AEPD (Spain) - PS/00445/2022
|AEPD - PS/00445/2022|
|Relevant Law:||Article 6 GDPR|
|Parties:||GRUPO TRANSAHER, S.L.|
|National Case Number/Name:||PS/00445/2022|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA fined a logistics company €50,000 for installing videocameras in the employees' rest area, in violation of Article 6 GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
In June 2022, the data subject filed a complaint with the Spanish DPA, claiming that GRUPO TRANSAHER, the controller, had installed surveillance cameras in workers' rest areas such as the canteen. The data subject also claimed that the informative notice regarding the cameras was not visible or did not exist.
In July 2022, the controller replied to the complaint, admitting the installation of the cameras and providing more detailed information about them.
First, the controller argued that it has a logistics park where a large number of people circulate and therefore it is necessary to ensure a high level of security, monitoring and protecting property and people in the building. For this reason, the controller considered that it was legitimate to video-surveil the entire work center, including the industrial building and the offices.
Second, with regard to the workers' rest area, it argued that it is actually a common area open 24 hours and is not intended for the exclusive rest of the workers. According to the controller, the room does not have restricted access for the exclusive use of employees, also being used by clients, customers, suppliers and freelancers.
Third, the controller pointed out that it performed a proportionality test and implemented mitigating measures such as providing informative notices, deleting the recordings after 30 days and limiting the access to the images to only 5 persons. Finally, the controller stated that in the employment contract there is a clause informing employees about the use of video surveillance systems for security purposes.
Holding[edit | edit source]
The Spanish DPA found that the use of surveillance cameras in an enclosed room, used as a canteen, was disproportionately invading the employee's privacy. The DPA highlighted that while Article 20.3 Workers' Statute Law allows the use of videocameras for labor control, this control must respect some limitations, such as the worker's dignity. Similarly, Article 89.2 LOPDGDD prohibits, in any case, the installation of image recording systems "in places intended for the rest or recreation of the workers, such as changing rooms, toilets, canteens and the like."
For these reasons, the DPA found a violation of Article 6 GDPR and fined the controller €50,000.
The controller appealed the decision, but the appeal was dismissed as it did not provide new facts or legal arguments that allow the decision to be reconsidered.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/25 File No.: EXP202206735 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: A.A.A. (hereinafter, the claimant), on 06/10/2022, filed claim before the Spanish Data Protection Agency. The claim is directed against GRUPO TRANSAHER, S.L., with NIF B78147758 (hereinafter, the party claimed or TRANSAHER), for the installation of a video surveillance system, located at ***ADDRESS.1, there being indications of a possible breach of the provided in article 6 of Regulation (EU) 2016/679 (General Regulation of Data Protection, hereinafter GDPR). The reasons for the claim are the following: The claiming party states that the claimed party has installed security cameras video surveillance in rest areas for workers, such as the dining room for workers workers. The claimant understands that it is a "camera installed illegally that controls the workers.” Likewise, it states that the informative posters related to security cameras video surveillance “are not well installed or do not exist”. Provide images of the location of a video surveillance camera in a dining room large dimensions, in which numerous tables for four can be seen diners, a kitchen furniture area that has eight microwaves and another area with three vending machines (cold drinks, hot drinks and snacks). In the photos provided, informative posters about the system of video surveillance. In view of the images, it can be seen that the dining room has windows to the exterior on two of its sides, which form one of the corners of the room. in one of These sides are located the video surveillance camera focused on the dining room interior. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in forward LOPDGDD), said claim was transferred to the claimed party, for to proceed with its analysis and inform this Agency within a month of the actions carried out to adapt to the requirements established in the regulations of Data Protection. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/25 The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, of the Common Administrative Procedure of the Administrations Public (hereinafter, LPACAP), was collected on 06/14/2022 as stated in the acknowledgment of receipt in the file. On 07/13/2022, this Agency received a written response from the party claimed, in which it provides complete information on its video surveillance system and acknowledges having cameras installed in the dining room, stating in his response the reasons that have led to its installation: . It is a company that, due to the purpose of its business (transport and logistics), (...) You need to have high security. It shares a logistics park (...), with large influx of people, both workers and freelancers who provide their jobs there services (...), ETT staff, customers and suppliers. . Given the circumstances expressed above, and by virtue of article 20.3 of the Workers' Statute, the entire workplace, including the industrial warehouse and offices are video-surveilled by cameras, which only record images, in no case audio. Its installation is proportional in terms of the weighting of the power of direction and control of business activity and the right to the privacy of the interested parties, who are aware of the use of their data that entails the employment relationship, purpose and mechanisms to exercise recognized rights. . There are signs that announce the installation of these cameras (provide photographs about its content and location, including the badge installed in the dining room to which refers to the claim). . Only five people are authorized to view the images; (…). . Images are stored for 30 days. . The system is certified by a security company, which is also responsible for of their review (they provide the latest technical report from February). . It has informed the existence of the video surveillance system both to the Committee of The company and the workers, who sign an informative clause in their contract (model taken from SEPE), receive a welcome manual with information relevant, which is completed in the employee portal. In this regard, provide a copy of the document signed by the workers in which it is indicated that they remain unequivocally informed of the "use of video surveillance systems to business control”. This document includes a space for the worker's signature, preceded by the following text: "By signing this document, the worker declares that he has read and understood in all its extension the aforementioned information that will be available at all times for consultation in the employee portal and a copy is delivered to the interested party”. . (…). The defendant refers to "the camera located in the dining room", noting that This room is an area for common use and passage open 24 hours a day, which does not C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/25 It has the purpose of the exclusive rest of the workers. (…). Does not have access restricted to the exclusive use of employees, but is also used by customers, providers, freelancers, service companies and ETT workers; and in it They find 4 vending machines, 2 refrigerators, several microwaves and an oven. It adds that they have suffered theft of products from the refrigerators, acts of vandalism in front of to the vending machines to obtain the products without paying and in 2013 a worker put a soft drink in the microwave causing the appliance to set fire According to the entity, all of this entails a risk for tangible assets, own or third parties (vending machines) and for people that the employer has the duty to prevent and avoid, in accordance with the regulations for the prevention of labor risks, and that can lead to civil liability of the company. In addition, it indicates that the video surveillance area's label informs that its purposes are "to monitor and protect the goods and people of the plant”. The installed system complies with the proportionality judgment set by the Court Constitutional: . Legitimacy, as long as it is not mere suspicions about the existence of illegal actions repeated over time, including robberies produced through the Windows. . Suitable for the purpose intended by the company, to determine who or who are the authors of said damages, as well as