| AEPD - PS/00082/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 08.09.2020 |
| Published: | 24.09.2020 |
| Fine: | n/a |
| Parties: | Grúas Barea, S.L.U. |
| National Case Number/Name: | PS/00082/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | Miguel Garrido de Vega |
The Spanish DPA (AEPD) imposed a warning on Grúas Barea, S.L.U. for the non-compliant installation of a video surveillance system, and the consequent infringement of the data minimisation principle (Article 5(1)(c) GDPR).
English Summary
Facts
The decision is the consequence of a complaint submitted by a Spanish citizen stating that the defendant has installed a video surveillance system allegedly pointing to a parking area without the consent of the owner of such area. The complaint included pictures proving that the video surveillance system was installed. The claimant was the landlord of the defendant.
Dispute
The defendant answered to the AEPD investigation requests stating that:
(i) it has installed the corresponding information poster,
(ii) it has installed six cameras in order to ensure the safety of its establishment,
(iii) the cameras pointing to the parking are only recording heavy equipment, and, considering that the property is leased and that the defendant and the claimant do not have a good relationship, the defendant understands that this complaint is a pressure measure by the lessor, and
(iv) the defendant is planning to leave the property before May 2020. The AEPD started the corresponding sanction procedure; after that, the defendant submitted the corresponding pleadings document, in which it declared that it has left the property and uninstalled all the cameras, attaching pictures of the same as a proof. As a result of its investigation, the AEPD considered that the claimant had a video surveillance system with an excessive orientation to an area out of its property, and without due cause: two of the six cameras were directly recording not only the entrance, but also the sidewalk and nearby road; in order to ensure the safety of the establishment it was not necessary to record such a big area.
Holding
Thus, the AEPD understood that the video surveillance system infringed the data minimisation principle (Article 5(1)(c) GDPR) and, after considering certain factors [(i) the defendant has collaborated with the AEPD, (ii) there is no intentionality by the defendant, and (ii) the video surveillance system has been uninstalled and the property has been left by the defendant, but (iii) in the end, the alleged facts have been proven], it imposed a minor warning to the defendant.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1
1/7 Procedure Nº: PS / 00082/2020938-300320RESOLUTION OF SANCTIONING PROCEDUREOf the procedure instructed by the Spanish Agency for Data Protection andbased on the followingACTSFIRST: Mrs. AAA (* hereinafter, the claimant) dated November 18,2019 filed a complaint with the Spanish Agency for Data Protection. TheThe claim is directed against GRÚAS BAREA SLU with NIF B14300313 (hereinafter,the claimed). The reasons on which the claim is based are “installation of cameravideo surveillance ”with orientation towards the parking area without having theauthorization from the owner of the land.Along with the claim, it provides documentary evidence that proves the presence ofvideo surveillance device-Annex I--.SECOND: In view of the facts reported in the claim and the documentsprovided by the claimant, the General Subdirectorate for Inspection of Datayielded to carry out preliminary investigation actions to clarifyof the facts in question, by virtue of the powers of investigation granted to thecontrol authorities in article 57.1 of Regulation (EU) 2016/679 (RegulationGeneral Data Protection, hereinafter RGPD), and in accordance with the provisions ofcido in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5December, Protection of Personal Data and guarantee of digital rights (inhereinafter LOPDGDD).As a result of the investigation actions carried out, it is verifiedthat the person responsible for the treatment is the one claimed.THIRD. On 01/10/20, the claim was TRANSFERRED to the partydenounced to allege what the Law deems appropriate, statingsuccinctly the following:-That the system has an informative poster (Doc. Test nº 1).-That the number of cameras installed is six, which are installed byestablishment security reasons.-That the cameras installed in the parking area are installed for reasons ofcapture of images of heavy machinery, although the property is rented,considering that the Complaint is due to “pressure” from the lessor for reasonsof the rental regime.-The decision has been made to abandon the ship, the transfer to thenew location before May of the current year.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/7Therefore, it REQUESTS that the allegations be taken into account and thatfor complying with the data protection regulations ”.FOURTH: On March 30, 2020, the Director of the Spanish Agency forData Protection agreed to initiate a sanctioning procedure to the claimed, by thealleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of theRGPD.FIFTH: On 06/22/20, this Agency received a written allegations from thedenounced entity -Grúas Barea- stating the following:“In advance we want to state that on March 20,Cranes Barea totally and definitively vacated the rented warehouse where they werethe cameras that are the object of the complaint, proceeding that same day to withdraw thesame (..) Document No. 1.Therefore and understanding that said equipment is not in operation,We understand by completing the provisions of Law Foundation IV of theresolution received, since all cameras have been removed, not just