SERVICIOS INTEGRALES S.L. (current company name
of the company) we do not know the motivation of the complainant regarding the facts above
exposed. Only understandable under the eagerness to intimidate and try to eliminate the
competition through complaints and "funny and slum" actions such as the
detailed inspection of our website (which by the way, we are updating
 
together with the IT company, in order to correct the slightest error).
 
In their eagerness to discredit us or for us to desist in the provision of our
services, Mr. A.A.A. (on behalf of AUDIDAT) demonstrates a manifest
 
incompetence in your complaint by being unable to locate our postal address at the
to direct the complaint, which was clearly indicated on the same website
object of your complaint (thus forcing the AEPD to resort to Orange
Espagne SAU to provide an address that we do not know at all and that nothing
 
has to do with our mercantile). "
 
 
In view of all the actions, by the Spanish Agency for Data Protection
In this proceeding, the following are considered proven facts,




Line 557: Line 441:




                                      ACTS






FIRST: On September 6, 2019, you have entry into the Spanish Agency for
Written Data Protection of the claimant in which he informs the
existence of a camera in the stairwell of the building where the
housing where he resides under a lease and located at *** ADDRESS. 1 -
*** LOCALITY. 1 (Ourense).




The photographs provided together with the claim show a camera located in the
enclosure of the portal of the property. This building, divided into 3 floors (ground, 1st and 2nd) is
property in its entirety of the claimed, who has reserved use of the home of the
1st floor.




SECOND: The defendant does not have his habitual residence in the property, being his
address *** ADDRESS.2 - *** LOCALITY.2 (Madrid).


THIRD: In order to guarantee the right to defense of the defendant and the
principle of contradiction, it was agreed to refer the defendant on October 2, 2010,
once the address of your habitual residence is known, a letter accompanied by


copy of the agreement to initiate the sanctioning procedure, as well as the report to which
reference has been made in the previous event. This writing was collected by the claimed
on October 15.


FOURTH: The defendant declares in his answering brief of October 21,


2020 that the camera was installed in August 2019 and became operational on 21
September 2019. Does not include accreditation.


FIFTH: The frames of dates October 15 to 19, 2020 provided by the
claimed in their answering brief, they show that the field of view of the


chamber is circumscribed to the internal enclosure of the portal of access to the property and to part of the
flight of stairs.


SIXTH: The defendant states in his letter that the placement of the camera in his
current location responds to the purpose of guaranteeing the safety of its
person, as well as the members of his family, before unfriendly encounters with


the inhabitants of the rented apartment that could occur in the portal and on the stairs,
taking into account the problematic contractual relationship and various antecedents that
relates in his writing.


SEVENTH: The photographs attached to the report to which it is referred, evidence the presence of two


informative posters, which offer information about the person in charge, the
possibility and address where to go to exercise the rights contained in
articles 15 to 22 of the GDPR, as well as an email address and a
telephone where to request more information.




EIGHTH: The complained party communicates a change of address to Calle *** ADDRESS. 3 -
*** LOCALITY. 3.






C / Jorge Juan, 6 www.aepd.es
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/16
28001 - Madrid sedeagpd.gob.es 7/14




Line 589: Line 511:




                                      ACTS
NINTH: In the brief presented on February 15, 2021, the defendant
states that he proceeded to disconnect the camera installed on February 2.






FIRST: PREDASE SERVICIOS INTEGRALES S.L. is a company of
                            FOUNDATIONS OF LAW
advice on various matters such as occupational risk prevention, protection
of data or insurance that the web page had on the internet *** URL.1.


                                            I


SECOND: The website had a contact section for potential interested parties
The Director of the Spanish Agency is competent to resolve this procedure
in their services, including address, telephone, email and a form
data collection.


THIRD: The website lacked a privacy policy and did not provide the
of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR and
in art. 47 and 48.1 of LOPDGDD.


information regulated in article 13 of the RGPD, as was shown in the
                                            II
previous investigation actions carried out.


FOURTH: The defendant states that the form was not operational and that for that reason
reason the email address was provided.


The defendant is charged, on the one hand, with the commission of an offense for violation
of article 5.1.c) of the RGPD that personal data will be “adequate, pertinent and
limited to what is necessary in relation to the purposes for which they are processed
("Data minimization"). "


FIFTH: The website is not accessible in the checks carried out on
On the other hand, the commission of another offense for violation of the
days 21, 25 and 29 of September and 5 of October of 2020 since it returns an error of
access by server permission denial (Error 403) and object not found
(Additional 404 error).


 
Article 13 of the RGPD, which establishes that:
SIXTH: The website is still not accessible in the checks carried out on the 8th and
January 12, 2021, returning the same error indicated in the previous event.
 
                          FOUNDATIONS OF LAW
 
 
                                            I
 
By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of
 
The Spanish Agency for Data Protection is competent to resolve this
process.
 
                                            II
 
 
The defendant is charged with committing an offense for violation of article 13
of the RGPD, regarding the information that must be provided when the data is
obtained from the interested party, which establishes that:


"1. When personal data relating to him are obtained from an interested party, the
"1. When personal data relating to him are obtained from an interested party, the
responsible for the treatment, at the time these are obtained, will provide
responsible for the treatment, at the time these are obtained, will provide
all the information indicated below:
all the information indicated below:


a) the identity and contact details of the person in charge and, where appropriate, their
 
a) the identity and contact details of the person in charge and, where appropriate, of their
representative;
representative;


b) the contact details of the data protection officer, if applicable;
b) the contact details of the data protection officer, if applicable;
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/16




Line 663: Line 551:
of the treatment;
of the treatment;


d) when the treatment is based on article 6, paragraph 1, letter f), the interests
legitimate of the person in charge or of a third party;


d) when the treatment is based on article 6, paragraph 1, letter f), the interests
legitimate rights of the person in charge or a third party;


e) the recipients or categories of recipients of the personal data, in their
e) the recipients or categories of recipients of personal data, in their
case;
case;


f) where appropriate, the intention of the person responsible to transfer personal data to a third party


f) where appropriate, the intention of the person responsible to transfer personal data to a third party
country or international organization and the existence or absence of a decision of
country or international organization and the existence or absence of a decision of
adequacy of the Commission, or, in the case of transfers indicated in the
adequacy of the Commission, or, in the case of transfers indicated in the
Articles 46 or 47 or Article 49, paragraph 1, second subparagraph, reference to the
Articles 46 or 47 or Article 49, paragraph 1, second subparagraph, reference to the
adequate or appropriate warranties and the means to obtain a copy of these or
adequate or appropriate warranties and the means to obtain a copy of these or
to the fact that they have been borrowed.


to the fact that they have been borrowed.