the protection of the goods your own as well as those you have on deposit. . Necessary, since the recording would serve as proof of such irregularities and not there is another type of less intrusive means to achieve the aforementioned purpose . Proportionality, since the recording of images was limited to the area previously informed and visualizes the company utilities, vending machines and windows, as it is a transit area with a large number of people. According to the defendant, the latest jurisprudential doctrine states that the installation of cameras is lawful and does not violate any fundamental right when the workers have been expressly informed of the installation of the system surveillance and their location for security reasons, an expression that includes surveillance of illegal acts by workers and third parties and, in Ultimately, the safety of the workplace. But, in addition, it also considers it lawful, even if it is not previously reported to the worker, if the installation of the camera is carried out due to suspicion of irregular behavior and is placed in full view of the workers, although they are not warned of their possible use for disciplinary purposes, since they understand that in the workplace, the consent of the worker for the treatment by the company of your personal data goes into the background, since the Consent is understood to be implicit in the business relationship, provided that the processing of said data is necessary for the maintenance and fulfillment of the contract signed by the parties and the fundamental rights of the person are not infringed worker. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/25 Provide a photograph of the informative poster used, which is in accordance with the regulations of data protection, and photographs with the locations of several of those exposed, one of them in the dining room. He also provided images (more than 100) over the field of view of the cameras installed, as displayed on the monitors. (…). One of the images provided corresponds to the camera object of the claim, the installed in the dining room. The information provided by this image is detailed in the Fact Proven Third. THIRD: On 08/19/2022, in accordance with article 65 of the LOPDGDD, The claim presented by the complaining party was admitted for processing. FOURTH: On 10/24/2022, by the General Subdirectorate of Data Inspection information related to the claimed party is accessed in “Axesor” (“Informe monitors"). (…). FIFTH: On 10/31/2022, the Director of the Spanish Agency for the Protection of Datos agreed to initiate disciplinary proceedings against the claimed party, in accordance with the provided in articles 63 and 64 of the LPACAP, for the alleged violation of article 6 of the GDPR, typified in article 83.5.a) of the aforementioned Regulation; and qualified as very serious for the purposes of prescription in article 72.1.b) of the LOPDGDD. In the opening agreement it was determined that the sanction that could correspond, attention to the existing evidence at the time of opening and without prejudice to the resulting from the instruction, would amount to a total of 50,000 euros (fifty thousand euro). Likewise, it was warned that the accused infringement, if confirmed, may lead to the imposition of measures, according to article 58.2 d) of the GDPR. SIXTH: Notified the aforementioned start agreement in accordance with the rules established in the LPACAP, the claimed party presented a pleading in which it requests the procedure file based on the following considerations: . In advance, it informs that it has learned the identity of the complaining party with the notification of initiation of the procedure (…). . For the rest, it ratifies the allegations that it revealed during the procedure transfer of the claim, outlined in the Second Antecedent, reiterating that the video surveillance area is signposted; that the workers; that it is not a camera for the control of the workers, but which is located in an area of common use and passage to which not only those access; and that its purpose is to protect the health and safety of workers, as well as material and business assets, as evidenced by the acts of vandalism suffered by vending machines, a circumstance that has not been valued by the Agency. Warns that, contrary to what is indicated in the initiation agreement, the claimed party does C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/25 He provided a photograph of the camera located in the passageway that adjoins the dining room. Provide again this photograph corresponding to the image captured by the camera in question. In this image it can be seen that the camera captures the entire room, including the tables arranged in the dining room, which appear in the image shaded with a mask. The image shows the vending machines and all the space that separates them from the tables (the detail about the space captured consists of outlined in the Third Proven Fact). On this last question, he cites two precedents, marked with the numbers E/09297/2018 and E/01760/2017, referring to the installation of cameras in areas of rest oriented to the goods that are intended to be protected, in which the Agency resolved the file of proceedings. Also in relation to the possibility of installing cameras to protect heritage business when irregularities have been committed or there are suspicions of it, cites the party claimed the Judgment no. 630/2016 of the Supreme Court and Judgment of 10/17/2019 of the European Court of Human Rights. . Finally, the TRANSAHER entity reiterates that it has complied with the judgment of proportionality set by the Constitutional Court and ends by invoking the Judgment num. 1190/2021, of the Social Chamber of the Superior Court of Justice of the Islands Canary Islands in which it is expressed: “It is recognized, however, that a minor portion of the camera's field of view corresponded to a place of recreation for working people, but obviously not All places of recreation can have the same consideration (waiting rooms, parking, dining rooms in relation to others such as showers, changing rooms, etc.). So there could be a need to monitor those places and even people's belongings workers. This should lead us, in the appellant's opinion, to apply in this case the principle of proportionality in relation to the principle of minimization of the data referred to”. SEVENTH: On 03/06/2023, a resolution proposal was formulated in the sense of that the claimed party be penalized for a violation of article 6 of the GDPR, typified in article 83.5.a) of the same Regulation, and qualified for the purposes of prescription as very serious in article 72.1.b) of the LOPDGDD, with a fine of 50,000 euros (fifty thousand euros). Likewise, it was proposed that the claimed party be required so that, within the term determined, adopt the necessary measures to adapt its performance to the personal data protection regulations, with the scope expressed in the Legal basis VII of the proposed resolution. Notification of this resolution proposal was delivered to the claimed party in the same date of 03/06/2023 through the Enabled Electronic Address service Sole (DEHÚ), being granted a term to formulate allegations. EIGHTH: On 03/10/2023, a letter from the party claimant in which he states "that, having made the company available to the claimant as well as the lawyers all the documentation that accredits the exposed in the allegations made by the company, by means of the present proceed to C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/25 waive any compensation that may correspond to him for the processing of the file..., as well as to request the filing of the file". NINTH: On 03/17/2023, a written statement of allegations to the proposal for resolution in which the claimed party reiterates and ratifies its previous allegations and request the procedure file again. In this writing, the defendant reveals the following: . The area between the vending machines and the dining room is a transit area, which is It is communicated by two doors that communicate different spaces of the ship industrial. (...) (provides a plan that marks the area of passage to which referred to by the defendant). According to the defendant, "it is a transit area that crosses an area of tables intended for the dining room, but in no case can it be considered that all the This space is a place of rest, since many people pass through this area (…). The orientation of the camera requires the need to ensure, in addition to what Exposed below, the access from the street to the interior of the enclosure”. Based on this, it is contrary to the assessment of the AEPD, in that the field of vision of the camera belongs to the dining room. considers it inevitable that said area remains within the field of view of the camera due to the need to Secure access to the transit area. And he adds that, "despite being an area that must inevitably cross all the people who access the dining room to make use of the room, it is also inevitable that they cross the rest of the