AEPD (Spain) - PS/00393/2021
|AEPD - PS/00393/2021|
|Relevant Law:||Article 5(1) GDPR|
Article 13 GDPR
Art. 22 LOPDGDD
|National Case Number/Name:||PS/00393/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Sergi Ariño Mayans|
The Spanish DPA fined an establishment with €3000 for having surveillance cameras (CCTV) recording excessively public space
An individual lodged a complaint with the Spanish DPA (AEPD) arguing that an establishment has set a hidden video surveillance camera not exclusively oriented to the establishment's property. The individual claimed that the camera recorded 24h the front door of his house.
The DPA held, that it is responsability of the controller to make sure his surveillance cameras are set up in a lawful manner.
The surveillance cameras must be oriented to the private property, otherwise that might constitute a privacy violation for third parties, even in the event of a "simulation" camera, which might lead to third parties believe that they are being permanently recorded. Besides, recording public spaces is an exclusive competence of the spanish state.
The DPA held that the camera was recording excesively public space without having a proper sign in place warning about being a video-recorded zone, and providing basic information such as the purpose and controller of the CCTV system.
Therefore, the AEPD imposed a fine of €2000 to the establishment for a violation of the Article 5(1)(c) GDPR, for having surveillance cameras recording excessively public space, and €1000 for a violation of Article 13 GDPR, given the lack of an informative sign about the video-recorded zone.
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7 File No.: PS/00393/2021 RESOLUTION OF PUNISHMENT PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following FACTS FIRST: A.A.A. (*hereinafter, the complaining party) dated April 12, 2021 filed a claim with the Spanish Data Protection Agency. The claim is directed against LODEJU, S.L. with NIF B92047745 (hereinafter, the part claimed). The grounds on which the claim is based are as follows: "He has placed hidden among the plants a camera with a colored casing. white as indicated in the attached photo. This camera is oriented towards the door. entrance door of my house (...)”-folio nº 1--. “Finally, I want to express that in our case we found out about the existence ence of said chambers by the same claimed. Because on March 17, 2021 sends a WhatsApp to my husband, expressing that he has cameras recording the 24 hours (I enclose the screenshot of said conversation”.—folio nº 1--. Together with the claim, it provides documentary evidence (Annex I) that proves the presence of the device, as well as images obtained from the device in question. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred to the claimed party in fe- cha 04/30/21 and 06/24/21, to proceed to its analysis and inform this Agency within a month, of the actions carried out to adapt to the requirements provided for in the data protection regulations. No response to this letter has been received, nor has any reasoned explanation been has made on the device in question. THIRD: On July 27, 2021, the Director of the Spanish Agency for Pro- Data protection agreed to admit for processing the claim presented by the claimant party. keep. FOURTH: On September 10, 2021, the Director of the Spanish Agency of Data Protection agreed to initiate sanctioning procedure to the claimed, with in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of Article 5.1.c) of the RGPD, typified in the Article 83.5 of the RGPD. FIFTH: The database of this Agency consulted on 10/20/21 has not been C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 2/7 received any allegation in this regard, nor has the reason for the installation of the camera(s). SIXTH: On 10/21/21, the collaboration of the Security Forces and bodies is requested. Security of the town (Marbella-Málaga City Council) so that displaced people place of the facts verify the presence and operability of the cameras object of claim. SEVENTH: On 11/02/21 a Local Police Report (Marbella-Málaga) was received in where Don B.B.B., responsible for the Shop (...) and Restaurant (...). The reasons for the installation of the cameras are security reasons for the establishment(s) of its ownership as a result of "thefts" that occurred in the area, without further specs. Images are provided where the capture of public space in the outside area of tables of the hotel establishment (Page No. 5-6 Police Report Local-Marbella 01/11/21). Item, documentary evidence is provided that proves the presence of a cartel(s) yes well in the same one only informs about the installation, not being posters approved to current regulations in force, not identifying the data controller. EIGHTH: On 01/17/22, a “Resolution proposal” was issued, considering accredited the presence of cameras that excessively record public space, without proper signage, which is why a sanction of three thousand euros (€3,000), for the infringement of articles 5.1 c) and 13 RGPD. Of the actions carried out in this procedure and the documentation in the file, the following have been accredited: PROVEN FACTS First. The facts bring cause of the claim dated 04/12/21 through the which translates the following "he has placed hidden among the plants a camera with a white casing as indicated in the attached photo. This camera is oriented towards the entrance door of my house (...)”