2. In addition to the information mentioned in section 1, the person responsible for the
2. In addition to the information mentioned in section 1, the person responsible for the
treatment will facilitate the interested party, at the time the data is obtained
treatment will facilitate the interested party, at the time the data is obtained
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/14
personal information, the following information necessary to guarantee data processing
personal information, the following information necessary to guarantee data processing
loyal and transparent:
loyal and transparent:
Line 686: Line 586:


a) the period during which the personal data will be kept or, when it is not
a) the period during which the personal data will be kept or, when it is not
possible, the criteria used to determine this period;
possible, the criteria used to determine this deadline;
 
b) the existence of the right to request the data controller access to the


b) the existence of the right to request the data controller for access to the
personal data relating to the interested party, and its rectification or deletion, or the limitation
personal data relating to the interested party, and its rectification or deletion, or the limitation
of its treatment, or to oppose the treatment, as well as the right to portability
of its treatment, or to oppose the treatment, as well as the right to portability
of the data;
of the data;


c) when the treatment is based on article 6, paragraph 1, letter a), or article
c) when the treatment is based on article 6, paragraph 1, letter a), or article
9, paragraph 2, letter a), the existence of the right to withdraw consent in
9, paragraph 2, letter a), the existence of the right to withdraw consent in
at any time, without affecting the legality of the treatment based on the
at any time, without affecting the legality of the treatment based on the
consent prior to its withdrawal;
consent prior to its withdrawal;


d) the right to file a claim with a supervisory authority;
d) the right to file a claim with a supervisory authority;


e) if the communication of personal data is a legal or contractual requirement, or a
e) if the communication of personal data is a legal or contractual requirement, or a
necessary requirement to sign a contract, and if the interested party is obliged to provide
necessary requirement to sign a contract, and if the interested party is obliged to provide
personal data and is informed of the possible consequences of not
personal data and is informed of the possible consequences of not
provide such data;
provide such data;


f) the existence of automated decisions, including profiling, to be
f) the existence of automated decisions, including profiling, to be
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information
significant on the applied logic, as well as the importance and consequences
significant on the applied logic, as well as the importance and consequences
provided for said treatment for the interested party.
provided for said treatment for the interested party.


3.When the data controller plans the further processing of data
personal data for a purpose other than that for which they were collected, will provide the


3.When the controller plans the further processing of data
personal data for a purpose other than that for which they were collected, will provide the
interested party, prior to said further processing, information on that other purpose
interested party, prior to said further processing, information on that other purpose
and any additional pertinent information pursuant to section 2.
and any additional relevant information pursuant to section 2.
 
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/16
 
 
 
 
 
 
 
 


4.The provisions of paragraphs 1, 2 and 3 shall not apply when and in the
4.The provisions of paragraphs 1, 2 and 3 shall not apply when and in the
Line 735: Line 624:




The violation of this article is classified as an infringement in article 83.5 of the RGPD,
The aforementioned infractions are classified in article 83.5 of the RGPD, which
which it considers as such:
provides the following:


"Violations of the following provisions will be sanctioned, in accordance with the
"Violations of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of up to EUR 20,000,000 or,
paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,


in the case of a company, an amount equivalent to a maximum of 4% of the
in the case of a company, an amount equivalent to a maximum of 4% of the
Line 745: Line 634:
the highest amount:
the highest amount:


[…] B) the rights of the interested parties pursuant to Articles 12 to 22; […]. "
a) the basic principles for the treatment, including the conditions for the treatment


consent in accordance with articles 5, 6, 7 and 9;


For the purposes of the statute of limitations for the offense, article 72.1 of the LOPDGDD
b) the rights of the interested parties in accordance with articles 12 to 22 […] "
establishes:


"Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose


a substantial violation of the articles mentioned therein, and, in particular, the
C / Jorge Juan, 6 www.aepd.es
following:
28001 - Madrid sedeagpd.gob.es 9/14


[…] H) The omission of the duty to inform the affected party about the treatment of their
personal data in accordance with the provisions of articles 13 and 14 of the Regulation


(EU) 2016/679. […] ”.


                                            III


This sanctioning procedure has its origin, as indicated in the agreement
of initiation and was reiterated in the proposed resolution, in the absence of
privacy of the website www.predase.es. As regards the
complaints regarding aggressive practices in terms of data protection
(specifically framed in letters b) and c) of the additional provision
sixteenth of the LOPDGDD: «to generate the appearance that it is acting in
name, on behalf of or in collaboration with the Spanish Agency for the Protection of
Data or an autonomous data protection authority in carrying out
any communication to those responsible and in charge of the treatments in which the
sender offers its products or services "and" carry out commercial practices in the
that the decision-making power of the recipients is curtailed through reference to the
possible imposition of sanctions for non-compliance with the regulations for the protection of
personal data ”, respectively), it means that its regulation is carried out
by Law 3/1991, of January 10, on Unfair Competition, not showing the Agency
Spanish Data Protection powers in this matter.
"Article 5 of the RGPD, relating to the principles of personal data processing
enunciates in his letter to the one of "legality, loyalty and transparency", principle in which to his
Considering 39: “All processing of personal data must be lawful and
loyal. For natural persons it must be completely clear that they are being collected,
using, consulting or otherwise processing personal data that
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/16








For the purposes of the statute of limitations for offenses, both offenses are
considered very serious and prescribe after three years, in accordance with article 72.1 of the
LOPDGDD, which establishes that:




"Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:




concern, as well as the extent to which said data is or will be processed. The beginning
a) The processing of personal data violating the principles and guarantees
transparency requires that all information and communication regarding the treatment of
established in article 5 of Regulation (EU) 2016/679. […]
such data is easily accessible and easy to understand, and that a language is used


simple and clear. This principle refers in particular to the information of the
h) The omission of the duty to inform the affected party about the processing of their data
interested parties about the identity of the person responsible for the treatment and the purposes thereof and
personal in accordance with the provisions of articles 13 and 14 of Regulation (EU)
to the information added to ensure fair and transparent treatment with
regarding the affected natural persons and their right to obtain confirmation and
communication of personal data concerning them that are the subject of
treatment. Natural persons must be aware of the risks, the


rules, safeguards and rights regarding the processing of personal data
2016/679 and 12 of this Organic Law. […] "
as well as the way to assert your rights in relation to the treatment. In
In particular, the specific purposes of the processing of personal data must be
explicit and legitimate, and must be determined at the time of collection. The data
Personal data must be adequate, relevant and limited to what is necessary for the purposes


for those who are treated. This requires, in particular, ensuring that it is limited to a
                                          III
Strict minimum its conservation period. Personal data should only be processed if
the purpose of the treatment could not reasonably be achieved by other means. For
ensure that personal data is not kept longer than necessary, the
responsible for the treatment must establish deadlines for its deletion or revision
periodic. All reasonable steps must be taken to ensure that


rectify or delete personal data that are inaccurate. Personal information
Article 6.1 of the RGPD establishes the cases in which the
should be treated in a way that ensures adequate security and confidentiality
processing of personal data, providing within them - article 6.1.e) - the
of personal data, including to prevent unauthorized access or use of
said data and the equipment used in the treatment. "


that refers to the legality "the treatment is necessary for the fulfillment of
a mission carried out in the public interest or in the exercise of public powers
conferred on the person responsible for the treatment ”.


