| AEPD - PS/00003/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR Article 83(5) GDPR Article 22 LOPDGDD |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 26.10.2020 |
| Published: | 26.10.2020 |
| Fine: | 5000 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS/00003/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Francesc Julve Falcó |
The Spanish DPA (AEPD) imposed a fine of €5000 on a betting company because its installation of cameras did not comply with Article 5(1)(c) GDPR.
English Summary
Facts
On October 16th 2019, due to complaints from neighbours about the cameras facing the public space, the local police came to check the content of the recordings, but they were not allowed access to the images.
On December 18th 2019, the AEPD informed the company of the complaint and requested more information regarding the video surveillance system.
PLAY ORENES S.L. invoked article 22 LOPDGDD, which allows the capture of images of the public highway, in some cases, with the aim of preserving the security of people and goods.
From the inspection of the frames taken from the system's viewing monitor, which through 4 cameras facing the outside, it was verified that the entire width of the street was captured, as well as the vehicles parked.
It is also recorded as a proven fact that the claimant removed 3 of the 4 cameras facing outwards, following the claim. However, a camera has been maintained which captures images of the street and the parked vehicles.
Dispute
Must video surveillance installations that record images of public space respect Article 5 (1) (c) GDPR?
Holding
The AEPD held that the installation of a video surveillance system under Article 22 LOPDGDD must always comply with the principle of minimization of data, set out in Article 5 (1) (c) GDPR.
The aggravating circumstance taken into account was: the intentionality or negligence of the infringement (Art. 83 (2) (b) GDPR); while as mitigating circumstances: the adoption of measures taken by the person responsible to mitigate the damage (Article 83 (2) (c) GDPR), collaboration with the Agency in responding to the complaint (Article 83 (2) (f) GDPR), not linking the activity of the offender to the processing of personal data (Article 76 (2) (b) LOPDGD), the non-existence of profits obtained as a result of the infringement (Article 76 (2) (c) LOPDGDD and, having the figure of the data protection delegate even though it is not obligatory for the company (Article 76 (2) (g) LOPDGDD).
Furthermore, the AEPD requested the company in question to prove that it had removed the camera that still recorded images of the street, in accordance with Article 58(2)(d) GDPR.
Comment
The company PLAY ORENES S.L. made use of the reduction of 20% of the amount of the sanction, proceeding to the voluntary payment so that the amount was reduced to EUR 4000.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/19
Procedure Nº: PS / 00003/2020
RESOLUTION R / 00522/2020 OF TERMINATION OF THE PROCEDURE BY PAYMENT
VOLUNTARY
In the sanctioning procedure PS / 00003/2020, instructed by the Spanish Agency for
Data Protection to PLAY ORENES, S.L., considering the claim presented by
CITY COUNCIL OF *** LOCALITY. 1, and based on the following,
BACKGROUND
FIRST: On March 12, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning procedure to PLAY ORENES, S.L ..
The initiation agreement has been notified and after analyzing the allegations presented, dated
September 29, 2020, the resolution proposal was issued that follows
transcribe:
<<
Procedure number: PS / 00003/2020
926-300320
Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following:
BACKGROUND
FIRST: On October 16, 2019, you entered this Spanish Agency
of Data Protection a letter presented by CITY OF
*** LOCALITY. 1 (hereinafter, the claimant), through which it formulates
claim against PLAY ORENES, S.L. with NIF B73002099 (hereinafter, the
claimed), for the installation of a video surveillance system installed in STREET
*** ADDRESS.1, with respect to which there are indications of a possible breach of the
provided in the data protection regulations.
The reasons that support the claim are the following:
«That different residents of this town have repeatedly stated before
this City Council that the company Play Orenes S.L.U, with NIF B73002099, company
dedicated to sports betting, has installed in its premises located in *** LOCALIDAD.1,
Calle *** ADDRESS. 1, video surveillance cameras that due to their positioning and
characteristics seem to be covering an important part of the public road, more
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/19
beyond the strict access that by monitoring the facade of the building could
considered adequate.
Faced with this situation, and after assessing the situation with the Municipal Police,
decided to go to check this point at said local, in order to confirm the
existence of privacy masks. In person at the premises, on August 9,
We were not allowed access to the images, for which purpose a record of the
municipal police of the date. "
SECOND: Prior to the admission for processing of this claim, a
transferred the claimed, in accordance with the provisions of article 65.4 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD), being notified on 11/21/2019.