halls of the ship and the workplace video surveillance to reach the dining room. Therefore, this area should be considered a exclusive area of passage and no viewing of any sensitive area of the personnel for not be a place intended for rest, since the area intended for rest has already been is entirely masked, scrupulously complying with the privacy from the workers". On the other hand, it indicates that the AEPD has not taken into account that the machines of vending suffer constant acts of vandalism, as evidenced in the actions, and that it is essential to protect tangible and business assets, as well as such as the health and safety of workers, in an area with a high influx of people who access the different rooms from outside through the area in question 24 hours a day. It reiterates that the present case conforms to what is indicated in the resolution of the file number E/09297/2017, according to which the installation of cameras in a transit area that could be considered a break for the AEPD is exceptional and It is considered legal if the taking of images of the goods that may suffer damage is limited. threats. He wonders what less intrusive means he could have used to prove the damage caused to the vending machines or the theft of products without payment from the price; once again alleges that it has complied with the proportionality judgment established by the Constitutional Court; and mentions, with respect to suitability, the Judgment C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/25 432/2022, of the Contentious Administrative Chamber of the National Court of 01/31/2022. Likewise, it states that the complaining party has informed the company that has requested the AEPD to file the proceedings, after examining the documentation that proves the allegations of the claimed party. The defendant concludes that the video surveillance of the area is not capricious, but that it is a justified installation whose image capture field only includes the assets of the company's patrimony as well as the security of the people who make up the workplace, leaving out of the field of vision the tables, guaranteeing the privacy of the workers, so it cannot be seen conduct that violates a fundamental right; that the AEPD does not have in note that there are informative posters and all security measures have been taken. information to workers; (…); and that the recordings are not preserved time of the legally established, (...). Regarding the graduation of the proposed sanction, it alleges that it is proportionate considering that the privacy of workers in the table area is protected intended for a dining room, the recording is deleted in accordance with the legal provisions (…). With its allegations, the claimed party provides a floor plan in which the locate the dining room (…). Of the actions carried out in this procedure and of the documentation in the file, the following have been accredited: PROVEN FACTS FIRST: The claimed party, dedicated to transport and logistics, develops its economic activity in facilities located at ***ADDRESS.1. according to manifested by the claimed party, the influx of people to these facilities is high, whether they are workers (...), freelancers who provide their services there (...), staff from ETT, customers and suppliers. SECOND: The facilities described in the previous Proven Fact have a video surveillance system for which the claimed party is responsible. THIRD: Of the many cameras that the security system has, video surveillance installed by the claimed party in its premises located in ***ADDRESS.1, one of them is located in a dining room used by workers of the claimed party and other persons who access the facilities. It is a large room and has numerous tables for four people, a kitchen furniture area that has eight microwave and another area with several vending machines (cold drinks, drinks hot drinks and snacks). The dining room has exterior windows on two of its sides, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/25 in one of which the focused video surveillance camera is located into the dining room. The field of view of this camera captures the entire room. On the left side of the image you can see the vending machines and on the right the tables located next to the windows that face the outside, although the area where the tables are located is is protected by a mask that covers the exact limit of the space that occupy the tables. Between both areas (vending machines and dining tables) there is a wide space, about two meters wide and from end to end of the stay, which is fully captured by the camera in question. The space that separates the vending machine area and the tables belongs entirely to the interior of the dining room, which must inevitably cross all the people who They access the dining room to make use of the room. FUNDAMENTALS OF LAW Yo Competence In accordance with the powers that article 58.2 of the GDPR grants to each authority of control and as established in articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, The Director of the Agency is competent to initiate and resolve this procedure Spanish Data Protection. Likewise, article 63.2 of the LOPDGDD determines that: "Procedures processed by the Spanish Data Protection Agency will be governed by the provisions in Regulation (EU) 2016/679, in this organic law, by the provisions regulations dictated in its development and, insofar as they do not contradict them, with character subsidiary, by the general rules on administrative procedures”. II Withdrawal of the complaining party The claiming party has stated that the claimed party has made available the documentation that proves their allegations and that, based on this, requests the file the procedure, waiving any compensation that may correspond. This claim must be rejected, considering that the complaining party is not interested party in the procedure, which prevents him from intervening in it. Besides, The purpose of these proceedings is not aimed at recognizing a right of the claiming party to be indemnified, but to determine the possible existence of a infringing conduct by the claimed party and the consequences that derive from it. Said request must also be rejected, even if the writing was taken presented by the complaining party as a withdrawal of their claim. Proceeds point out in this regard what is established in article 63.1 of the LPACAP, according to which “the procedures of a sanctioning nature will always be initiated ex officio by agreement C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/25 of the competent body", establishing in article 68 of the LOPDGDD that corresponds to the "Presidency of the Spanish Data Protection Agency, when appropriate, issue an agreement to start the procedure for the exercise of the sanctioning power”. Thus, for the claiming party to withdraw their claim is irrelevant and does not imply the filing or completion of the disciplinary procedure initiated, since it begins and is processed in all its phases ex officio. II The image is a personal data The physical image of a person, according to article 4.1 of the GDPR, is data personnel and their protection, therefore, is the subject of said Regulation. In article 4.2 of the GDPR defines the concept of "processing" of personal data. The images generated by a system of cameras or camcorders are data of personal nature, so its treatment is subject to the protection regulations of data. It is, therefore, pertinent to analyze whether the processing of personal data (image of the natural persons) carried out through the denounced video surveillance system is in accordance with the provisions of the GDPR. IV. Infringement. Regulatory framework Article 6.1 of the GDPR establishes the assumptions that allow the use of processing of personal data. "1. Processing will only be lawful if at least one of the following conditions is met: a) the interested party gave his consent for the processing of his personal data for one or various specific purposes; b) the treatment is necessary for the execution of a contract in which the interested party is a party or for the application at his request of pre-contractual measures; c) the processing is necessary for compliance with a legal obligation applicable to the responsible for the treatment; d) the processing is necessary to protect the vital interests of the data subject or of another person physical; e) the processing is necessary for the fulfillment of a task carried out in the public interest or in the exercise of public powers conferred on the data controller; f) the treatment is necessary for the satisfaction of legitimate interests pursued by the user. responsible for the treatment or by a third party, provided that such interests are not the interests or fundamental rights and freedoms of the data subject prevail require the protection of personal data, in particular when the data subject is a child. The provisions of letter f) of the first paragraph shall not apply to the treatment carried out by public authorities in the exercise of their functions. The