Recital 60 links the duty of information with the principle of transparency,
In the specific field of data processing for video surveillance purposes, the
by establishing that “The principles of fair and transparent treatment require that
inform the interested party of the existence of the treatment operation and its purposes. The
responsible for the treatment must provide the interested party with all the information
is necessary to guarantee fair and transparent treatment,


taking into account the specific circumstances and context in which the
Article 22.1 of the LOPDGDD provides that “people may carry out the
personal information. The interested party must also be informed of the profiling
Image processing through camera or video camera systems with the
and the consequences of such elaboration. If personal data is obtained from
purpose of preserving the safety of people and property, as well as their
interested parties, should also be informed if they are obliged to provide them and of the
facilities ”dedicating the rest of the sections of this article to the
consequences if they do not […] '. In this order, article 12.1 of the
specificities to which this data processing must be submitted.
RGPD regulates the conditions to ensure its effective implementation and article 13


specifies what information should be provided when the data is obtained from the
interested.


In turn, article 11 LOPDGDD introduces the information rule by layers when
In this sense, and with regard to the specific case that is the object of this present
has:
sanctioning procedure, it can be affirmed, taking into account the declarations
made by the defendant about the purpose pursued with the chamber of
video surveillance installed on the portal of the property of which it is the owner and in which
maintains a home for his personal use, that said treatment responds to the


objective of guaranteeing the safety of people (the claimed person and the
family members) in the face of the problematic relationships maintained with
tenants who reside in the rented dwelling within the property owned by the
reclaimed. We would, therefore, be faced with a case in the person responsible for the treatment
performs a mission in the public interest.


"1. When personal data is obtained from the affected party, the person responsible for the
treatment may comply with the duty of information established in article
13 of Regulation (EU) 2016/679, providing the affected party with basic information to the
referred to in the following section and indicating an email address or other


means that allows easy and immediate access to the rest of the information.
Now, to consider the concurrence of the public interest, this must be
proportionate with respect to the purpose pursued, inasmuch as its exercise is
susceptible to affect the physical image as personal data and therefore represents a
interference in the field of fundamental rights of people. What


2. The basic information to which the previous section refers must contain, at the
Consequently, it will be necessary to make a weighting between the mission of
less:
public interest to ensure the safety of people carried out by the
responsible for the treatment and the rights of the tenants, who in the present
Of course, their privacy and freedom of movement may be affected by the fact that the


C / Jorge Juan, 6 www.aepd.es
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/16
28001 - Madrid sedeagpd.gob.es 10/14




Line 870: Line 721:




The area captured by the camera affects the common area that serves as access to both
households.


a) The identity of the person responsible for the treatment and their representative, if applicable.


In order to carry out this weighting and evaluate the proportionality of the
measure, it is necessary to take into consideration the Judgment of the Constitutional Court
207/1996, in which the High Court determines that “to verify whether a measure
restriction of a fundamental right exceeds the judgment of proportionality, it is
It is necessary to verify if it meets the following three requirements or conditions: if such
measure is capable of achieving the proposed objective (suitability judgment); Yes,


b) The purpose of the treatment.
Furthermore, it is necessary, in the sense that there is no other more moderate measure to
the achievement of such purpose with equal effectiveness (judgment of necessity); and finally yes
it is weighted or balanced, as more benefits or advantages derive from it
for the general interest that damages to other goods or values in conflict (judgment
of proportionality in the strict sense) ”.


c) The possibility of exercising the rights established in articles 15 to 22 of the


Regulation (EU) 2016/679. […] ”.
Applying, therefore, this judgment of proportionality to the specific assumption proceeds
note the following:


In relation to the foregoing, the proven facts show that the website
● The installation of a video surveillance system can be considered an ideal means
It had a contact section for potential clients which included the
to achieve in order to guarantee the safety of the claimed and their family, for
telephone, an email and a data collection form, without stating


no section that provides the information that, in accordance with article 13 of the
how much it is capable of fulfilling both a preventive objective and proving
RGPD, must be provided about the processing of data likely to be generated
documentary evidence of the occurrence of certain events that suppose an attack on said
by providing personal damage through any of the means of contact
security.
referrals.


● It can be considered that the treatment complies with the principle of minimizing


With regard to the claimed claim made in the brief of
data and is moderate with respect to the area captured by the camera since it is
response of June 25, 2020 to the commencement agreement, in the sense that the
limits to areas only to areas common to both houses where they can
form was not operational and that by not collecting data effectively,
coincide the claimed and the tenants, without affecting the area in any way
indicated the email address next to it, it could not be verified
exclusive of use and enjoyment of these.


veracity of said statement about the functionality of the aforementioned form as it is not
possible access to the website in the checks carried out. Now the
The fact that the form has not been operational does not prevent the web page
must comply with the duty of information established in article 12 of the RGPD and
specified in the subsequent article 13 for situations in which the information is


obtained from the interested party, since the collection of personal data is subject to
● It can also be considered that the treatment complies with the principle of
also be done through the rest of the published means of contact (and
minimization of data and is moderate in relation to the conservation period of
particularly, as stated by the complainant himself, by means of the email address
the images, for the aforementioned term, in accordance with what was stated by the
electronic that has been indicated supplying the lack of functionality of the form).
claimed, it is only 1 day.


● However, given that the purpose alleged by the defendant is


ensure the safety of your person and your family members during the
time in which any of them makes use of their home in the property and therefore
both can coincide spatially and temporally with the tenants (without there being any
alleged at no time the need to preserve the safety of one's own
property), the processing of data would be excessive when those circumstances


they do not take place, since they would exceed the purpose for which they respond.


In conclusion, it cannot be said that it is proportionate that the system of
installed video surveillance is operational at all times as the purpose
pursued by the person in charge is not reached when the defendant or a member of


your family is not using the home in the property; in this
In this circumstance, it could not be concluded that the mission of public interest prevails over
fundamental rights of those affected.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/14




Line 920: Line 791:




In accordance, therefore, with the foregoing, the video surveillance system, to the extent
that was operational all the time (it was disconnected on February 2),
violated the provisions of article 5.1.c) of the RGPD.




                                            IV


Regarding the duty of information provided for in article 12 of the RGPD (with
the content provided in the subsequent article 13, article 22.4 of the LOPDGDD
determines that




“[…] It will be understood that it has been fulfilled by placing an information device in
sufficiently visible place identifying, at least, the existence of the treatment, the
identity of the person in charge and the possibility to exercise the rights provided in the
Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the


informational device a connection code or internet address to this
information.


In any case, the data controller must keep at the disposal of the
affected the information referred to in the aforementioned regulation ”.




According to the report and the photographic images provided by the report of the
Commander of the Acctal Post. of the Civil Guard of *** LOCALIDAD.1, the system
video surveillance has two informative posters that comply with the provisions
in the previously transcribed precept as it identifies the existence of
treatment and offers information about the person in charge, the possibility and direction to


Where to go to exercise the rights contained in articles 15 to 22 of the
RGPD, as well as an email address and a telephone number where to request more
information.