On 12/18/2019 he had a written reply entry from the complained in which he states
what:
«[…] 4. Number and characteristics of the cameras. In the case of
fictitious cameras must provide the invoice, purchase receipt or any other
document that serves to prove that they are fictitious.
The aforementioned establishment has a total of 16 CCTV cameras. In
As for fictitious cameras, inform that the establishment does not have
none of them. (See ANNEX Nº1: Installation sketch and quadrant of
camera shots).
5. Scope of the cameras and places where they are installed, proving
by means of photography of the images captured by the cameras, as
displayed on the monitor or equivalent system, that the space of
capture so as not to affect adjoining land and homes, public roads or
any other foreign or reserved space.
Of the four cameras that the establishment has oriented towards the
access points, indicate that one of them is installed inside the
establishment and the other three on the façade focusing only on the two
pedestrian accesses and minimally the public road as you can see
in the attached frames, dated 2.019-11-25 / 17: 14 hours.
6. Indicate the conservation period of the registered images.
The term of conservation of the images of the recorder is of 19 days;
maximum programmed capacity depending on the quality and number of cameras
that this recorder supports.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/19
In our Privacy Policy regarding Video Surveillance of all
Centro de Play Orenes, S.L., it is determined that the images will be kept
a maximum period of 30 days.
(See ANNEX No. 2: Privacy Policy for video surveillance)
7. Any other information that you consider of interest to assess the
adaptation of the installation of video surveillance cameras to the regulations
of data protection.
It should be noted that, on the part of our Security Department,
so far this year a total of 760 Police Trades have been processed,
received from both the National Police Corps and the Civil Guard. In large
part of said requests, were aimed at interests unrelated to this
Company, and if in favor of Citizen Security. Make mention of, that, in
These requests for collaboration have required us to provide the
images captured by the exterior cameras accesses of the different
establishments, being able to clarify how it can be accredited, numerous
criminal acts investigated by police units throughout Spain in
for the safety of citizens.
With regard to data protection, I attach the description of the
treatment, as well as their impact assessments describing the measures
technical and organizational that are part of the treatment, as well as the
different risk analyzes carried out on it.
(See ANNEX No. 3: Registration of treatment activities: Video surveillance)
(See ANNEX Nº4: Basic risk analysis: Video surveillance)
(See ANNEX No. 5. Risk analysis and need for DPIA: Video surveillance). »
THIRD: The claim was admitted for processing by resolution of January 8
2020.
FOURTH: On March 12, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure for the claimed party, with
in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in the
Article 83.5 of the RGPD.
FIFTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written
allegations in which it shows that:
«[…] FIRST.- Of the nullity of the procedure.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/19
It is manifested in the antecedents of the notified resolution that by this
Administration, prior to the admission for processing of the claim
that has given rise to the present sanctioning procedure, was transferred to
PLAY ORENES S.L. of the existing claim- filed by the
City Council- and this in accordance with the provisions of article 65.4 of the
Organic Law 3/2018, of December 5, Protection of Personal Data and
guarantee of digital rights (hereinafter LOPDGDD), being
notified such claim on 11/21/2019:
Well, the truth and truth is that Play has never been notified
ORENES SL any claim, and only on the date indicated
(11/21/2019) we were sent a "request for information" (CVS:
*** CVS.1), a copy of which is attached as document number 1:
In response to that request for information - and not to any claim-,
this company filed a reply on 12/18/2019, whose
copy is attached as document nº2.
Therefore, PLAY ORENES has never had knowledge of a claim
any regarding the cameras installed in your establishment nor therefore
he has been able to make any allegation in his defense.
In view of the foregoing, it is evident that this Administration has not acted, such as
and as indicated, in accordance with article 65.4 of the LOPDGDD,
violating the right of defense of my client, who has seen how
respond to a request for information, a procedure has been initiated
sanctioner based on a claim for which he has not even had
knowledge or ability to defend oneself.
