AEPD (Spain) - PS/00389/2021
|AEPD (Spain) - PS/00389/2021|
|Relevant Law:||Article 5(1)(c) GDPR|
|Parties:||LA OFICINA BAR|
|National Case Number/Name:||PS/00389/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
A bar was fined €1500 for installing video surveillance cameras pointed towards a public street, violating the data minimisation principle under Article 5(1)(c) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
A case was filed against LA OFICINA BAR for installing two video surveillance cameras oriented towards a public street and not towards their private area, thus surveilling the movement of all citizens circulating on the street.
Holding[edit | edit source]
The Spanish DPA (AEPD) recalled that the installation of this type of device must be accompanied by a mandatory information sign, indicating the purposes and the person responsible for the processing of personal data, if applicable. In any case, the cameras must be oriented towards private areas, to avoid intimidating neighborhoods with this type of device, as well as surveilling public transit areas without a justified cause. The AEPD held that this type of device cannot be used to obtain images of public space, as this is the exclusive competence of the State Security Forces and Corps.
The AEPD considered that, in accordance with the evidence available in the procedure, the defendant had two video-surveillance cameras that affect a public traffic area without a justified reason. Therefore the DPA imposed a fine of €1500 on LA OFICINA BAR for violating the data minimisation principle under Article 5(1)(c) GDPR.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 Procedure No.: PS/00389/2021 RESOLUTION OF PUNISHMENT PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following FACTS FIRST: A.A.A. (*hereinafter, the complaining party) dated May 21, 2021 filed a claim with the Spanish Data Protection Agency. The claim is directed against LA OFFICE BAR XXXX with CIF 49981173B (in hereafter, the party claimed). The grounds on which the claim is based are following. “Installation of 2 video surveillance cameras oriented towards public roads and not to their private area thereby controlling the movement of all citizens that circulate on the road. The orientation of the cameras...”—folio nº 1--. Along with the claim, provide documentary evidence that proves the presence of the cameras on the outside of the facade of the establishment with palm trees orientation towards public space (Annex I frames 1-4). SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred to the claimed party in fe- cha 05/27/21 and 06/18/21, to proceed to its analysis and inform this Agency within a month, of the actions carried out to adapt to the requirements provided for in the data protection regulations. No response has been received to this letter, nor any explanation about the cameras has produced. THIRD: On July 26, 2021, the Director of the Spanish Agency for Pro- Data protection agreed to admit for processing the claim presented by the claimant party. keep. FOURTH: On September 10, 2021, the Director of the Spanish Agency of Data Protection agreed to initiate a sanctioning procedure against the claimed, for the alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the GDPR. FIFTH: On 10/15/21, it is verified that no allegation has been received by the claimed party, nor has the system been regularized. In view of everything that has been done, by the Spanish Data Protection Agency In this proceeding, the following are considered proven facts: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 2/6 FACTS First. The facts bring cause of the claim dated 05/21/21 through the which translates the following: “Installation of 2 video surveillance cameras oriented towards public roads and not to their private area thereby controlling the movement of all citizens that circulate on the road. The orientation of the cameras...”—folio nº 1--. Together with the claim, it provides documentary evidence that proves the presence of the cameras on the outside of the establishment's facade with oriented palm trees tion towards public space (Annex I frames 1-4). Second. The Bar Office entity is identified as the main responsible entity. XXXX. Third. There is evidence of the presence of two exterior chambers whose orientation allows them to capture public space without just cause. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and according to the provisions of articles 47 and 48 of the LOPDGDD, the Director of the Spanish Agency for Data Protection is competent to initiate and to re- solve this procedure. II Before going into the substance of the matter, it should be noted that, as indicated in the Agreement of Start date 09/10/21, in case of absence of allegations it could be "considered as a resolution proposal", referring to what was stated in the same for reasons of procedural economy. In the present case, we proceed to analyze the claim dated 05/21/21 by means of gave from which the following is transferred as the main fact “Installation of 2 video surveillance cameras oriented towards public roads and not to their private area thereby controlling the movement of all citizens that circulate on the road. The orientation of the cameras...”—folio nº 1--. The image of a person is a "personal data" as long as it can be identified, which can be treated in different ways, for different purposes. The purpose of a video-surveillance system is the security of the property private property and residents against external aggression (eg robbery with force in the things). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 3/6 The art. 5.1 c) RGPD provides the following: The personal data will be: “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"). It should be remembered that individuals are responsible for ensuring that the systems installed felled comply with current legislation, proving that it complies with all the requirements demanded by the regulations in force. The installation of this type of device must have the mandatory informative sign. tive, indicating the purposes and responsible for the treatment, where appropriate, of the data of each personal character. In any case, the cameras must be oriented towards the particular space, avoiding intimidate neighboring neighbors with this type of device, as well as control areas transit of the same without just cause. With this type of device it is not possible to obtain image(s) of public space either. co, as this is the exclusive competence of the State Security Forces and Bodies ted. It