Regarding the possible breach of this duty at the time of filing


C / Jorge Juan, 6 www.aepd.es
the claim, it is noted that the defendant declares that, even when the cameras are
28001 - Madrid sedeagpd.gob.es 13/16
installed in August 2019, the video surveillance system did not go into operation
 
until September 21. Therefore, since it has not been proven that the
 
camera will be in operation at the time of filing the claim
 
(the claimant indicates that the person in charge has shown images of their tickets and
 
exits from the building, but does not provide an indication in this regard), it is not possible to determine that
 
 
 
 
And with regard to the allegations presented by the defendant to the proposal of
resolution, and that are objectified in the alleged prescription of the alleged infringement and
in the statement that the website is in the process of updating,
 
the following is noted:
 
 Regarding the possible prescription of the offense, the defendant alleges that it would be
Applicable to the provisions of Article 30 of Law 40/2015, of October 1, of the
Legal Regime of the Public Sector (hereinafter, LRJSP) and that the facts
 
denounced should be considered prescribed since, according to the underlined that
accompanies this writing, the defendant seems to understand that the alleged infringement is
would consider mild (and prescribe at 6 months) and that the term would begin to
computed from the day it was committed. These arguments cannot
to qualify for several reasons:
 
 
      1. Article 30.1 of the LRJSP provides that "Infractions and sanctions
      They will prescribe according to the provisions of the laws that establish them. […] ”. In this
      In this sense, the LOPDGDD has a Title, IX, dedicated to the regime
      sanctioner. Within this title, article 71 establishes that they constitute
      offenses the acts and conducts typified in article 83, sections 4, 5 and
 
      6 of the RGPD as well as those contrary to the LOPDGDD itself and dedicates the
      Articles 72 to 74 to determine a gradation of infractions in very
      serious, serious and minor, instituting the limitation period for each of the
      the levels. Therefore, the applicable statute of limitations will be the
      provided in the LOPDGDD.
 
 
      2. The alleged offense is subsumed, for these prescription purposes, in the
      article 72.1.h) of the LOPDGDD and in this article it is specified that
      considered very serious and that he will prescribe after 3 years. This is reflected in the
      Legal Basis V of the initiation agreement and is recalled in the Basis
      Legal II of the motion for a resolution.
 


      3. Regarding the moment of the beginning of the calculation of the term of
there would have been on that date an effective data processing and, therefore, a
      prescription, the LOPDGDD does not establish any specific regimen, so
omission of the duty of information.
      At this point, the provisions of article 30.2 of the LRJSP are applicable with
      supplementary character. Well, going to this article, it is observed that


      makes a distinction between "one-time" or ongoing commission offenses.
The principle of the right to the presumption of innocence, recognized as a right
      Taking into account the nature of the alleged offense, it seems clear that the
subjective fundamental in article 24 of the Spanish Constitution, prevents imposing
      omission of the duty to provide the information was maintained, at least,
      until the date of February 7, 2020, the day on which the diligence is carried out
      about the website mentioned in the previous action report


      inspection that has been collected in the fourth Antecedent. Also, this
an administrative sanction when a proof of
      limitation period would have been interrupted by the notification of the
charge accrediting the facts that motivate the imputation or the intervention in the
      initiation agreement, as provided in article 75 of the LOPDGDD.
the alleged offender and applying the principle "in dubio pro reo" in case of
doubt regarding a concrete and determined fact, which in any case obliges
resolve said doubt in the most favorable way to the interested party.


In conclusion, therefore, in the most favorable case for the claimed party, the term of
3-year prescription would have started on February 7, 2020, leaving
interrupted on June 5, 2020, the date on which the notification took place
effective agreement to initiate the sanctioning procedure.


The aforementioned right to the presumption of innocence is also included in a
expressed in article 53.2.b) of Law 39/2015, of October 1, on the Procedure




C / Jorge Juan, 6 www.aepd.es
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/16
28001 - Madrid sedeagpd.gob.es 12/14




Line 1,012: Line 861:




 Regarding the claim of the claimed that the web page is in
Common Administration of Public Administrations (hereinafter, LPACAP), which
update to correct possible errors, it is not possible to verify it, since
states that:
that, as has been reflected in the sixth proven fact of this resolution, the


mentioned web (*** URL.1) is not available.


The rest of the allegations are not taken into consideration as they do not refer to
"two. In addition to the rights provided in the previous section, in the case of
the object of this sanctioning procedure.
administrative procedures of a sanctioning nature, the alleged
Responsible parties will have the following rights:


[…] B) The presumption of non-existence of administrative responsibility while not
the contrary is proven. "


                                            IV


The corrective powers available to the Spanish Agency for the Protection of
In relation to this principle, the Constitutional Court in its Sentence 76/1990, of 26
Data, as a control authority, are established in article 58.2 of the RGPD. Between
April, considers that the right to the presumption of innocence entails: “that the
They have the power to sanction with warning - article 58.2 b) -, the
sanction is based on acts or probative means of charge or incriminating of the
Power to impose an administrative fine in accordance with article 83 of the RGPD
reproached conduct; that the burden of proof rests with the accuser, without


-article 58.2 i) -, or the power to order the person in charge of the treatment
no one is obliged to prove their own innocence; and that any insufficiency in the
that the processing operations comply with the provisions of the RGPD, when
result of the tests carried out, freely assessed by the sanctioning body,
proceed, in a certain way and within a specified period - article 58. 2
it must be translated into an acquittal. "
d) -.


                                          V


According to the provisions of article 83.2 of the RGPD, the measure provided for in article 58.2
d) of the aforementioned Regulation is compatible with the sanction consisting of a fine
administrative.


                                            IV
However, what is established in article 83.5, sections a) and b), of the RGPD, its art.
58.2 b) provides the possibility of sanctioning with warning, in relation to the
indicated in Recital 148:


"In the event of a minor offense, or if the fine that is likely to be imposed


In accordance with the provisions of the RGPD in its art. 83.2, when deciding to impose a
would constitute a disproportionate burden for an individual, rather than
administrative fine and its amount in each individual case will take into account the
sanction by fine may be imposed a warning. It must however
aggravating and mitigating factors that are listed in the indicated article, as well as
pay special attention to the nature, severity and duration of the offense, to its
any other that may be applicable to the circumstances of the case.
intentional nature, to the measures taken to alleviate the damages suffered,
the degree of responsibility or any relevant prior infringement, the way in which


that the supervisory authority has had knowledge of the infringement, to the fulfillment
of measures ordered against the person in charge or in charge, to the adherence to codes of
conduct and any other aggravating or mitigating circumstance. "


For the purposes of setting the sanction to impose on the claimed party, the
In the present case, when deciding the sanction to impose, they have taken into account
following aggravating circumstances:
count the following items,


1. Intentionality or negligence in the infringement (article 83.2.a) RGPD) since it is
It is about a company that offers advice, among other issues on the subject of


data protection, which requires greater diligence in complying with
 That the person responsible is a natural person.
the obligations of the matter with respect to which it claims to advise.


2. The continuing nature of the offense (article 76.2.a) LOPDGDD), since the
 That there is no recidivism or repetition due to the fact that the commission of
The claim submitted is dated March 20, 2019 and the diligence of the


previous inspection actions that corroborate the maintenance of the situation in
previous infractions.
The website www.predase.es was held on February 7, 2020.


On the other hand, the following circumstances have also been taken into account
● That it has shown collaboration in this organization within the present
mitigating:
sanctioning procedure




1. There is no record of the commission of any prior infraction regarding the protection of
Therefore, it is considered that the sanction that would correspond to impose is
data by the claimed party (article 83.2.e) RGPD).
warning, in accordance with the provisions of article 58.2 b) of the RGPD, in
relation to what is stated in Considering 148, cited above.