In this sense, the jurisprudence of the Third Chamber of the Supreme Court has
declared that no one can be condemned without being heard (Sentences, among
others, of November 30, 1995, November 5, 2001, June 17,
2002 and June 28, 2002), finding the nullity of the act from which it derives
this defenselessness justified in the fact that my client has not been
given the opportunity to make their own arguments and to use
the pertinent means of proof for the defense of their rights and interests
legitimate protected by the article. 24.1. of the Spanish Constitution.
Serve in this regard the Judgments of the Constitutional Court numbers 31/1984,
48/1984, 70/1984, 48/1986, 155/1988 and 58/1989: […]
For all of the above we understand that this file does not conform to the
legally established procedure since it has not been
compliance with article 65. 4 LOPDGDD and this despite the fact that this
Administration reiterates on several occasions -at the initiation of this
sanctioner - that it has proceeded to do so.
It is enough for this Administration to check its registration and content of the
telematic notification on its day made (11/21/2019) to check what
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/19
this company defends: it only moved to PLAY ORENES S.L. A request of
information.
The agreement to initiate this sanctioning procedure includes in its
factual background FIRST, SECOND and THIRD the processing of
a prior file in accordance with the aforementioned article 65 LOPDGDD,
admission to processing of a claim from a third party and after that it understands that
this sanctioning procedure must be initiated.
However, this is not true and therefore the resolution that initiates this
sanctioning file nor the previous file do not adjust to the reality of
the facts or article 65 LOPDGDD.
Therefore, it is in accordance with the law that the agreement of
initiation of the notified sanctioning procedure, proceeding to file the
procedure, since it brings cause of a previous file that is not
complies with the legally established procedure (article 65 and related),
consequently suffering from a defect of nullity or failing that
voidability ex article 47 and 48 of Law 39/2015, of October 1.
SECOND.- Compliance with the exception established by article 22 of
the LOPDGDD
This Administration states that the claim that has given rise to the
present procedure - to insist that we were never notified - is based on the
"Alleged illegality of the installation by my client of a system
surveillance system, composed of four cameras located in the premises located in
CALLE *** ADDRESS. 1, which could capture images of the public thoroughfare of
disproportionately, capturing not only the entire width of the sidewalk (if
well it is narrow) (in all of them) but also to parked vehicles
adjoining it (in two of those installed on the façade) ”.
In this sense, it is worth recalling article 22 of the LOPDGDD, which establishes the
next:
"1. Individuals or legal entities, public or private, may carry out the
image processing through camera or video camera systems with
the purpose of preserving the safety of people and property, as well as
your instalations.
2. Images of public roads may only be captured to the extent that
it is essential for the purpose mentioned in the previous section.
However, it will be possible to capture the public road in an extension
when necessary to guarantee the safety of goods or
strategic facilities or infrastructure related to transport, without
that in no case may involve the capture of images inside a
private address. "
Well, due to the nature of the business of this company and following the
indications of the LOPD, my represented conforms to the exception
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/19
contemplated by article 22 that allows the recording of a minimum portion
of the public thoroughfare whenever it is essential to guarantee the purpose
of security.
It serves as a justification, that on some occasions and due to the design of
the public thoroughfare, when cameras are installed on the façade,
these minimally or partially capture the sidewalks, since they are not
few occasions that criminals take advantage of parked vehicles
at the entrance of the establishment to hide and rob or assault
our employees and customers at the entrance or exit of the establishment. In
In this sense, it should be remembered that we are facing an establishment that combines
the hospitality industry and the gaming industry, being necessary to collect almost
daily of the machines installed in it causing the personnel of
collection - and even clients - are or may be the object of robberies to their
departure. That is why compliance with the security purpose of the
cameras requires a plus or reinforcement always within the allowed margins
by article 22.
In proof of the foregoing, it is attached as document No. 3,
report from the security department of my client where it is justified
the need to guarantee the security of the establishment through
placement of certain cameras and their compliance with the
legally required measures.
As indicated in the attached report, the implementation of the
Security in each establishment is the decision of the security department
in collaboration with the data protection officer of the Orenes Group,
thus guaranteeing compliance with legal requirements in both areas
normative. It is a decision that responds to technical and specialized criteria,
measuring in any case the scope of the exception regulated in article 22.