permanent implantation of a system of video cameras for reasons of security has a legitimate basis in the LOPDGDD, the explanatory statement of which indicates: “Together with these assumptions, others are included, such as video surveillance… in which the legality of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/25 treatment comes from the existence of a public interest, in the terms established in the Article 6.1.e) of Regulation (EU) 2016/679”. Regarding treatment for video surveillance purposes, article 22 of the LOPDGDD establishes that natural or legal persons, public or private, may carry out carry out the treatment of images through systems of cameras or video cameras in order to preserve the safety of people and property, as well as their facilities. This same article 22, in its section 8, provides that "The treatment by the Employer data obtained through camera or video camera systems will be submits to the provisions of article 89 of this organic law”. This article 89 of the LOPDGDD, referring to the "Right to privacy against the use of video surveillance and sound recording devices in the workplace”. sets the following: "1. Employers may process the images obtained through camera systems or video cameras for the exercise of control functions by workers or employees provided for, respectively, in article 20.3 of the Workers' Statute and in the public function legislation, provided that these functions are exercised within its framework law and with the limits inherent to it. Employers must inform previously, and expressly, clearly and concisely, to the workers or public employees and, in your case, your representatives, about this measure. In the event that the flagrant commission of an illegal act has been captured by the workers or public employees, the duty to inform will be understood fulfilled when at least the device referred to in article 22.4 of this organic law exists. 2. In no case will the installation of sound recording systems or video surveillance in places intended for the rest or recreation of workers or public employees, such as locker rooms, toilets, dining rooms and the like. 3. The use of systems similar to those referred to in the previous sections for the sound recording in the workplace will be allowed only when relevant risks to the safety of facilities, goods and people derived from the activity that it takes place in the workplace and always respecting the principle of proportionality, the minimum intervention and the guarantees provided for in the previous sections. the deletion of the sounds preserved by these recording systems will be made according to the provided in section 3 of article 22 of this law”. On the legitimacy for the implementation of video surveillance systems in the field labor, Royal Legislative Decree 1/1995, of 03/24, is taken into account, which approves the revised text of the Workers' Statute Law (LET), whose article 20.3 notes: "3. The employer may adopt the measures he deems most appropriate for surveillance and control to verify compliance by the worker with his labor obligations and duties, keeping in their adoption and application due consideration to their dignity and taking into account account, where appropriate, the real capacity of workers with disabilities. The Constitutional Court, in Judgment 98/2000, of 04/10/2000, highlights in its legal basis 6 that “The jurisprudence of this Court has insisted repeatedly in the full effectiveness of the fundamental rights of the worker within the framework of the employment relationship, since this cannot imply in any way the deprivation of such rights for those who serve in organizations C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/25 productive, which are not alien to constitutional principles and rights. Without However, the mere manifestation of the exercise of the power of control by the employer so that the right of the worker is sacrificed. These limitations business must be those indispensable and strictly necessary to satisfy a business interest deserving of guardianship and protection, so that if there are other less aggressive and affective possibilities of satisfying said interest of the law in question, it will be necessary to use the latter and not those more aggressive and affective. It is, ultimately, the application of the principle of proportionality”. To check whether a restrictive measure of a fundamental right passes the trial of proportionality it is necessary to verify if it meets the three requirements or conditions following: . If such a measure is likely to achieve the proposed objective (judgment of suitability); . If necessary, in the sense that there is no other more moderate measure for the achievement of such purpose with equal effectiveness (judgment of necessity); . If it is weighted or balanced, because it derives more benefits or advantages for the general interest than damages to other goods or values in conflict (judgment of proportionality). Thus, among the surveillance and control measures admitted in the workplace are included the installation of security cameras, although these systems must respond always to the principle of proportionality, that is, the use of video cameras must be proportional to the purpose pursued, this is to guarantee the security and compliance with the job obligations and duties. In short, even though article 20.3 of the Workers' Statute authorizes the employer to adopt the measures he deems most appropriate for surveillance and control to verify compliance by the worker with his obligations and duties labor rights, this adoption must necessarily take into account the rights workers, respecting the rights to privacy and the right fundamental to data protection. Under the terms of the aforementioned article 89 of the LOPDPGDD, it is allowed that Employers can process the images obtained through camera systems or video cameras for the exercise of control functions of workers provided for in article 20.3 of the Workers' Statute "provided that these functions are exercised within its legal framework and with the limits inherent to it. In accordance with the foregoing, employers must inform in advance, and expressly, clearly and concisely, to the workers and, where appropriate, to their representatives, about this measure (article 89.1 of the LOPDGDD). Therefore, the treatment must be adjusted and proportional to the purpose for which it is carried out. directs. The relevance in the treatment of the data must occur both in the time of data collection as well as in the subsequent treatment that is carried out of them, so that the system of cameras or video cameras installed does not may obtain images affecting the privacy of employees, resulting in disproportionate to capture images in private spaces, such as changing rooms, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/25 lockers or worker rest areas. This is expressly established in the aforementioned article 89 of the LOPDGDD in relation to with the installation of video surveillance systems: "2. In no case will the installation of sound recording systems or video surveillance in places intended for the rest or recreation of workers or public employees, such as locker rooms, toilets, dining rooms and the like. According to this article, surveillance in workplaces should not include places reserved for the private use of employees or that are not intended for carrying out of work tasks (such as toilets, showers, changing rooms, dining rooms or work areas). rest). V Video surveillance obligations In accordance with the foregoing, the processing of images through a system video surveillance, to comply with current regulations, must comply with the following requirements: 1.- Individuals or legal entities, public or private, can establish a system video surveillance in order to preserve the safety of people and property, as well as its facilities. It must be assessed whether the intended purpose can be achieved in another less intrusive to the rights and freedoms of citizens. Personal data only should be processed if the purpose of the processing cannot reasonably be achieved by other means, recital 39 of the GDPR. 2.- The images obtained cannot be used for a subsequent purpose incompatible with the one that motivated the installation of the video surveillance system. 3.- The duty to inform those affected provided for in articles 12 must be fulfilled and 13 of the GDPR, and 22 of the LOPDGDD, in the terms already indicated. 4.