C / Jorge Juan, 6 www.aepd.es
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/16
28001 - Madrid sedeagpd.gob.es 13/14
 




Line 1,081: Line 931:




On the other hand, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD,
according to which each supervisory authority may 'order the person in charge or in charge
of the treatment that the treatment operations conform to the provisions of the


2. It is a micro-SME for the purposes of the provisions of the Recommendation of the
this Regulation, where appropriate, in a certain way and within a
Commission, of May 6, 2003, on the definition of micro, small and
specified term […] ”, the person in charge must adapt the operation of the system
medium businesses.
video surveillance installed so that it is only operational when he or
a member of your family make use of the home they have in the property
where that is installed.




Based on the above, a fine of FIVE THOUSAND EUROS (5,000.00
Regarding this issue, the defendant has stated in his brief presented on the day
€).
February 15, having proceeded to disconnect the camera, so it is considered that
the adequacy measure has been adopted and must be maintained as long as he or someone
member of your family do not use the house.




Therefore, in accordance with the applicable legislation and the criteria of


Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of the sanctions whose existence has been accredited, the Director of the
graduation of the sanctions whose existence has been accredited, the Director of the
Spanish Agency for Data Protection RESOLVES:
Spanish Agency for Data Protection RESOLVES:




FIRST: IMPOSE PREDASE SERVICIOS INTEGRALES S. L., with NIF
B02547164, for a violation of article 13 of the RGPD, typified in article 83.5
of the RGPD, a fine of FIVE THOUSAND EUROS (€ 5,000.00).


SECOND: NOTIFY this resolution to PREDASE SERVICIOS
FIRST: IMPOSE C.C.C., with NIF *** NIF.1, for a violation of article 5.1.c),
INTEGRALES S.L. and inform A.A.A ..
typified in article 83.5 of the aforementioned rule, a sanction of
APPEARANCE.


SECOND: ORDER, under the provisions of article 58.2.d) of the RGPD,


THIRD: Warn the sanctioned person that the sanction imposed by a
that the video surveillance system is only operational when he or someone else
Once this resolution is enforceable, in accordance with the provisions of the
member of their family make use of the home they have in the property where
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
that one is installed.
Common of Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved


by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
THIRD: NOTIFY this resolution to C.C.C. and inform the claimant.
of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency
Spanish Data Protection in the bank CAIXABANK, S.A .. In case


Otherwise, it will be collected in the executive period.


Notification received and once executive, if the execution date is found
Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment
volunteer will be until the 20th day of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediate business month.


In accordance with the provisions of article 50 of the LOPDGDD, this
In accordance with the provisions of article 50 of the LOPDGDD, this
Line 1,132: Line 974:




Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may file, optionally, an appeal for reconsideration before the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly


count from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the


C / Jorge Juan, 6 www.aepd.es
referred Law.
28001 - Madrid sedeagpd.gob.es 16/16


Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/14




Line 1,153: Line 1,000:




Contentious-administrative jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.




Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the
interested party expresses his intention to file contentious-administrative appeal.
interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
If this is the case, the interested party must formally communicate this fact through


letter addressed to the Spanish Agency for Data Protection, presenting it through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in art. 16.4 of the
web /], or through any of the other records provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
 
documentation that proves the effective filing of the contentious appeal-
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.
notification of this resolution would terminate the precautionary suspension.




                                                                                      938-131120
Mar Spain Martí


                                                                                      938-131120
Mar Spain Martí
Director of the Spanish Agency for Data Protection
Director of the Spanish Agency for Data Protection





Latest revision as of 13:52, 13 December 2023

AEPD - PS/00054/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(c) GDPR
Article 13 GDPR
Article 22 LOPDGDD
Type: Investigation
Outcome: Violation Found
Started:
Decided: 19.02.2021
Published:
Fine: None
Parties: n/a
National Case Number/Name: PS/00054/2020
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: Francesc Julve Falcó

The Spanish Data Protection Agency (AEPD) imposed a warning sanction on a private individual for the installation of a video surveillance system without informing the subjects who may be recorded of the data processing, in violation of Article 13 and Article 5 (1) (c) GDPR.

English Summary

Facts

The complainant lodged a complaint with the AEPD about the installation of video surveillance cameras in the neighbours' doorway, from which several entrances to homes could be monitored, and believed that excessive and disproportionate use was being made of the video surveillance system in relation to data protection regulations.

The defendant responded that the installation of the video surveillance system was necessary to protect himself and his family from neighbourhood disputes caused by non-payment by his tenants.

Dispute

Is the installation of a video surveillance system in a community of neighbours, without the authorization of the rest of the neighbours, a breach of Article 13 GDPR?

Holding

The AEPD held that the video surveillance system was excessive in relation to the purposes alleged by the defendant. It imposed a warning sanction and ordered that the system should only be operational when the defendant or his family were living at the address where the camera was located.

Given that the defendant is a natural person, that there is no evidence of recidivism and that, furthermore, he has shown cooperation with the AEPD in repairing the possible damage caused, it was decided to impose a warning sanction.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/14










     Procedure Nº: PS / 00054/2020


                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following



                                  BACKGROUND

FIRST: On September 6, 2019, you entered this Agency
Española de Protección de Datos a document submitted by A.A.A., on behalf of

by B.B.B. (hereinafter, the claimant), through which he makes a claim against
C.C.C. with NIF *** NIF.1 (hereinafter, the claimed one), for the installation of a system
video surveillance in the property located at *** ADDRESS.1 - *** LOCALIDAD.1
(OURENSE), with respect to which there are indications of a possible breach of the
provided in the regulations for the protection of personal data.


The reasons that support the claim are the following:

"Don C.C.C., installs surveillance camera in the stairwell, without authorization
for our part, no mention, that he is going to put a camera. The fact is that we
we feel totally intimidated and controlled by the owner of the house. Not in-

we have the end, because there is no vandalism, and this control of knowing our
entrances and exits of the farm, makes us think that it is for a bad purpose because of his
Part, because we know that it shows people our entrances and exits of the building.
Well, this man is the owner of a house with 2 houses, one of them is the one that
I have rented, and a place that is to use and enjoy it. For which there is no

Community of owners. And without further ado he has placed this camera that I am attaching a photo-
spellings. There is no sign of said camera […] "

Attach photo report showing the location of the camera.

SECOND: Prior to the admission for processing of this claim, a

transferred the defendant, in accordance with the provisions of article 65.4 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD). The aforementioned transfer was returned by
“Absent” and “surplus (not picked up in office)” on 10/31/2019. The day 07/11/2019 was
made a reiteration that was again returned as "absent" and "surplus (no
withdrawn in office) ”on 11/27/2019.


THIRD: The claim was admitted for processing by resolution of 18
February 2020.

FOURTH: On June 8, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure to the claimed, by the

alleged infringements of articles 5.1.c) and 13 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), typified in the
Article 83.5 of the same rule.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/14









FIFTH: As the notification of the initiation agreement was unsuccessful, the
proceeded to publish a notification announcement on the Single Edictal Board of the Bulletin

Official of the State on July 8, 2020, in accordance with the provisions of the
Article 44 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter, LPACAP).

