AEPD (Spain) - PS/00261/2020
|AEPD (Spain) - PS/00261/2020|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 12 GDPR
|Parties:||RADIOTELEVISIÓN DEL PRINCIPADO DE ASTURIAS|
|National Case Number/Name:||PS/00261/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA fined a company €26,000 (reduced to €19,600) for recording images of their employees' resting room and for not offering up-to-date information about the use of video surveillance at the workplace.
English Summary[edit | edit source]
Facts[edit | edit source]
Following a complaint, the Spanish DPA (AEPD) launched an investigation of a public radio-tv company that was using a video surveillance system on their premises.
The complainant alleged that the company had kept images during more than a year, as more than a year after recording them they were able to provide them to a court that asked for them.
Additionally, the AEPD noted that one of the system's cameras were pointing to the door of the employees' resting room, in order to control access to it. However, the camera also recorded images of part of the room itself, including a table and two chairs, a bulletin board, and two vending machines.
Holding[edit | edit source]
The AEPD concluded, in the first place, that even if there might had been an infringement in the storage of the images for more than a year, the violation was already prescribed, according to the former Spanish Data Protection Act, as more than two years had passed since the moment in which the controller handled the images to the court.
On the other hand, the AEPD found that the controller had violated Article 5(1)(c) GDPR when recording part of the employees' resting room. Even if the Spanish Workers' Statute allows under its Article 20(3) the employer to use different methods of control and surveillance, the Spanish Data Protection Act regulates the use of videocameras in the workplace. Its Article 89 allows for the use of videocameras, but specifically prohibits the recording of images of resting places for employees.
Therefore, the controller illegally recorded such images, and hence violated Article 5(1)(c) GDPR, for processing inadequate and irrelevant personal data of its employees.
The AEPD suggested that, if they needed to record images of the door providing access to the room, they could either move the camera, so the angle was the appropriate one, either mask the part of the image that was filming the resting room, other than the door.
The AEPD fined the controller €20,000 for the violation of Article 5(1)(c) GDPR, reduced to €16,000 due to early payment.
Additionally, the AEPD found that the informative signs regarding the video cameras were not up-to-date, as they only mentioned the former Spanish Data Protection Act. The AEPD considered that the controller had had enough time to update the signs since the publication and the entry into force of the GDPR, and that therefore the controller had violated Article 12 GDPR, by not fulfilling their information obligations.
The AEPD fined the controller €6,000 for the violation of Article 12 GDPR, reduced to €3,600 due to the recognition of responsibility and early payment.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.