-folio nº 1--. “Finally, I want to express that in our case we found out about the existence ence of said chambers by the same claimed. Because on March 17, 2021 sends a WhatsApp to my husband, expressing that he has cameras recording the 24 hours (I enclose the screenshot of said conversation”.—folio nº 1--. Together with the claim, it provides documentary evidence (Annex I) that proves the presence of the device, as well as images obtained from the device in question. Second. It is identified as the main person in charge of the installation Don B.B.B., as reflected in the Local Police report (Marbella) dated 11/01/21. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 3/7 Third. It is proven that the person claimed does not have an informative badge in the area visible informing that it is a video-monitored area, indicating the "responsible of the treatment” or the purpose of capturing the images. Fourth. The presence of video-surveillance devices that affect to a public area without just cause, exercising a control reserved to the Forces and State security forces, obtaining images of public space where Various tables have been placed next to the Restaurant establishment (...). Fifth. No documentation has been provided that proves the theft. or other types of acts that justify, in the judgment of this body, the presence of cameras. FOUNDATIONS OF LAW Yo By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and according to the provisions of articles 47 and 48 of the LOPDGDD, the Director of the Spanish Agency for Data Protection is competent to initiate and to re- solve this procedure. II In the present case, the claim dated 04/12/21 is examined by me- gave from which the following is transferred as the main "fact": "He has placed hidden among the plants a camera with a colored casing. white as indicated in the attached photo. This camera is oriented towards the door. entrance door of my house (...)”-folio nº 1--. The art. 5.1 c) RGPD provides the following: The personal data will be: “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"). It should be remembered that individuals are responsible for ensuring that the systems installed felled comply with current legislation, proving that it complies with all the requirements demanded by the regulations in force. The installation of this type of device must have the mandatory informative sign. tive, indicating the purposes and responsible for the treatment, where appropriate, of the data of each personal character. In any case, the cameras must be oriented towards the particular space, avoiding intimidate neighboring neighbors with this type of device, as well as control areas transit of the same without just cause. With this type of device it is not possible to obtain image(s) of public space either. co, as this is the exclusive competence of the State Security Forces and Bodies ted. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 4/7 It should be remembered that even in the case of a "simulated" camera, the same should preferably be oriented towards private space, since it is considered that this type of device can affect the privacy of third parties, that they are inti- measured by it in the belief of being the subject of permanent recording. On the part of individuals, it is not possible to install devices for obtaining images of public space, outside the cases allowed in the regulations. III In accordance with the evidence available in this proceeding sanctioning party, it is considered that the claimed party has a chamber(s) of video-surveillance with which it controls the public sidewalk "processing third-party data" without justified cause, lacking proper signage. The known facts constitute an infraction, attributable to the party claimed, for violation of the content of art. 5.1 c) GDPR. Item, the establishment lacks an informative sign indicating that it is a video-monitored area, in such a way that passers-by are unaware that it is of a video-monitored area, the data being processed by a camera conveniently simulated. So that the exposed facts suppose a violation of art. 13 RGPD, lacking a duly approved informative label, indicating the res- responsible for the treatment or the purpose(s) of the treatment carried out with the device in question. Article 22 of Organic Law 3/2018 (December 5)-LOPDGDD- provides: "1. Natural or legal persons, public or private, may carry out the processing of images through camera systems or video cameras with the purpose of to preserve the safety of people and property, as well as its installations. nes. The AEPD, in a related report, stipulates that it is not necessary for car- TVs are placed just below the cameras. It is enough to do it in a visible place and that includes open and closed spaces where the video camera circuit is operative. This badge will be displayed in a visible place, and at least, at the entrances to the monitored areas whether indoors or outdoors. In the event that the video surveillance space If it has several entrances, it must have said video zone badge. gilada in each of them. The fact that the owner of the hotel activity has a License for terrace, does not justify the installation of a video-surveillance system that controls the an- public space, this being a task reserved for the Police Forces and Corps. Security of the Town, who are the ones who have to video-monitor the space, if applicable public. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 5/7 Remember that the cameras must be oriented (vgr in the case of the store) da) at most to the facade of the same to avoid as a guideline the breakage of the storefront or towards the main points of access to it, while the interiors must be marked with an informative poster indicating the presence of the same more to the potential clients of the same. IV The art. 83.5 RGPD provides the following: “Infringements of the following provisions will be sanctioned, in accordance with section 2, with administrative fines of 20 EUR 000,000 maximum or, in the case of a company, an equivalent amount. to a maximum of 4% of the total global annual turnover of the financial year above, opting for the highest amount: a) the basic principles for the treatment, including the conditions for the consent under articles 5, 6, 7 and 9; b) the rights of the interested parties under articles 12 to 22 (…) When motivating the sanction, the following is taken into account: - the nature, seriousness and duration of the offence, taking into account the nature nature, scope or purpose of the treatment operation in question, as well as the number of interested parties affected and the level of damages suffered fried; (art. 83.2 a) RGPD). - the intent or negligence in the infringement; (art. 83.2 b) RGPD), to the proce- to obtain images of a public area, whose competence is reserved to the State Security Forces and Bodies, being the same considered a negligence serious agency for the reasons stated. The cameras are oriented towards the public transit area, exceeding the angle collection necessary for the protection of the establishment, affecting rights of third parties who are intimidated by them as they consider themselves to be recorded by them, not being the same informed with the presence in visible area of informative poster(s) about it. So it is considered correct to impose a sanction encrypted in the amount €2,000 (two thousand euros) for the violation of art. 5.1 c) GDPR and €1,000 (Thousand euros) for the infringement of art. 13 RGPD, lacking the required signage, being the total sum of both amounts €3000 (three thousand euros), sanction located on the scale lower for this type of behavior. Therefore, in accordance with the applicable legislation and after assessing the graduation criteria tion of the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE the company LODEJU, S.L., with NIF B92047745, for an in- fraction of Article 5.1.c) and 13 of the RGPD, typified in Article 83.5 of the RGPD, a fine of €3,000 (three thousand euros). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 6/7 SECOND: NOTIFY this resolution to the entity LODEJU, S.L. (major responsible Don B.B.B.). THIRD: Warn the sanctioned party that he must make the imposed sanction effective once Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co- of the Public Administrations (hereinafter LPACAP), within the term of payment voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, through its entry, indicating the NIF of the sanctioned and the number of procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency Department of Data Protection at the banking entity CAIXABANK, S.A.. In case of Otherwise, it will be collected during the executive period. Received the notification and once executed, if the date of execution is between the 1st and 15th of each month, both inclusive, the term to make the payment will be until the 20th day of the following month or immediately after, and if is between the 16th and last day of each month, both inclusive, the term of the payment It will be valid until the 5th of the second following month or immediately after. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the resents may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from the date of the day following the notification of this resolution or directly contentious appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the additional provision Final fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction- administrative, within a period of two months from the day following the notification tion of this act, as provided for in article 46.1 of the aforementioned Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the firm resolution in administrative proceedings if the interested party do states its intention to file a contentious-administrative appeal. If it is- In this case, the interested party must formally communicate this fact in writing addressed to the Spanish Agency for Data Protection, presenting it through the Re- Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or to through any of the other registers provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the effective filing of the contentious-administrative appeal. If the Agency was not aware of the filing of the contentious-administrative appeal tive within two months from the day following the notification of this resolution, would end the precautionary suspension. 938-270122 Sea Spain Marti C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 7/7 Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es