SIXTH: On September 1, 2020, the instructor of the procedure agreed to the
opening of a period of practice of tests, requiring the Command of the

Civil Guard of Ourense so that, within 30 days, it would issue the corresponding
report where it was found:

 Effective address of the claimed at the indicated address.


 Existence of a video surveillance device in the aforementioned property.

 Presence of an informative poster adapted to the regulations in force.


 Orientation of the installed cameras and their catchment area. If allowed by the
claimed, it is requested that they be observed and informed about the images displayed
on the monitor.

 Any other aspect that is considered appropriate to review.


SEVENTH: On September 16, 2019, the Civil Guard Command of
Ourense sends the report issued by the Commander of the Acctal Post. of the Guard
Civil of *** LOCALIDAD.1 on September 12, 2020. The content of the report is the

following:

"[…]1. In relation to the effective address of the claimed and if it is the indicated address
the complaint informs that the claimed person does not reside in the place where he / she is
installed the video surveillance system. It resides on the street *** ADDRESS. 2
belonging to the town of *** LOCALIDAD.2 (Madrid) and with telephone number

[…].

2 On the existence of a video surveillance device in the aforementioned property; I know
informs that a video camera installed on the aforementioned portal has been found
building, located on the wall opposite the entrance door to the portal, this being a

common area, from where the stairs that give access to the two floors start
superiors that make up the only dwellings in the building.

3º Regarding the presence of an informative poster adapted to the regulations in force.
It is reported that there are 2 informational signs, one of them in located on a door

metal just below the chamber and the other located on the wall adjacent to the place
where the camera is about ten feet away. It means that the two
Announcement signs are similar.

4th As has been outlined in point 2, regarding the orientation of the cameras
installed and catchment area of these. It is reported that there is only one camera, the

which is located on the wall opposite the entrance door to the building's portal.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/14








Supposedly this camera captures the images inside the portal. Regarding the
type of images that are recorded is unknown, since the holder does not reside and does not allow
the observation.


4th (Sic.) The person responsible for the recorded images is D. C.C.C. and it is specified
on the poster.

5th Photographic Annex is attached. "


Attach the following photos:

 Photographic image of the portal of the property where the camera and the two
posters.


 Enlarged photographic image of the poster.

EIGHTH: On the occasion of the knowledge of the claimed effective address, confirmed
by the Planning and Institutional Relations Service of the Tax Agency in

the consultation carried out, on October 2, 2020, a copy of the
report issued by the Civil Guard, as well as a copy of the agreement to initiate the
present proceeding.

The defendant presented, on October 21, 2020, an answering brief where
makes the following statements:


“[…] Reasons why a security camera is placed on the portal of said
edifice.

- On the second floor of said building there are some tenants of the company […]

(before). These men were evicted for non-payment in April 2019 by the
Court […]. In May of the same year the property was rented to me again by a man who
He claims to be the administrator of a company called […] (after), which is my surprise
that they send me a message on my mobile and it turns out that they are the same tenants who already
They had been evicted a month earlier mocking me and mocking that
they were back in the house, changing the name of the company. All this for

Of course, it was communicated at that time to my lawyer and the court.

- In August 2019, in our holiday stay, on the first floor of the
property; One night at dawn, one of the
people who are on the second floor rented (very aggressive and pushy). In that

At that moment my wife and I had an attack of anxiety and fear. These
events occurred on 08/07/2019 01:50 AM and 08/08/2019 05:30 AM, which
were testified in an appearance procedure before the Civil Guard and attested
No. […], which is communicated to the Court […].


- The most important reason why I have thought about putting a security camera is
to fully protect my family and me in case at some point they coincide
in the portal or on the stairs of the building so that the worst would not happen.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/14








- Upon my arrival in Madrid, I contact the AEPD to find out if I could proceed with the
installation of a security camera in the portal of the building (where the
camera currently). After exposing the location of the camera and the range of

the same, the answer by this organism was affirmative, informing me of
that I had to put all my personal data: responsible, exercise your rights
of data protection before and the information on the treatment of personal data;
as stated in the posters that were provided to me in the same AEPD and posts
visible in the portal of the building, where they are currently warning of
said camera, which was installed in August 2019 without going into operation until

on 09/21/2019.

- It is not in my interest at all to save images of who enters or leaves the building,
only to ensure the full safety of my family […]. I have not shown any kind of
image or personal data of these gentlemen. Therefore, the images

provided by the camera are erased absolutely and daily.

[…] "

Attach 7 images captured from October 15 to 19, 2020 in
different times showing the camera's field of view


NINTH: On December 11, 2020, a resolution proposal was formulated, in
which it is proposed that a penalty of warning be imposed on the defendant, for
an infringement of article 5.1.c) of the RGPD, typified in article 83.5 of the same

standard, as well as to certify the adoption of measures. In this proposal
grants a period of 10 days for the claimed person to be able to consider in his
defense, as well as present the documents and information that it considers
pertinent, in accordance with article 89.2 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP).


TENTH: In the event of a faulty first attempt to notify the proposed
resolution by the Post Office, the aforementioned
proposal. The notification took place on February 2, 2021 and the defendant has
submitted writing on February 15, 2021, in which it shows what

following:

"[...]

1º- On February 2, 2021, I received the proposed resolution of the letter that in its

day I sent to AEPD, the resolution proposal being a warning sanction.

I inform you that that same day the camera was disconnected, as
you have ordered me.

2º- On January 2, 2021, I proceed to sue the company […], whose

legal representatives or administrators are A.A.A. and B.B.B ..

The reason for the lawsuit is the non-payment of the rents or amounts due,
requesting the court No1 of instruction of XXXXXXXX eviction from the 2nd floor

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/14









of said property.

On February 3, 2021, I received the answer from the court that I contributed to my writing.

as evidence for the record, the legal grounds of which are listed therein, not
accommodating the enervation of the eviction action, leaving the view for the next
9/3/2021 and subsequent launch of direct eviction of the leased property for the
3/18/2021.


Being grateful in advance and very satisfied with the proposed resolution,
I remain entirely at your disposal. "


Enclosed Decree of February 3, 2021 issued by the Lawyer of the Administration
of Justice of the Court of 1st Instance and Instruction of XXXXXXXX in Verbal Trial
of Eviction.


In view of all the actions, by the Spanish Agency for Data Protection
In the present proceeding, the following are considered proven facts,











































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/14








                                       ACTS



FIRST: On September 6, 2019, you have entry into the Spanish Agency for
Written Data Protection of the claimant in which he informs the
existence of a camera in the stairwell of the building where the
housing where he resides under a lease and located at *** ADDRESS. 1 -
*** LOCALITY. 1 (Ourense).


The photographs provided together with the claim show a camera located in the
enclosure of the portal of the property. This building, divided into 3 floors (ground, 1st and 2nd) is
property in its entirety of the claimed, who has reserved use of the home of the
1st floor.


SECOND: The defendant does not have his habitual residence in the property, being his
address *** ADDRESS.2 - *** LOCALITY.2 (Madrid).