the cameraqualified as "conflictive" if not all the others.In order to prove the closure of said Delegation in Seville, it is attached asDocument nº 3, screenshot of the screen of June 22, 2020, obtained from the webde Grúas Barea, SLU ( *** URL.1 ) where it can be seen that, between the Delegationsof this company, the one located in the aforementioned warehouse is no longer found.In order to prove the foregoing, a letter addressed to the owner is attachedthrough burofax communicating the termination of the lease by saidreason, as Document No. 2.We also understand that it is necessary to bear in mind that the ship wherefound the cameras that were the subject of the complaint (1.2 of plot 12) adjoined by itsleft with 1.1 of the aforementioned plot, also owned by Insauce InmueblesSLU and both warehouses were the only buildings that existed on plot no. 12,whose ownership also belongs to the aforementioned Company.In the same way, we also wanted to clarify in our previous writing, as toto the images captured by camera 3 to which the request sent bysaid Subdirectorate, that the warehouse in addition to the existing pedestrian door on the facade,It had two overhead doors on its right side, whose access area wasessential for maneuvers and continues entry / exit of large machinerydimensions.We also reiterate that our intention in placing the cameras was, in allmoment, guarantee the safety of personnel and facilities, because in said areayou work with heavy machinery.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/7For all the above, I request the AEPD to have this writing presented, withthe accompanying documentary evidence, considering the allegations to theresolution of the initiation of the sanctioning procedure (...) ”.SIXTH: On 07/13/20, a resolution proposal was issued proposingimpose a penalty of Warning, when it is proven that the denouncedhad a camera system oriented towards third party (s) without causejustified, infringing art. 5.1 c) RGPD, without any reply beingmade in this regard by the same.In view of all the actions, by the Spanish Protection Agencyof Data in this procedure the following are considered proven facts,First. On 11/18/19, this Agency received a Complaint against the entityDad Grúas Barea, for the installation of a video surveillance system with guidancefrom at least one of the cameras to the common parking area with the shipadjacent, obtaining, where appropriate, images from third parties without the authorizationinformed of these.Second. The entity-Cranes Ba-area — which acknowledges having a video surveillance system composed of a total ofsuch a six-chamber.The cameras are fixed image, have infrared for night recording.na, they do not have zoom or rotation.-Camera nº4. Captures an image of the parking area, displaying part ofthe sidewalk in front of the camera installation site.-Camera nº5. Get a visual of the parking area being displayedthe squares located in it, in such a way that it allows to control the movements ofeveryone who accesses it.Third. The reported entity certifies that it has an informative poster (s),providing photographic material that proves its presence in a visible area, includingstating the person responsible for the treatment.Room. It is proven as the main reason for the installation of the system“security” reasons, not having contracted the installation of the system with analien prey.Fifth. In writing dated 06/22/20 by the denounced entity, thedoes not state having proceeded to withdraw all the cameras, having vacated therented ship, there is no device to date.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/7FOUNDATIONS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authoritycontrol, and according to what is established in articles 47 and 48 of the LOPDGDD, therector of the Spanish Data Protection Agency is competent to initiate andto solve this procedure.IIIn the present case, the claim dated 11/18/19 is examined bygave of which the following facts are made known to this Agency:"The delegation of Seville, located on the street *** DIRECCIÓN.1 of *** LOCA-LIDAD.1 , in Seville, cp *** CP1 , they have 3 cameras placed to monitor the parking lotsprivate communal spaces that are also used by the adjoining warehouse, without car-creation of the community of owners of said plot, which has already requestedburofax to remove the cameras, ignoring it. It also does not have postersindicative of the existence of said cameras and of the right of access to imagesgenes of said cameras ”.The facts are specified in the installation of a video surveillance systemwith orientation of at least one of the cameras towards the parking areabad with the neighboring ship, obtaining, where appropriate, images from third parties without countingwith their informed authorization.The content of article 5.1 letter c) RGPD, which provides: “Thepersonal data will be:c) adequate, relevant and limited to what is necessary in relation to the purposesfor those who are processed ("data minimization");It should be remembered that cameras installed by individuals cannot beoriented towards public / private space, affecting the privacy of third parties, whichThey are intimidated by these kinds of devices.Surveillance cameras may make recordings limited to what is necessary, theperimeter and some reasonable points, applying the principle of proportionality, it isIn other words, only the truly relevant areas will be recorded for the purposewanted.IIIIn accordance with the evidence provided in this proceedingsanctioner, it is considered that the defendant had a system of camerasdeo-surveillance, with an excessive orientation towards the area of third parties, without justifiable cause.each.