- Images of the public thoroughfare cannot be captured, since the treatment of images in public places, unless there is government authorization, only It can be carried out by the Security Forces and Bodies. On some occasions, for the protection of private spaces, where cameras installed on facades or inside, may be necessary to ensure the security purpose the recording of a portion of the public thoroughfare. That is, cameras and camcorders installed for security purposes may not be obtain images of public roads unless it is essential for said purpose, or it is impossible to avoid it due to their location. And in such a case extraordinary, the cameras will only be able to capture the minimum portion necessary to preserve the safety of people and property, as well as its facilities. Installed cameras cannot get images from third-party proprietary space C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/25 and/or public space without duly accredited justified cause, nor can they affect the privacy of passers-by who move freely through the area. It is not allowed, therefore, the placement of cameras towards the private property of neighbors with the purpose of intimidating them or affecting their private sphere without cause justified. In no case will the use of surveillance practices beyond the environment be admitted. object of the installation and in particular, not being able to affect public spaces surroundings, adjoining buildings and vehicles other than those that access the space guarded. Images cannot be captured or recorded in spaces owned by third parties without the consent of their owners, or, where appropriate, of the people who are in them find. It is disproportionate to capture images in private spaces, such as changing rooms, lockers or rest areas for workers. 5.- The images may be kept for a maximum period of one month, except in those cases in which they must be kept to prove the commission of acts that threaten the integrity of people, property or facilities. In this second case, they must be made available to the authority competent authority within a maximum period of 72 hours from the knowledge of the recording existence. 6.- The controller must keep a record of processing activities carried out under his responsibility in which the information to which he makes reference article 30.1 of the GDPR. 7.- The person in charge must carry out a risk analysis or, where appropriate, an evaluation of impact on data protection, to detect those derived from the implementation of the video surveillance system, assess them and, where appropriate, adopt security measures. appropriate security. 8.- When a security breach occurs that affects the processing of cameras for security purposes, whenever there is a risk to the rights and freedoms of natural persons, you must notify the AEPD within a maximum period of 72 hours. A security breach is understood to be the destruction, loss or accidental alteration or unlawful transfer of personal data, stored or otherwise processed, or the communication or unauthorized access to said data. 9.- When the system is connected to an alarm center, it can only be installed by a qualified private security company contemplated in article 5 of Law 5/2014 on Private Security, of April 4. The Spanish Data Protection Agency offers through its website C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 14/25 [https://www.aepd.es] access to: . the legislation on the protection of personal data, including the GDPR and the LOPDGDD (section "Reports and resolutions" / "regulations"), . the Guide on the use of video cameras for security and other purposes, . the Guide for compliance with the duty to inform (both available at the section "Guides and tools"). It is also of interest, in case of carrying out low-risk data processing, the free tool "Facilita" (in the "Guides and tools" section), which, through specific questions, allows to assess the situation of the person in charge with respect to the processing of personal data that it carries out, and where appropriate, generate various documents, informative and contractual clauses, as well as an annex with measures indicative security considered minimum. SAW Administrative offense. Classification and qualification of the infraction. The claim is based on the alleged illegality of the video surveillance camera installed in the area set up as a workers' canteen, in the Dependencies of the requested entity located at ***ADDRESS.1. It is not disputed in this case the fact that the claimed party is the owner and responsible for the reported video surveillance system and, therefore, the person responsible for the data processing involved in the use of said system. And neither does he fact that among the data processing carried out is the collection and storage of personal data relating to the image of employees and others affected within the area indicated above. The capture of these images has been recognized by the claimed party. It is proven in the proceedings, likewise, that said installation is carried out with security and business control purposes. When carrying out the collection and use of the images obtained in the dining room enabled for personnel, the claimed part does not take into account the limits set forth in the Article 20.3 of the Workers' Statute Law (LET), which admits the recording of images for the exercise of labor control functions when those functions respect the legal framework and the limits inherent to it, such as respect for the worker's dignity; nor the provisions of article 89.2 of the LOPDGDD, which prohibits, in any case, the installation of image recording systems or video surveillance "in places intended for the rest or recreation of workers..., such as locker rooms, toilets, dining rooms and the like”. Consequently, in this case, the general prohibition that establishes article 89.2 of the LOPDGDD, on the capture of images in an area of staff dining room. The claimed party does not dispute that the area captured by the camera that motivates the performances is intended for dining room and that it is used for this purpose by C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 15/25 your employees. But he has indicated that the dining room in question is not a zone of exclusive access for employees, but rather an area with a large influx of people, of common use by workers, freelancers who provide their services there (...), ETT staff, customers and providers; that does not have, ultimately, the end of exclusive rest of workers In this regard, it should be noted, on the one hand, that it is the aforementioned standard that assigns to dining rooms the classification of "places for rest or recreation of the workers" and, on the other hand, that the fact that the dining room is used by people other than the company's own workers excludes or diminishes the aforementioned legal coverage, to the extent that such circumstances do not exclude the classification of this room as a rest area for workers. In addition, for the purposes at hand, this Agency understands that some of the affected groups or categories indicated by the claimed party may be included in the concept of workers, there being no reason to exclude from the protection established in article 89.2 of the LOPDGDD to self-employed workers and ETT personnel who provide services in the dependencies of the claimed party. And not only that. It is also understood that the capture of images that made by the camera installed in the aforementioned dining room and that the intended purpose could be obtained in a less intrusive way, without implying an intrusion into privacy of the people affected. As stated in the Third Proven Fact, the dining room in which the video surveillance camera is a large room, which has numerous tables for four people, a kitchen furniture area that It has eight microwaves and another area with several vending machines (drinks cold drinks, hot drinks and snacks). Likewise, according to the image provided to the proceedings by the claimed party itself, It is clear that the field of vision of said camera captures the entire room, although the area location of the tables is protected by a mask that covers the limit exactly how much space they occupy. However, between the tables, which occupy the right side of the dining room on the image taken by the camera, and the vending machines, located at one end of In the room, on the left side of the image, there is a wide space, about two meters wide and from end to end of the room, which is fully captured by the camera in question without restriction of any kind. This space that separates the area with vending machines and tables belongs entirely to the interior of the dining room, which is inevitably crossed by all the people who They access the dining room to make use of the room. Capturing this space between the tables and the vending machines does not meet the trial of proportionality, considering the purpose pursued by the claimed party with the installation of the camera in the dining room, so that this measure must qualify as restrictive of the rights of those affected. The claimed party, in its response to the claim transfer process and in the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 16/25 brief of allegations at the opening of the procedure, states that, by virtue of the Article 20.3 of the Workers' Statute, the installation of a system of video surveillance throughout the workplace is proportional, in terms of the weighting of the power of direction and control of business activity and the right to the privacy of the interested parties. The defendant also considers that the use made of the video