THIRD.- Disproportionality of the sanction
In a subsidiary manner, and in the event that this Administration
the commission of some type of infraction by this company will be appreciated,
the disproportionality of a penalty of 20,000 euros would be flagrant, the
which is absolutely disproportionate and devoid of all motivation, resulting
be arbitrary.
This Administration does not justify the reasons that support the seriousness of
such sanction, taking into account that:
- No claim of any kind was ever notified - preventing my
represented to be able to exercise their right of defense-
- There is no recidivism
For this reason, the principle of proportionality established by the
Article 29.3 of Law 40/2015 of October 1, on the Legal Regime of the
Public Sector, which provides that, in the imposition of sanctions, the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/19
Public Administrations must observe the due suitability and necessity
of the sanction to be imposed, and its adaptation to the seriousness of the constitutive act
of the offense; operating for graduation guilt, intentionality,
persistence, damages caused, or recidivism. In this sense,
warn this Administration that it is not appropriate to try to justify the
graduation and severity of the sanction proposed here, bringing up the
existence of 16 files - which, as indicated, are of a non-existent nature
sanctioning - related to video surveillance systems installed in
establishments owned by my client.
- Absolute good faith for my client. If the above is not enough, we
we find that the present procedure comes from the answer
exhaustive on the part of my client of a request for information, the
which and surprisingly, according to this Administration, it was about
a claim (See document nº1).
It would not be idle to recall that the principle of proportionality performs,
in the field of Administrative Penalty Law, a capital role and this does not
only as an expression of some abstract powers of application of the Law
in terms of equity, but because of the concrete fact that sanctions against
impose are defined in our ordinance, generally, of
extremely flexible way, in such a way that the same behavior can
deserve the imposition of very diverse sanctions and that move in
very wide margins and that, for the same reason, can result, in practice,
extraordinarily diverse amount and period. The principle of
proportionality imposes that since the sanctioning activity of the
I administer a discretionary activity, but a typically activity
legal or application of the rules, (as recognized by our Court
Supreme Court in Judgments of December 23, 1981 [RJ 1981, 5453], December 3,
February 1984 [RJ 1984, 1027] and April 19, 1985 [RJ 1985, 1716]), the
factors that must govern its application depend on what is available
the Legal System in each sector in particular and, very especially, in
the concurrent circumstances.
The Supreme Court has declared in its Judgment of July 29, 2014
(Contentious-Administrative Chamber, Section 1), regarding the principle of
proportionality, which:
"The principle of proportionality plays, in the field of Law
Administrative Penalty, a capital role and this not only in terms of expression
of some abstract powers of application of the Law in terms of equity,
but because of the concrete fact that the sanctions to be imposed are found
defined in our system, in general, in a highly
flexible, in such a way that the same conduct may merit the imposition of
very diverse sanctions and that move in very wide margins and that, for
the same, they can result, in practice, of amount and period
extraordinarily diverse. The principle of proportionality requires that the
not being the sanctioning activity of the Administration an activity
discretionary, but a typically legal activity or application of the
norms, (as recognized by our Supreme Court in Judgments of 23
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/19
December 1981 [RJ 1981, 5453], February 3, 1984 [RJ 1984, 1027] and
April 19, 1985 [RJ 1985, 1716]), the factors that must preside over its
application are based on the provisions of the Legal System in
each sector in particular and, very especially, in the circumstances
concurrent. "
It should be remembered, as the Sentence of the Supreme Court of the Balearic Islands refers,
Contentious-Administrative Chamber, Section 1, of July 25, 2006, which:
“The Constitution, which has recognized the legitimacy of sanctions
administrative, has taken good care to underline the regulated nature of the
sanctioning power of the Administration: not that the Administration has
"Freedom" to choose between different solutions, but equally fair
- legally indifferent-. All the actions of the Administration in the
sanctioning ground is therefore regulated. "
It is evident that in the present case there are no circumstances that
justify the imposition of such a serious sanction and perhaps for that reason
motivate for this Administration
.
Be that as it may, and despite not having an express requirement on the part of this
Administration, in order to demonstrate the good faith of my client,
states that he proceeded to withdraw the outer chambers of the
establishment, as evidenced by document no. 4. […] '.
