AEPD - PS/00027/2019

From GDPRhub
AEPD - PS/00027/2019
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(b) GDPR
Article 83(5) GDPR
Type: Complaint
Outcome: Upheld
Decided: n/a
Published: 6. 3.2020
Fine: None
Parties: Anoymous
Ministry for Internal affairs
National Case Number/Name: PS/00027/2019
European Case Law Identifier: n/a
Appeal: {{{Appeal_To_Status}}}
[[:Category:{{{Appeal_To_Body}}}|{{{Appeal_To_Body}}}]]
[[{{{Appeal_To_Link}}}|{{{Appeal_To_Case_Number_Name}}}]]
Original Language(s): Spanish
Original Source: AEPD (in es)
Initial Contributor: {{{Initial_Contributor}}}

The AEPD issued a reprimand to the Ministry of internal affairs due to their misuse of surveillance cameras in a police station. The controller did not inform about the specific purposes of the surveillances cameras which were used for the employees' monitoring and, thus, breached the principle of purpose limitation.

English Summary[edit | edit source]

Facts[edit | edit source]

Prior to the entry in force of the GDPR, a police inspector requested a copy of the surveillance cameras in a police station. Although the cameras were installed for the “security and protection” of the detainees and the police station, he requested the copy to check if one of the police officers followed his instruction: to wear the regulatory uniform. While, there was no proof that disciplinary procedure has been initiated, the copy of the images has been delivered.

The employee filed a complaint with the AEPD.

Dispute[edit | edit source]

The question was whether the information on the use of surveillance cameras for “security and protection” was sufficient to cover employees’ surveillance.

Holding[edit | edit source]

The AEPD ruled that the use of the cameras for the employees' surveillance was against the principle of purpose limitation, Article 5(1)(b) GDPR.

Indeed, the controller carried out a disciplinary control though surveillance cameras and did not inform the affected data subjects accordingly. Insofar the data subjects have not been properly informed of the surveillance specific purpose, the controller could not have legitimated the processing disputed on the consent.

The APED ruled that it constituted a misused of the system and as mentioned in another court case-law, “it was necessary to expressly, precisely, clearly and unequivocally inform the workers of the monitoring purpose with a prior notice” and that “it should specify the characteristics and scope of the data processing to be carried out, i.e. in which cases the recordings could be examined, for how long and for what purposes, explaining in particular that they could be used to impose disciplinary measures for breaches of the employment contract”.

Comment[edit | edit source]

Share your comments here!

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.