surveillance pursues a legitimate objective, such as the protection of your assets, in specifically the vending machines, which have suffered various acts of vandalism and theft; and that said use is considered lawful by our jurisprudential doctrine for situations as indicated; and that it complies with the judgment of proportionality established by the Constitutional Court, understanding that the thefts and damages that have been occurring in vending machines legitimize the installation of the camera, that this installation is suitable to determine the authors of the damages, necessary to provide the relevant and proportional evidence, given that the images are limited to the area previously informed and only visualizes the company's tools, the aforementioned machines of vending and the windows, in an area of passage with great concurrence of people. However, as indicated above, this Agency does not share the conclusion of the claimed party and understands that the data processing carried out is beyond what is strictly necessary, judging by the detail displayed by the camera. This capture is not limited to exclusively controlling the people who make use of vending machines, but it reaches all the people who access the dining room, whether or not they use said machines. The judgment of necessity implies that there is another more moderate measure for the achievement of purpose with equal effectiveness. If the purpose of installing the camera was the protection of property assets of the company and vending machines, the field of vision captured by said chamber should have been limited to the minimum necessary to guarantee this protection or to obtain the intended results regarding the removal of items property of the claimed party or the commission of unlawful acts against the property. The Constitutional Court Judgment 119/2022, of September 29, admits these recordings when there are indications of the commission of illegal acts, but always that there is no other less invasive way to confirm the illegality of the conduct of the worker and resting places are respected. In this Judgment it is declared: "Consequently, in the general framework of monitoring compliance with an employment contract, and for these purposes alone, the employer may install a video surveillance system. Installation and use of the system will not require the consent of the workers, but it does require a duty of inform them in advance and expressly about its existence and purpose. The location of the cameras must respect the privacy of the places intended for rest or recreation, or that have a reserved character. However, the use of the images captured to verify or prove the flagrant commission of an illegal act will require the prior duty of information, which may be understood to have been fulfilled when the placed in a visible place an informative sign of the existence of the system, of its responsible and its purpose. (…) In the specific circumstances of the case, it can be stated that the installation of the video surveillance and the consequent use of the captured images was a measure justified, suitable, necessary and proportionate. (i) The measure was justified, because there were sufficient indicative suspicions of a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 17/25 irregular behavior of the worker —already described— that had to be verified. (ii) The measure can be considered suitable for the intended purpose, which was none other that the verification of the eventual illegality of the conduct, which was confirmed precisely by viewing the images. (iii) The measure was necessary, since it does not seem that any other less invasive and equally effective to prove the labor infringement. Any other measure would warned the worker, thus making the company's actions useless. (iv) Finally, the measure can be considered proportionate. At this point you have to weigh various elements of judgement. So, first of all, the cameras were not installed in places of rest, leisure or of a reserved nature, where there is an expectation reasonable privacy, but were installed in work areas open to the attention to the public. Second, the cameras were not installed surreptitiously, but rather They were located in visible places, both for the workers of the establishment and For the general public. Third, the cameras were not used on a regular basis. generalized or indefinite, or to carry out a prospective investigation, but to verify the possible existence of irregular conduct detected the day before. Therefore, the degree of interference in the sphere of privacy of the worker (art. 18.1 CE), in terms of space and time, cannot be considered unbalanced in relation to the rights and interests of the company in the detection and punishment of conduct that violates the contractual good faith, within the framework of the exercise of the rights to private property and freedom of enterprise, recognized in arts. 33 and 38 CE, respectively”. The defendant also alleges that the area between the vending machines and the dining room is a "passage area", communicated with other spaces of the industrial warehouse through two doors (one next to the vending machines and the other at the back of the room, according to the field of vision of the video surveillance camera object of the actions). (…). According to the plan provided to the actions, it is verified that the two doors communicate with other closed spaces that can be accessed, in both cases, to the stairs of the building. For this reason, and considering the many people who pass through this area that crosses the space in which the dining tables are located, understands that it cannot be considered a space intended for rest or that the field of vision of the camera belongs to the dining room. And add that the orientation of the camera requires ensuring access from the street to the interior of the enclosure and the entrances to the passage area. This Agency understands, however, that the space in question belongs entirely inside a closed room for dining room. Furthermore, the part claimed does not justify that the security of the building requires the control of that supposed "passage area" and that the same security and control cannot be obtained without this additional camera installed in the dining room, making use only of the system installed in the areas where the capture of images is allowed. (...) (...). The claimed entity itself admits in its statement of allegations that the persons Those who access the dining room go through "the rest of the corridors of the ship and the place of video-monitored work to reach the dining room”. With this statement, the claimed party also intends to assimilate the capture of images of the worker in the controversial area, which belongs to the interior of the room dining room, with the capture of images in the rooms or contiguous spaces that The people who make use of it must cross to reach the dining room. Is C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 18/25 as much as saying that, being possible to capture images of the people who are going to the dining room through different parts of the building, it is also possible to capture images inside the dining room, except in the space occupied by the tables strictly delimited, as if the privacy of the person should only be protected when you use one of the tables. However, it is clear both spaces are not assimilable, and that the norm protects the space destined to rest in its entirety and not just a part of it, at the convenience of the responsible entity. Consequently, in this case, it can be understood disproportionate and illegal the capture of images referred to in the claim that gives rise to this sanctioning procedure. It is noted that recording images on the indicated area is an intrusion into the privacy of people. The approach and conclusion expressed in this act do not contradict what indicated in the precedents of this Agency invoked by the claimed party, nor the Sentences alluded to in his brief of allegations. The defendant cites the precedents indicated with the numbers E/09297/2018 and E/ 01760/2017, indicating that they refer to the installation of cameras in areas of rest oriented to the goods that it is intended to protect, which is considered lawful said installation if the capture of images is limited to the goods that can suffer threats and that this Agency resolved the filing of the proceedings. In the resolution issued in the first of them, number E/09297/2018, archived the actions because the assumption refers to a simulated camera. are exposed, However, in said resolution, the criteria that enable the installation of a video surveillance camera in places of rest for the protection of assets, and on the legitimate basis of the treatment the following is indicated: "a) If there are acts of vandalism, the taking of images of the part of the goods should be limited. that may suffer such threats, not being provided that a dome-type camera monitors the entire area. If it were decided to install, the assets to be protected could be moved