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/7Specifically examined the screen prints of cameras No. 4 and 5,Images were obtained of the entrance to the enclosure, capturing the sidewalk and adjacent road(camera nº 4) and with camera nº 5 the entire parking area was controlled.The denounced party argues that at the time of renting the ship, theadjoining ship was unoccupied and with a sign of "For rent", being thecar parks for the exclusive use of the Grúas Barea entity.The truth is that between the parties (complainant / accused) there is no goodtion, as the complainant himself argues when stating that “they leave the propertyagainst their will ”or“ in view of the unsustainable situation ”.In this case, it would have been advisable for the denounced party to inform theleast to the Administrator of the intention to control the parking area of useshared with the adjoining ship, even if it was "unoccupied" and hadControlled with the system to the exclusive area of your ship, being able to reach aunderstanding based on good faith between the parties.Article 1,255 of the Civil Code provides: »The contracting parties may establishclose the agreements they deem convenient, provided they are not contrary to the law,to morality or to public order ».The mere presence of the camera (s) was considered an “intimidating” element.giver ”by the complaining party, regardless of whether or not there has been a"Third party data processing", this aspect is not accredited at least in the area ofparking.Control for “security” reasons of the reported entity was achieved freely.limiting access to the area that had the right of use based on the relationshipcontractual between the parties.Therefore, the facts that are the subject of the complaint are accredited when consideringExcessive third party space imaging without just cause.The art. 83.5 RGPD provides the following: “Violations of the following provisionsThese will be sanctioned, in accordance with section 2, with administrative fines of 20EUR 000 000 maximum or, in the case of a company, an equivalent amountat a maximum of 4% of the total global annual turnover for the financial yearabove, opting for the one with the highest amount:a) the basic principles for the treatment, including the conditions for theconsent in accordance with articles 5, 6, 7 and 9;In the present case, the collaboration of the accused withthis organism, the limited nature of the uptake, being a private space, thusas little intentionality, given that the installation was for security reasonsof personnel and facilities, in particular because in that area they worked withheavy quinary.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/7Hence, from now on, the installation of a camera system musttar with the mandatory information poster (art. 22.4 LOPDGDD), limit your catchment areation to the private space or what is necessary to allow the security of the facilities,as well as adjusting to the specific regulations of the sector that may regulatelarla.IVWithout prejudice to the provisions of article 83 of the RGPD, the aforementioned Regulationprovides in its art. 58.2 b) the possibility of sanctioning with warning, in relation towith what is stated in Recital 148:"In the event of a minor offense, or if the fine likely to be imposedwould constitute a disproportionate burden on a natural person, rather thantion through a fine may be imposed a warning. It must nevertheless be paidspecial attention to the nature, severity and duration of the offense, its characterintentional, to the measures taken to alleviate the damages suffered, to the degreeliability or any prior relevant infringement, to the way in which the au-control authority has had knowledge of the infringement, compliance withorders ordered against the person in charge or in charge, to adherence to codes ofduct and any other aggravating or mitigating circumstance. "To date, the cameras that are the subject of dispute between the parties have been withdrawn.days, upon termination of the contractual relationship between the parties, so the area is free fromany camera, although it is necessary to warn the denounced, when being accreditedthe "facts" opting for a mere Warning for the offense committed inbased on slight negligence.Therefore, in accordance with the applicable legislation and the criteria ofgraduation of sanctions whose existence has been proven,the Director of the Spanish Agency for Data Protection RESOLVES:FIRST: IMPOSE GRÚAS BAREA SLU . , with NIF B14300313 , for aviolation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, aWarning sanction .SECOND: NOTIFY this resolution to GRÚAS BAREA SLU andREPORT the result of the proceedings to the complaining party Doña AAAIn accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once it has been notified to the interested parties.Against this resolution, which puts an end to the administrative procedure in accordance with art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of theLPACAP, the interested parties may optionally file an appeal for reversalbefore the Director of the Spanish Agency for Data Protection within a period ofmonth from the day after notification of this resolution or directlycontentious-administrative appeal before the Contentious-Administrative Chamber of theC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/7National High Court, in accordance with the provisions of article 25 and section 5 ofthe fourth additional provision of Law 29/1998, of July 13, regulating theContentious-administrative jurisdiction, within a period of two months from theday following notification of this act, as provided in article 46.1 of thereferred Law.
Mar España Martí
Director of the Spanish Agency for Data Protection
