AEPD - PS/00003/2020
|AEPD - PS/00003/2020|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 83(5) GDPR
Article 22 LOPDGDD
|National Case Number/Name:||PS/00003/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
The Spanish DPA (AEPD) imposed a fine of €5000 on a betting company because its installation of cameras did not comply with Article 5(1)(c) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
On October 16th 2019, due to complaints from neighbours about the cameras facing the public space, the local police came to check the content of the recordings, but they were not allowed access to the images.
On December 18th 2019, the AEPD informed the company of the complaint and requested more information regarding the video surveillance system.
PLAY ORENES S.L. invoked article 22 LOPDGDD, which allows the capture of images of the public highway, in some cases, with the aim of preserving the security of people and goods.
From the inspection of the frames taken from the system's viewing monitor, which through 4 cameras facing the outside, it was verified that the entire width of the street was captured, as well as the vehicles parked.
It is also recorded as a proven fact that the claimant removed 3 of the 4 cameras facing outwards, following the claim. However, a camera has been maintained which captures images of the street and the parked vehicles.
Dispute[edit | edit source]
Must video surveillance installations that record images of public space respect Article 5 (1) (c) GDPR?
Holding[edit | edit source]
The AEPD held that the installation of a video surveillance system under Article 22 LOPDGDD must always comply with the principle of minimization of data, set out in Article 5 (1) (c) GDPR.
The aggravating circumstance taken into account was: the intentionality or negligence of the infringement (Art. 83 (2) (b) GDPR); while as mitigating circumstances: the adoption of measures taken by the person responsible to mitigate the damage (Article 83 (2) (c) GDPR), collaboration with the Agency in responding to the complaint (Article 83 (2) (f) GDPR), not linking the activity of the offender to the processing of personal data (Article 76 (2) (b) LOPDGD), the non-existence of profits obtained as a result of the infringement (Article 76 (2) (c) LOPDGDD and, having the figure of the data protection delegate even though it is not obligatory for the company (Article 76 (2) (g) LOPDGDD).
Furthermore, the AEPD requested the company in question to prove that it had removed the camera that still recorded images of the street, in accordance with Article 58(2)(d) GDPR.
Comment[edit | edit source]
The company PLAY ORENES S.L. made use of the reduction of 20% of the amount of the sanction, proceeding to the voluntary payment so that the amount was reduced to EUR 4000.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.