The report issued by D.A.A.A. ,, member of the Department of Security and
responsible for the Treatment of images of the establishments of the Orenes Group,
attached as document No. 3 indicates, fundamentally, that the company is
complies with the data protection regulations in the installation of its
video surveillance being sometimes necessary to capture a minimum portion of the track
to guarantee the safety of goods and people, that the Forces and Corps
Security have required your contribution of images for the investigation of
criminal acts, that Madrid stands as the area with the highest crime rate
crimes that affect customers and employees and that for technical reasons, is not
It is possible to redirect the capture angle of the installed cameras.
SIXTH: On 09/03/2020, the procedure instructor agreed to open the
a period of testing, being considered reproduced, for evidentiary purposes
the claim filed by the claimant, the data obtained and generated by the
Subdirectorate General for Data Inspection and the allegations presented by the
reclaimed.
SEVENTH: A list of documents in the document is attached as an annex.
process.
Of the actions carried out in this procedure and of the
documentation in the file, the following have been accredited:
PROVEN FACTS
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/19
FIRST: Existence of a video surveillance system installed in a
gambling establishment located in CALLE *** ADDRESS. 1, composed of 16 cameras,
4 of them facing the outside (3 located on the facades and 1 on the porch of the
entrance access) as reflected in the content of the writing and the photographs
that accompany the answer made by the claimed to the prior transfer of the
claim filed. It is credited, through the frames taken from the monitor
system viewing and provided by the claimant, who, through the
mentioned 4 cameras facing outwards, the entire width of the
sidewalk (although narrow), as well as the vehicles parked in 2 of them.
SECOND: The person in charge of the video surveillance system is PLAY ORENES S.L.
THIRD: The defendant has proceeded to the withdrawal of 3 of the 4 oriented cameras
towards the outside (specifically the 3 installed on the facades), as
accredits in the photographs that accompany the letter, allegations to the agreement of
start, presented on June 11, 2020.
FOUNDATIONS OF LAW
I
The Director of the Agency is competent to resolve this procedure
Spanish Data Protection, in accordance with the provisions of art. 58.2 of
Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter
RGPD and in art. 47 and 48.1 of LOPDGDD.
II
In the present case, it is appropriate to examine the claim presented by the
*** Town Hall of LOCALIDAD.1 on October 16, 2019 in which the
installation of a video surveillance system in a PLAY ORENES establishment
S.L. located in the street *** ADDRESS.1 of the town that «that by its
positioning and characteristics seem to be covering an important part of the
public road, beyond the strict access than by the surveillance of the facade of the
real estate could be considered adequate ”.
Article 5.1.c) of the RGPD provides that personal data will be
«Adequate, relevant and limited to what is necessary in relation to the purposes for which
that are processed (“data minimization”). »
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/19
This offense is classified in Article 83.5 of the RGPD:
«Infringements of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:
a) the basic principles for the treatment, including the conditions for the
consent in accordance with articles 5, 6, 7 and 9;
b) the rights of the interested parties in accordance with articles 12 to 22; […]. »
For the purposes of the statute of limitations of the offense, it is considered very
serious and prescribes after three years, in accordance with article 72.1 of the LOPDGDD, that
states that:
"In accordance with the provisions of article 83.5 of Regulation (EU) 2016/679
are considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:
a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/19
III
In accordance with the evidence available in the present
sanctioning procedure, it is considered that the defendant has established a system of
Poorly oriented video surveillance with regard to 4 outward-facing cameras. From
the aforementioned cameras 3 of them (those placed on the facades) have been removed,
as stated in the Third Proven Fact; presumably subsisting located in
the arcade of access to the premises, a camera that captures images not only of the entrance to the
establishment and a minimum of adjacent sidewalk, but also reaches in its
Approach the vehicles parked in front of the entrance.
Regarding the allegations presented, it corresponds to make the following
considerations:
Regarding the request for annulment of the procedure
motivated by an alleged violation of the right of defense of the defendant
considering that the claim has not been transferred, it should be noted, in
First, that the transfer of the claim contained in article 65.4 of the
LOPDGDD is configured as an optional procedure in the opinion of the Agency
Spanish Data Protection Agency in an attempt to inform the
responsible or in charge that said body has been sent some
facts that could imply the violation of the regulations for the protection of
data, and all this with the aim that by said person in charge or
manager can provide information or justification that allows adopting
a reasoned decision about whether or not to admit the claim or
complaint and the subsequent official opening of an investigation file
or a sanctioning procedure.