THIRD: In order to guarantee the right to defense of the defendant and the
principle of contradiction, it was agreed to refer the defendant on October 2, 2010,
once the address of your habitual residence is known, a letter accompanied by

copy of the agreement to initiate the sanctioning procedure, as well as the report to which
reference has been made in the previous event. This writing was collected by the claimed
on October 15.

FOURTH: The defendant declares in his answering brief of October 21,

2020 that the camera was installed in August 2019 and became operational on 21
September 2019. Does not include accreditation.

FIFTH: The frames of dates October 15 to 19, 2020 provided by the
claimed in their answering brief, they show that the field of view of the

chamber is circumscribed to the internal enclosure of the portal of access to the property and to part of the
flight of stairs.

SIXTH: The defendant states in his letter that the placement of the camera in his
current location responds to the purpose of guaranteeing the safety of its
person, as well as the members of his family, before unfriendly encounters with

the inhabitants of the rented apartment that could occur in the portal and on the stairs,
taking into account the problematic contractual relationship and various antecedents that
relates in his writing.

SEVENTH: The photographs attached to the report to which it is referred, evidence the presence of two

informative posters, which offer information about the person in charge, the
possibility and address where to go to exercise the rights contained in
articles 15 to 22 of the GDPR, as well as an email address and a
telephone where to request more information.


EIGHTH: The complained party communicates a change of address to Calle *** ADDRESS. 3 -
*** LOCALITY. 3.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/14








NINTH: In the brief presented on February 15, 2021, the defendant
states that he proceeded to disconnect the camera installed on February 2.



                            FOUNDATIONS OF LAW

                                             I

The Director of the Spanish Agency is competent to resolve this procedure

of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR and
in art. 47 and 48.1 of LOPDGDD.

                                             II


The defendant is charged, on the one hand, with the commission of an offense for violation
of article 5.1.c) of the RGPD that personal data will be “adequate, pertinent and
limited to what is necessary in relation to the purposes for which they are processed
("Data minimization"). "

On the other hand, the commission of another offense for violation of the

Article 13 of the RGPD, which establishes that:

"1. When personal data relating to him are obtained from an interested party, the
responsible for the treatment, at the time these are obtained, will provide
all the information indicated below:


a) the identity and contact details of the person in charge and, where appropriate, of their
representative;

b) the contact details of the data protection officer, if applicable;


c) the purposes of the treatment to which the personal data are destined and the legal basis
of the treatment;

d) when the treatment is based on article 6, paragraph 1, letter f), the interests
legitimate of the person in charge or of a third party;


e) the recipients or categories of recipients of personal data, in their
case;

f) where appropriate, the intention of the person responsible to transfer personal data to a third party

country or international organization and the existence or absence of a decision of
adequacy of the Commission, or, in the case of transfers indicated in the
Articles 46 or 47 or Article 49, paragraph 1, second subparagraph, reference to the
adequate or appropriate warranties and the means to obtain a copy of these or
to the fact that they have been borrowed.


2. In addition to the information mentioned in section 1, the person responsible for the
treatment will facilitate the interested party, at the time the data is obtained


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/14








personal information, the following information necessary to guarantee data processing
loyal and transparent:


a) the period during which the personal data will be kept or, when it is not
possible, the criteria used to determine this deadline;

b) the existence of the right to request the data controller for access to the
personal data relating to the interested party, and its rectification or deletion, or the limitation
of its treatment, or to oppose the treatment, as well as the right to portability

of the data;

c) when the treatment is based on article 6, paragraph 1, letter a), or article
9, paragraph 2, letter a), the existence of the right to withdraw consent in
at any time, without affecting the legality of the treatment based on the

consent prior to its withdrawal;

d) the right to file a claim with a supervisory authority;

e) if the communication of personal data is a legal or contractual requirement, or a
necessary requirement to sign a contract, and if the interested party is obliged to provide

personal data and is informed of the possible consequences of not
provide such data;

f) the existence of automated decisions, including profiling, to be
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information

significant on the applied logic, as well as the importance and consequences
provided for said treatment for the interested party.

3.When the data controller plans the further processing of data
personal data for a purpose other than that for which they were collected, will provide the

interested party, prior to said further processing, information on that other purpose
and any additional relevant information pursuant to section 2.

4.The provisions of paragraphs 1, 2 and 3 shall not apply when and in the
to the extent that the interested party already has the information. "


The aforementioned infractions are classified in article 83.5 of the RGPD, which
provides the following:

"Violations of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,

in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:

a) the basic principles for the treatment, including the conditions for the treatment

consent in accordance with articles 5, 6, 7 and 9;

b) the rights of the interested parties in accordance with articles 12 to 22 […] "


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/14








For the purposes of the statute of limitations for offenses, both offenses are
considered very serious and prescribe after three years, in accordance with article 72.1 of the
LOPDGDD, which establishes that:


"Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:


a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679. […]

h) The omission of the duty to inform the affected party about the processing of their data
personal in accordance with the provisions of articles 13 and 14 of Regulation (EU)

2016/679 and 12 of this Organic Law. […] "

                                           III

Article 6.1 of the RGPD establishes the cases in which the
processing of personal data, providing within them - article 6.1.e) - the

that refers to the legality "the treatment is necessary for the fulfillment of
a mission carried out in the public interest or in the exercise of public powers
conferred on the person responsible for the treatment ”.

In the specific field of data processing for video surveillance purposes, the

Article 22.1 of the LOPDGDD provides that “people may carry out the
Image processing through camera or video camera systems with the
purpose of preserving the safety of people and property, as well as their
facilities ”dedicating the rest of the sections of this article to the
specificities to which this data processing must be submitted.


In this sense, and with regard to the specific case that is the object of this present
sanctioning procedure, it can be affirmed, taking into account the declarations
made by the defendant about the purpose pursued with the chamber of
video surveillance installed on the portal of the property of which it is the owner and in which
maintains a home for his personal use, that said treatment responds to the

objective of guaranteeing the safety of people (the claimed person and the
family members) in the face of the problematic relationships maintained with
tenants who reside in the rented dwelling within the property owned by the
reclaimed. We would, therefore, be faced with a case in the person responsible for the treatment
performs a mission in the public interest.


Now, to consider the concurrence of the public interest, this must be
proportionate with respect to the purpose pursued, inasmuch as its exercise is
susceptible to affect the physical image as personal data and therefore represents a
interference in the field of fundamental rights of people. What

Consequently, it will be necessary to make a weighting between the mission of
public interest to ensure the safety of people carried out by the
responsible for the treatment and the rights of the tenants, who in the present
Of course, their privacy and freedom of movement may be affected by the fact that the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/14








The area captured by the camera affects the common area that serves as access to both
households.


In order to carry out this weighting and evaluate the proportionality of the
measure, it is necessary to take into consideration the Judgment of the Constitutional Court
207/1996, in which the High Court determines that “to verify whether a measure
restriction of a fundamental right exceeds the judgment of proportionality, it is
It is necessary to verify if it meets the following three requirements or conditions: if such
measure is capable of achieving the proposed objective (suitability judgment); Yes,

Furthermore, it is necessary, in the sense that there is no other more moderate measure to
the achievement of such purpose with equal effectiveness (judgment of necessity); and finally yes
it is weighted or balanced, as more benefits or advantages derive from it
for the general interest that damages to other goods or values in conflict (judgment
of proportionality in the strict sense) ”.