should be remembered that even in the case of a "simulated" camera, the same should preferably be oriented towards private space, since it is considered that this type of device can affect the privacy of third parties, that they are inti- measured by it in the belief of being the subject of permanent recording. On the part of individuals, it is not possible to install devices for obtaining images of public space, outside the cases allowed in the regulations. III In accordance with the evidence available in this proceeding, sanctioning act, it is considered that the claimed party has two chambers of video-surveillance that affect public transit areas without just cause. The evidence provided (Doc. Annex I) allows verifying the presence of two devices that are blatantly oriented towards the public sidewalk, affecting rights of third parties without just cause, being a negligent conduct to the effects of the administrative infraction. Security cameras installed in private spaces will not be able to obtain images public spaces, the security function of public spaces corresponding to exclusively to the State Security Forces and Bodies, not to the Companies Private Security companies. The known facts constitute an infraction, attributable to the party claimed for violation of the content of art. 51. C) GDPR, cited above. IV C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 4/6 The art. 83.5 RGPD provides the following: “Infringements of the following provisions will be sanctioned, in accordance with section 2, with administrative fines of 20 EUR 000,000 maximum or, in the case of a company, an equivalent amount. to a maximum of 4% of the total global annual turnover of the financial year above, opting for the highest amount: a) the basic principles for the treatment, including the conditions for the consent under articles 5, 6, 7 and 9; When motivating the sanction, the following is taken into account: - the nature, seriousness and duration of the offence, taking into account the nature nature, scope or purpose of the treatment operation in question, as well as the number of interested parties affected and the level of damages suffered fried; (art. 83.2 a) RGPD). - the intent or negligence in the infringement; (art. 83.2 b) RGPD), by not doing have adopted the necessary measures to prevent the orientation of the cameras towards the public sidewalk, the conduct described being at least slightly negligent. The cameras are oriented towards the public transit area, exceeding the angle collection necessary for the protection of the establishment, affecting rights of third parties who are intimidated by them as they consider themselves to be recorded for the same In accordance with article 58.2 d) RGPD, the claimed party must clarify the reason (s) of the installation of the system, as well as in its case that is captured with the same (providing screen printing with date and time) or failing that, prove that It is a simulated camera, providing a copy of the invoice, if applicable, of the same or either proceed to reorient it exclusively towards the façade area of the local. For all this, it is agreed to impose a sanction encrypted in the amount of €1,500, offense located on the lower scale for this type of behaviour. Therefore, in accordance with the applicable legislation and after assessing the graduation criteria tion of the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE BAR XXXX OFFICE, with NIF 49981173B, for an infraction tion of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of €1,500 (One thousand five hundred euros). SECOND: ORDER the respondent so that within ONE MONTH from the notification cation of this administrative act proceed to regularize the situation described reo- orienting the cameras towards the façade area of their entertainment venue, accrediting such ex- I tremble to this organism. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 5/6 THIRD: NOTIFY this resolution to THE BAR XXXX OFFICE and INFORM MAR of the result of the actions to the claimant party A.A.A. FOURTH: Warn the sanctioned party that he must make the imposed sanction effective once Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co- of the Public Administrations (hereinafter LPACAP), within the term of payment voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, through its entry, indicating the NIF of the sanctioned and the number of procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency Department of Data Protection at the banking entity CAIXABANK, S.A.. In case of Otherwise, it will be collected during the executive period. Received the notification and once executed, if the date of execution is between the 1st and 15th of each month, both inclusive, the term to make the payment will be until the 20th day of the following month or immediately after, and if is between the 16th and last day of each month, both inclusive, the term of the payment It will be valid until the 5th of the second following month or immediately after. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the resents may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from the date of the day following the notification of this resolution or directly contentious appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the additional provision Final fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction- administrative, within a period of two months from the day following the notification tion of this act, as provided for in article 46.1 of the aforementioned Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the firm resolution in administrative proceedings if the interested party do states its intention to file a contentious-administrative appeal. If it is- In this case, the interested party must formally communicate this fact in writing addressed to the Spanish Agency for Data Protection, presenting it through the Re- Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or to through any of the other registers provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the effective filing of the contentious-administrative appeal. If the Agency was not aware of the filing of the contentious-administrative appeal tive within two months from the day following the notification of this resolution, would end the precautionary suspension. 938-131120 Sea Spain Marti C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 6/6 Director of the AEPD, P.O. the Deputy Director General for Data Inspection, Olga Pérez Sanjuán, Resolution 4/10/2021 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es