to another location in the least invasive space for people. b) The collection of images, if said purpose is accredited, would have to be very limited to those assets that have suffered such actions, without the belief or expectation that they may suffer acts of vandalism”. In the same way, the resolution to file the proceedings adopted in the E/01760/2017, referring to a case of installation of cameras for the protection of vending machines in worker rest areas, declares the following: "In the present case, from the photographic documentation provided by the denounced entity, It follows that there are cameras installed in the vending area, the purpose of which is to prevent violent acts are committed against vending machines, indicating that some of them these machines are located in break rooms used by truckers coming to pick up the products while they wait for the trucks to be loaded. of the pictures provided, it can be deduced that said cameras are oriented to vending machines, which would only allow to capture the people who used said machines, having to considered, that as long as they are kept in these conditions and location, there would be a proportional treatment that would justify its installation, according to the intended purpose, being the the minimum area captured for the intended purpose”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 19/25 Also in relation to the possibility of installing cameras to protect heritage business when irregularities have been committed or there are suspicions of it, cites the party claimed the Judgment no. 630/2016 of the Supreme Court and Judgment of 10/17/2019 of the European Court of Human Rights, but the case analyzed It does not deal with the recording of private areas, but work areas. The defendant also cites Judgment no. 1190/2021, of the Social Chamber of the Superior Court of Justice of the Canary Islands, but it does so by highlighting the allegations of the recurring entity in that case and not what was declared by the Court. And Judgment 432/2022, of the Administrative Litigation Chamber of the Court National of 01/31/2022, which is not related to the present case as it refers to to the installation of cameras inside a house. Lastly, contrary to what was stated by the defendant, it should be clarified that this Agency if it has taken into account the existence of informative posters or the non-existence conservation of the images longer than the established time, although it is circumstances that do not modify the conclusions presented. If confirmed the non-existence of informative posters, which was the object of the claim, would have motivated the imputation of an infraction for breach of the duty to inform in personal data protection matter. Consequently, by virtue of the foregoing, it is considered that the facts exposed violate what is established in article 6 of the GDPR, for which they suppose the commission of an offense classified in article 83.5 of the GDPR, which gives rise to the application of the corrective powers that article 58 of the aforementioned Regulation grants to the Spanish Data Protection Agency. This article 83.5.a) of the GDPR provides the next: Violations of the following provisions will be penalized, in accordance with section 2, with administrative fines of maximum EUR 20,000,000 or, in the case of a company, of an amount equivalent to a maximum of 4% of the total global annual turnover of the previous financial year, opting for the highest amount: a) the basic principles for treatment, including the conditions for consent to tenor of articles 5, 6, 7 and 9;”. For the purposes of the limitation period for infringements, the infringement indicated in the previous paragraph is considered very serious in accordance with article 72.1 of the LOPDGDD, which states that: "Based on what is established in article 83.5 of Regulation (EU) 2016/679, they are considered very serious and will prescribe after three years the infractions that suppose a violation substance of the articles mentioned therein and, in particular, the following: (…) b) The processing of personal data without the fulfillment of any of the legal conditions of the treatment established in article 6 of Regulation (EU) 2016/679”. VII Sanction C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 20/25 Article 58.2 of the GDPR establishes: "Each control authority will have all the following corrective powers indicated to continuation: (...) d) order the person in charge or in charge of processing that the processing operations be conform to the provisions of this Regulation, where appropriate, of a given manner and within a specified period; (...) i) impose an administrative fine in accordance with article 83, in addition to or instead of the measures mentioned in this section, according to the circumstances of each case particular". According to the provisions of article 83.2 of the GDPR, the measure provided for in article 58.2.d) of the aforementioned Regulation is compatible with the sanction consisting of a fine administrative. Regarding the infringement of article 6 of the GDPR, based on the facts exposed, it is considered that the sanction that would correspond to be imposed is a fine administrative. The fine imposed must be, in each individual case, effective, proportionate and dissuasive, in accordance with the provisions of article 83.1 of the GDPR. Thus considers, in advance, the status of a large company of the claimed party and its volume of business (it is stated in the proceedings that (...). In order to determine the administrative fine to be imposed, the provisions of article 83.2 of the GDPR, which states the following: "2. Administrative fines will be imposed, depending on the circumstances of each case. individually, in addition to or in lieu of the measures contemplated in article 58, section 2, letters a) to h) and j). When deciding to impose an administrative fine and its amount in each individual case due account shall be taken of: a) the nature, seriousness and duration of the offence, taking into account the nature, scope or purpose of the processing operation in question as well as the number of affected stakeholders and the level of damages they have suffered; b) intentionality or negligence in the infringement; c) any measure taken by the controller or processor to alleviate the damages suffered by the interested parties; d) the degree of responsibility of the controller or processor, taking into account of the technical or organizational measures that have been applied by virtue of articles 25 and 32; e) any previous infringement committed by the controller or processor; f) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate the potential adverse effects of the infringement; g) the categories of personal data affected by the infringement; h) the way in which the supervisory authority became aware of the infringement, in particular if the Controller or processor notified the infringement and, if so, to what extent; i) when the measures indicated in article 58, paragraph 2, have been ordered previously against the person in charge or the person in charge in relation to the same matter, compliance with said measures; j) adherence to codes of conduct under article 40 or certification mechanisms approved under article 42, and C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 21/25 k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the offence”. For its part, article 76 "Sanctions and corrective measures" of the LOPDGDD, Regarding section k) of the aforementioned article 83.2 GDPR, it provides: "1. The sanctions provided for in sections 4, 5 and 6 of article 83 of Regulation (EU) 2016/679 will be applied taking into account the graduation criteria established in the section 2 of said article. 