In this process, the main thing is to provide the person in charge of the
opportunity to defend oneself regarding the facts contained in the claim
and this is what has been fulfilled in the present case with the letter sent on
11/21/2019, where it is communicated to PLAY ORENES S.L. that «This Agency
has been aware of the existence of video surveillance cameras
located in CALLE *** DIRECCIÓN.1, which could be in breach of the
data protection regulations […] For this reason, you are requested to, in the
within a month from receipt of this letter, certify that the installation
of the cameras is in accordance with the data protection regulations giving
answer, at least, to the following points […] '. That is, although it has not
given transfer of the claim in its entirety as such, if it has been requested
information based on the facts that are related to the regulations
of data protection duly identified. In this case, therefore, no
defenselessness has occurred, since the defendant has had knowledge
of the situation allegedly likely to violate the regulations of
protection of data that the claimant has made known to the AEPD.
The doctrine that the Constitutional Court has been maintaining in relation to
defenselessness is that in order for it to be invoked it is necessary to
It is a material defenselessness that implies that it has caused damage
real and effective. (among others, SSTC 90/1988, 43/1989, STC, 105/1995, 118/1997,
91/2004).
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/19
In addition, it is necessary to point out that in this case what is requested is a
answer to the AEPD and not that the person in charge or manager responds to who
has filed the claim or complaint.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/19
Regarding the possibility, protected in article 22 of the
LOPDGDD that, in order to guarantee the safety of people and
goods, which enables the capture of public thoroughfares to the extent that it is
It is essential to point out that, indeed, this possibility is collected for,
taking into account section 1 of the aforementioned article «natural or legal persons,
public or private ”.
Now, the determining factor at this point, for a
conjunction with the principle of data minimization stated in the article
5.1.c) of the RGPD, is that it must be "to the extent that it is
essential ”, which means that, if for security reasons it were
necessary to capture public roads - a faculty that is generally attributed
to the Security Forces and Bodies in accordance with the provisions of the
Organic Law 4/1997 which regulates the use of video cameras by the
Security Forces and Bodies in public places and their regulations on
development — because it is the space adjacent to the property (access area or
perimeter) this should be kept to a minimum; in the case of a sidewalk you can
capture a portion of it in the part adjacent to that access or perimeter,
but it will not be provided to capture the entire width of the same or
reach parked cars so that passersby and motorists
who park their vehicles are not unduly affected by their right to
protection of the physical image ..
The possibility of expanding the catchment of public roads established by the
Article 22.2, refers to strategic assets or entities (having to understand
these to those defined as such in the National Catalog of Infrastructures
Strategic) or transport infrastructures, a category in which there is no
find a business dedicated to gambling. Therefore, not belonging to
business of the claimed to the category of good or strategic entity or
transport infrastructure, must respect the criteria of minimum capture of
the public highway, and this regardless of the area where the business is located
(This aspect has resulted from a free and voluntary decision of the
company), since an unequal application of the aforementioned criterion would entail
unequal consideration (and therefore possible discrimination) in the
rights of people who pass through a certain area with respect to
those of others.
Therefore, in accordance with the foregoing, the defendant is empowered to order
of a video surveillance system facing outwards (and even located
abroad) whose purpose is to guarantee the safety of the property, employees and
clients, but taking into account that, in the event of needing to capture
public thoroughfare, this capture must be limited to the essential minimum that
it is located adjacent to the access and perimeter.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/19
Regarding the allegation related to the
disproportionality of the proposed financial sanction, it is necessary to bring
collation what is collected in the agreement to initiate this procedure. In this
initial agreement has not been collected at any time the aggravation of
recidivism, but the concurrent circumstances considered for the purposes
modulating the proposed sanction are: as aggravating factors, the intentionality or
negligence in the infringement (article 83.2.b) RGPD) and the lack of measures
taken by the person in charge or in charge of the treatment to alleviate the damages and
damages suffered by the interested parties (article 83.2.c); as mitigating factors, the
collaboration with this Agency in the heart of this procedure by having
answered to the transfer of the claim (article 83.2.f) RGPD), non-existence
that of linking the activity of the offender with the performance of treatments
of personal data (article 76.2.b) LOPDGDD), non-existence of benefits
obtained as a result of the commission of the offense (article 76.2.c)
LOPDGDD) and have the figure of the data protection delegate not yet
belonging to the set of entities obliged to have the aforementioned figure
(article 76.2.g) LOPGDD).