Applying, therefore, this judgment of proportionality to the specific assumption proceeds
note the following:

● The installation of a video surveillance system can be considered an ideal means
to achieve in order to guarantee the safety of the claimed and their family, for

how much it is capable of fulfilling both a preventive objective and proving
documentary evidence of the occurrence of certain events that suppose an attack on said
security.

● It can be considered that the treatment complies with the principle of minimizing

data and is moderate with respect to the area captured by the camera since it is
limits to areas only to areas common to both houses where they can
coincide the claimed and the tenants, without affecting the area in any way
exclusive of use and enjoyment of these.


● It can also be considered that the treatment complies with the principle of
minimization of data and is moderate in relation to the conservation period of
the images, for the aforementioned term, in accordance with what was stated by the
claimed, it is only 1 day.

● However, given that the purpose alleged by the defendant is

ensure the safety of your person and your family members during the
time in which any of them makes use of their home in the property and therefore
both can coincide spatially and temporally with the tenants (without there being any
alleged at no time the need to preserve the safety of one's own
property), the processing of data would be excessive when those circumstances

they do not take place, since they would exceed the purpose for which they respond.

In conclusion, it cannot be said that it is proportionate that the system of
installed video surveillance is operational at all times as the purpose
pursued by the person in charge is not reached when the defendant or a member of

your family is not using the home in the property; in this
In this circumstance, it could not be concluded that the mission of public interest prevails over
fundamental rights of those affected.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/14








In accordance, therefore, with the foregoing, the video surveillance system, to the extent
that was operational all the time (it was disconnected on February 2),
violated the provisions of article 5.1.c) of the RGPD.


                                            IV

Regarding the duty of information provided for in article 12 of the RGPD (with
the content provided in the subsequent article 13, article 22.4 of the LOPDGDD
determines that


“[…] It will be understood that it has been fulfilled by placing an information device in
sufficiently visible place identifying, at least, the existence of the treatment, the
identity of the person in charge and the possibility to exercise the rights provided in the
Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the

informational device a connection code or internet address to this
information.

In any case, the data controller must keep at the disposal of the
affected the information referred to in the aforementioned regulation ”.


According to the report and the photographic images provided by the report of the
Commander of the Acctal Post. of the Civil Guard of *** LOCALIDAD.1, the system
video surveillance has two informative posters that comply with the provisions
in the previously transcribed precept as it identifies the existence of
treatment and offers information about the person in charge, the possibility and direction to

Where to go to exercise the rights contained in articles 15 to 22 of the
RGPD, as well as an email address and a telephone number where to request more
information.

Regarding the possible breach of this duty at the time of filing

the claim, it is noted that the defendant declares that, even when the cameras are
installed in August 2019, the video surveillance system did not go into operation
until September 21. Therefore, since it has not been proven that the
camera will be in operation at the time of filing the claim
(the claimant indicates that the person in charge has shown images of their tickets and
exits from the building, but does not provide an indication in this regard), it is not possible to determine that

there would have been on that date an effective data processing and, therefore, a
omission of the duty of information.

The principle of the right to the presumption of innocence, recognized as a right
subjective fundamental in article 24 of the Spanish Constitution, prevents imposing

an administrative sanction when a proof of
charge accrediting the facts that motivate the imputation or the intervention in the
the alleged offender and applying the principle "in dubio pro reo" in case of
doubt regarding a concrete and determined fact, which in any case obliges
resolve said doubt in the most favorable way to the interested party.


The aforementioned right to the presumption of innocence is also included in a
expressed in article 53.2.b) of Law 39/2015, of October 1, on the Procedure


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/14








Common Administration of Public Administrations (hereinafter, LPACAP), which
states that:


"two. In addition to the rights provided in the previous section, in the case of
administrative procedures of a sanctioning nature, the alleged
Responsible parties will have the following rights:

[…] B) The presumption of non-existence of administrative responsibility while not
the contrary is proven. "


In relation to this principle, the Constitutional Court in its Sentence 76/1990, of 26
April, considers that the right to the presumption of innocence entails: “that the
sanction is based on acts or probative means of charge or incriminating of the
reproached conduct; that the burden of proof rests with the accuser, without

no one is obliged to prove their own innocence; and that any insufficiency in the
result of the tests carried out, freely assessed by the sanctioning body,
it must be translated into an acquittal. "

                                           V


However, what is established in article 83.5, sections a) and b), of the RGPD, its art.
58.2 b) provides the possibility of sanctioning with warning, in relation to the
indicated in Recital 148:

"In the event of a minor offense, or if the fine that is likely to be imposed

would constitute a disproportionate burden for an individual, rather than
sanction by fine may be imposed a warning. It must however
pay special attention to the nature, severity and duration of the offense, to its
intentional nature, to the measures taken to alleviate the damages suffered,
the degree of responsibility or any relevant prior infringement, the way in which

that the supervisory authority has had knowledge of the infringement, to the fulfillment
of measures ordered against the person in charge or in charge, to the adherence to codes of
conduct and any other aggravating or mitigating circumstance. "

In the present case, when deciding the sanction to impose, they have taken into account
count the following items,


 That the person responsible is a natural person.

 That there is no recidivism or repetition due to the fact that the commission of

previous infractions.

● That it has shown collaboration in this organization within the present
sanctioning procedure


Therefore, it is considered that the sanction that would correspond to impose is
warning, in accordance with the provisions of article 58.2 b) of the RGPD, in
relation to what is stated in Considering 148, cited above.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/14








On the other hand, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD,
according to which each supervisory authority may 'order the person in charge or in charge
of the treatment that the treatment operations conform to the provisions of the

this Regulation, where appropriate, in a certain way and within a
specified term […] ”, the person in charge must adapt the operation of the system
video surveillance installed so that it is only operational when he or
a member of your family make use of the home they have in the property
where that is installed.


Regarding this issue, the defendant has stated in his brief presented on the day
February 15, having proceeded to disconnect the camera, so it is considered that
the adequacy measure has been adopted and must be maintained as long as he or someone
member of your family do not use the house.



Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of the sanctions whose existence has been accredited, the Director of the
Spanish Agency for Data Protection RESOLVES:



FIRST: IMPOSE C.C.C., with NIF *** NIF.1, for a violation of article 5.1.c),
typified in article 83.5 of the aforementioned rule, a sanction of
APPEARANCE.

SECOND: ORDER, under the provisions of article 58.2.d) of the RGPD,

that the video surveillance system is only operational when he or someone else
member of their family make use of the home they have in the property where
that one is installed.

THIRD: NOTIFY this resolution to C.C.C. and inform the claimant.



In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.



Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly

contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/14









interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through

writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in art. 16.4 of the

cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the

notification of this resolution would terminate the precautionary suspension.


                                                                                       938-131120
Mar Spain Martí

Director of the Spanish Agency for Data Protection














































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es