2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679 also may be taken into account: a) The continuing nature of the offence. b) Linking the offender's activity with data processing personal. c) The benefits obtained as a consequence of the commission of the infraction. d) The possibility that the conduct of the affected party could have led to the commission of the infringement. e) The existence of a merger process by absorption subsequent to the commission of the infraction, that cannot be attributed to the absorbing entity. f) The affectation of the rights of minors. g) Have, when it is not mandatory, a data protection delegate. h) Submission by the person responsible or in charge, on a voluntary basis, to alternative conflict resolution mechanisms, in those cases in which there are disputes between those and any interested party”. In the present case, the criteria of following graduation: . Article 83.2.a) of the GDPR: "a) the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the operation treatment in question as well as the number of interested parties affected and the level of damages they have suffered”. . The number of interested parties: the use of the video surveillance camera that has determined the infringement does not affect only the party complained of. The claimed entity itself has stated that the dining room in which said camera is located in a place with a large influx of people, among its workers (...), freelancers who provide their services there (...), ETT staff, clients and suppliers. . Article 83.2.b) of the GDPR: "b) intentionality or negligence in the infringement". The negligence appreciated in the installation of a video surveillance camera that allows the collection of images in a private space intended for the rest of workers, expressly prohibited by the applicable regulations. To this In this regard, the statement of the National Court Judgment is taken into account of 10/17/2007 (rec. 63/2006) that, based on the fact that these are entities whose activity involves continuous data processing, indicates that "...the The Supreme Court has understood that there is imprudence whenever disregards a legal duty of care, that is, when the offender does not C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 22/25 behave with the required diligence. And in the assessment of the degree of diligence has to weigh especially the professionalism or not of the subject, and there is no doubt that, in the case now examined, when the appellant's activity is constant and abundant handling of personal data must be insisted on the rigor and exquisite care to comply with the legal provisions in this regard”. It is a company that performs personal data processing in a systematic and continuous in the area in which the events occurred and that must exercise extreme care in complying with its obligations in terms of Data Protection. . Article 83.2.g) of the GDPR: "the categories of personal data affected by the infringement”; Although "Special categories of personal data" have not been affected, as defined by the GDPR in article 9, the personal data to which they refer the actions (image of the interested parties) has a particularly sensitive, since it allows the prompt identification of the interested parties and increases risks to your privacy. . Article 76.2.b) of the LOPDGDD: "b) Linking the offender's activity with the processing of personal data”. The high connection of the claimed party with the performance of the processing of personal data in the workplace that are the subject of the procedure. This circumstance determines a greater degree of demand and professionalism and, consequently, of the responsibility of the claimed party in relation to the data processing. It is also considered that the circumstances concur as mitigating following: . Article 83.2.d) of the GDPR: "d) the degree of responsibility of the controller or the processor, taking into account technical or organizational measures that they have applied by virtue of articles 25 and 32”. The requested entity has a complex video surveillance system and has implemented adequate procedures for action in the collection and treatment of the personal data contained in said system, not having Appreciated in the actions other defects other than the declared infringement. Considering the exposed factors, the valuation reached by the fine for the violation of article 6 of the GDPR is 50,000 euros (fifty thousand euros). The claimed party considers this sanction disproportionate, alleging that it protects the privacy of the workers in the area of tables set aside for the dining room, which recording is deleted in accordance with the legal provisions (...). But these circumstances do not modify the responsibility for the facts that have determined the sanctioned offense. It has already been assessed as mitigating that the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 23/25 video surveillance system is complex, without any other defects that the determinants of the declared infringement. In addition, the non-conservation of the recordings or the non-use of images outside the provisions of the standard are circumstances that, if not present, would be the reason for new infractions. VIII Measures of adaptation to the regulations Once the infringement is confirmed, it is appropriate to impose on the person responsible the adoption of measures adequate to adjust their performance to the regulations mentioned in this act, in order to In accordance with the provisions of the aforementioned article 58.2 d) of the GDPR, according to which each The supervisory authority may “order the person in charge or in charge of the treatment to processing operations comply with the provisions of this Regulation, where appropriate, in a certain way and within a time limit specified…". The text of this agreement establishes which have been the infractions allegedly committed and the facts that give rise to the violation of the regulations of data protection, from which it is clearly inferred what are the measures to adopt, notwithstanding that the type of procedures, mechanisms or instruments specific measures to implement them correspond to the sanctioned party, since it is the controller who fully knows his organization and has to decide, based on proactive responsibility and the risk approach, how to comply with the GDPR and the LOPDGDD. However, in this case, regardless of the foregoing, it is appropriate to require the responsible entity so that, within the term indicated in the operative part, abolish the capture of images by the video surveillance system object of the actions in the area for the workers' canteen, with the scope expressed in this act. You must remove the video surveillance camera installed in the employee dining area. It is noted that not meeting the requirements of this body may be considered as an administrative offense in accordance with the provisions of the GDPR, classified as an infraction in its article 83.5 and 83.6, being able to motivate such conduct the opening of a subsequent administrative sanctioning procedure. Therefore, in accordance with the applicable legislation and assessed the criteria of graduation of sanctions whose existence has been accredited, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE GRUPO TRANSAHER, S.L., with NIF B78147758, for a infringement of article 6 of the GDPR, typified in article 83.5.a) of the same Regulation, and classified as very serious for the purposes of prescription in article 72.1.b) of the LOPDGDD, a fine of 50,000 euros (fifty thousand euros). SECOND: That by the Director of the Spanish Data Protection Agency orders GRUPO TRANSAHER, S.L., within a period of one month from the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 24/25 notification of this act, adopt the necessary measures to adapt its performance of the personal data protection regulations, with the scope expressed in the Foundation of Law VIII of this resolution. Within the same period indicated, TRANSAHER GROUP, S.L. must inform and justify before this Agency the compliance with the imposed measures. THIRD: NOTIFY this resolution to GRUPO TRANSAHER, S.L. FOURTH: Warn the sanctioned party that he must enforce the sanction imposed Once this resolution is enforceable, in accordance with the provisions of Article art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of its income, indicating the NIF of the sanctioned and the number of procedure that appears in the heading of this document, in the account restricted IBAN number: ES00 0000 0000 0000 0000 0000 (BIC/SWIFT Code: XXXXXXXXXXXX), opened on behalf of the Spanish Agency for Data Protection in the banking entity CAIXABANK, S.A. Otherwise, it will proceed to its collection in executive period. Once the notification has been received and once executed, if the execution date is between the 1st and 15th of each month, both inclusive, the term to make the payment voluntary will be until the 20th day of the following or immediately following business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediately following business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once the interested parties have been notified. Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of one month from count from the day following the notification of this resolution or directly contentious-administrative appeal before the Contentious-administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following the notification of this act, as provided for in article 46.1 of the referred Law. Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the firm resolution in administrative proceedings if the The interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through writing addressed to the Spanish Data Protection Agency, presenting it through of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronicaweb/], or through any of the other registries provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 25/25 documentation proving the effective filing of the contentious-administrative appeal. If the Agency was not aware of the filing of the appeal contentious-administrative proceedings within a period of two months from the day following the Notification of this resolution would terminate the precautionary suspension. 938-181022 Mar Spain Marti Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es