Regarding the mentioned aggravations, the motivation rests, as
stated in the initiation agreement, in a previous existence of the report-complaint
raised by the Civil Guard of *** LOCALIDAD.2 and that was presented before
the AEPD on February 11, 2019 due to the existence of a system of
video surveillance in the premises located at C / *** ADDRESS.1 (the same system as
which is the object of this sanctioning procedure) that would violate the
provided in the data protection regulations. On the 26th of the same month
sent the defendant a communication informing him of this
extreme, from where to consult the requirements in this regard and that, if not
the necessary measures, it could be incurring a criminal offense
in the data protection regulations that could initiate actions
investigating and sanctioning. To this communication the defendant replied,
March 26, 2019, that the system met the requirements.
Well, of the facts that have motivated the present procedure
sanctioner, it is evident that the defendant did not implement any
measure in this regard that would have allowed him to check and, therefore, correct,
the excessive recording of the public road that is included in the Proven Fact
First.
Likewise, the mention of the 16 non-sanctioning files opened to the
claimed serves to influence the idea of lack of diligence of the claimed in the
failure to review a policy for installing video surveillance systems
that has been warned on those occasions from the AEPD about its possible
lack of adaptation to data protection regulations.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/19
Based on the foregoing, and taking into account that according to the latest accounts
annual presented (2018 financial year) it is clear that the company had an
net of turnover of € XXX. and had an average number of
permanent employees of 317.28 and of non-permanent employees of 174.58 - which excludes
of the definition of SMEs in accordance with Regulation (EU) No. 651/2014 of
On June 17, 2014, the Commission considered it proportionate to propose a
penalty of 20,000 euros.
Now, taking into account that the defendant has proceeded to withdraw 3 of the
4 cameras (those located on the facades) that captured public roads excessively,
It is considered that the concurrent circumstance of article 83.2.c) has to make
from aggravating to mitigating, since measures have been adopted for that
tending to avoid harm to those affected who would see their right to
the protection of personal data when being captured by the system of
video surveillance.
IV
In accordance with the provisions of the RGPD in its art. 83.2, when deciding to impose
an administrative fine and its amount in each individual case will take into account the
aggravating and mitigating factors that are listed in the indicated article, as well as
any other that may be applicable to the circumstances of the case.
Consequently, the following have been taken into account as aggravating factors:
The intentionality or negligence in the infringement (article 83.2.b) RGPD),
On the other hand, the following have been taken into consideration as mitigating factors:
The adoption of measures taken by the person in charge of the
treatment to alleviate the damages suffered by the interested parties
(article 83.2.c) RGPD)
Collaboration with this Agency within this procedure
having responded to the transfer of the claim (article 83.2.f) RGPD)
There is no link between the offender's activity and the
processing of personal data (article 76.2.b) LOPDGDD)
Non-existence of benefits obtained as a consequence of the
commission of the offense (article 76.2.c) LOPDGDD)
Have the figure of the data protection delegate not yet
belonging to the set of entities obliged to have the aforementioned figure
(article 76.2.g) LOPGDD).
Based on the foregoing, it is appropriate to propose adjusting the sanction to be imposed on the
claimed and set it at the amount of FIVE THOUSAND EUROS (€ 5,000).
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/19
If the infringement is confirmed, it could be agreed to impose the responsible
adoption of appropriate measures to adjust its performance to the aforementioned regulations
in this act, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD,
according to which each supervisory authority may 'order the person in charge
of the treatment that the treatment operations conform to the provisions of the
this Regulation, where appropriate, in a certain way and within a
specified term ”.
In such case, in the resolution adopted, this Agency may require the
responsible so that within the period to be determined:
Prove that you have proceeded to remove the camera located in the
entrance porch (private space of the establishment but outside the premises)
from its current location, or to reorient it by reducing
the pickup angle.
It is noted that not meeting the requirements of this body may be
considered as an administrative offense in accordance with the provisions of the RGPD,
classified as an offense in its articles 83.5 and 83.6, being able to motivate such conduct the
opening of a subsequent administrative sanctioning procedure.
In view of the above, the following is issued
MOTION FOR A RESOLUTION
That the Director of the Spanish Agency for Data Protection
sanction PLAY ORENES, S.L., with NIF B73002099, for a violation of Article
5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of FIVE THOUSAND
EUROS (€ 5,000).
That, under the provisions of article 58.2.d) of the RGPD, you are
ORDER the defendant that, within ONE MONTH from the date on which the
resolution in which it is agreed to be notified, proceed to withdraw the camera
located in the entrance porch of its current location, or to the reorientation
of the same reducing the angle of capture.
Likewise, in accordance with the provisions of article 85.2 of the LPACAP,
You are informed that you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which
will mean a reduction of 20% of the amount thereof. With the application of this
reduction, the penalty would be set at FOUR THOUSAND EUROS (€ 4,000) and its
payment will imply the termination of the procedure. The effectiveness of this reduction
It will be conditioned to the withdrawal or resignation of any action or remedy in progress.
administrative against the sanction.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 17/19
In case you choose to proceed to the voluntary payment of the amount
specified above, in accordance with the provisions of the aforementioned article 85.2,
You must make it effective by entering the restricted account number ES00 0000
0000 0000 0000 0000 opened in the name of the Spanish Agency for the Protection of
Data in the bank CAIXABANK, S.A., indicating in the concept the number
reference of the procedure that appears in the heading of this document and
the cause, by voluntary payment, of reduction of the amount of the sanction. Likewise,
You must send proof of admission to the General Inspection Subdirectorate for
proceed to close the file.
By virtue of this, he is notified of the foregoing, and the
procedure so that within TEN DAYS you can claim whatever you consider
in his defense and present the documents and information he deems pertinent,
in accordance with article 89.2 of the LPACAP).
B.B.B.
HEAD OF AREA
PROCEDURE INSTRUCTOR
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 18/19
ANNEX: Index of File PS_00003_2020
1. Claim of C.C.C.
2. Transfer of claim to PLAY ORENES, S.L.
3. Answer to the request of D.D.D.
4. Admission for processing to C.C.C.
5. E / 02186/2019
6. Check background
7. Diligence
A. opening to PLAY ORENES, S.L.
8. Allegations of PLAY ORENES SL
9. Notif. p. tests to PLAY ORENES, S.L.
>>
SECOND: On October 16, 2020, PLAY ORENES, S.L. has proceeded to
payment of the penalty in the amount of 4,000 euros making use of the planned reduction
in the proposed resolution transcribed above.
THIRD: The payment made entails the waiver of any action or remedy in progress
against the sanction, in relation to the facts referred to in the
motion for a resolution.
FOUNDATIONS OF LAW
I
By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in art. 47 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said
Regulation; infractions of article 48 of Law 9/2014, of May 9, General
of Telecommunications (hereinafter LGT), in accordance with the provisions of the
article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and
38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.
II
Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 19/19
"1. Initiated a sanctioning procedure, if the offender acknowledges his
responsibility, the procedure may be resolved with the imposition of the
appropriate sanction.
2. When the sanction is solely of a pecuniary nature or it fits
impose a pecuniary sanction and a non-pecuniary sanction but it has
justified the inadmissibility of the second, the voluntary payment for the alleged
responsible, at any time prior to the resolution, will involve the
termination of the procedure, except in relation to the reinstatement of the situation
altered or to the determination of the compensation for damages
caused by the commission of the offense.
3. In both cases, when the sanction is solely of a pecuniary nature, the
competent body to resolve the procedure will apply reductions of, at
less, 20% on the amount of the proposed penalty, these being
cumulative with each other. The aforementioned reductions must be determined in
the notification of initiation of the procedure and its effectiveness will be
conditioned to the withdrawal or resignation of any action or remedy in
administrative against the sanction.
The percentage of reduction foreseen in this section may be increased
regulations. "
In accordance with the above, the Director of the Spanish Agency for the Protection of
Data
RESOLVES:
FIRST: DECLARE the termination of procedure PS / 00003/2020, of
in accordance with the provisions of article 85 of the LPACAP.
SECOND: NOTIFY this resolution to PLAY ORENES, S.L ..
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.
968-150719
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
