AEPD (Spain) - PS/00027/2019

From GDPRhub
Revision as of 16:08, 11 March 2020 by Juliette Leportois (talk | contribs) (Created page with "{{DPAdecisionBOX <!--Information about the DPA--> |Jurisdiction=Spain |DPA-BG-Color=#ffffff; |DPAlogo=logoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) <!--Inf...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
AEPD - PS/00027/2019
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(b) GDPR
Article 83(5)GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: n/a
Published: 6. 3.2020
Fine: None
Parties: Anoymous
Minstry for Internal affairs
National Case Number/Name: PS/00027/2019
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in es)
Initial Contributor: n/a

The APED issued a reprimand to the Ministry of internal affairs due to their misuse of surveillance cameras. The controller did not inform about the specific purposes of the surveillances cameras processing employees’ personal data and, thus, breach the principle of purpose limitation. .

English Summary

Facts

Prior to the entry in force of the GDPR, a police inspector requested a copy of the surveillance cameras in a police station. Although the cameras were installed for the “security and protection” of the detainees and the police station, he requested the copy to check if one of the police officers followed his instruction: to wear the regulatory uniform. While, there was no proof that disciplinary procedure has been initiated, the copy of the images has been delivered.

The employee filed a complaint with the AEPD.

Dispute

The question was whether the information on the use of surveillance cameras for “security and protection” was sufficient to cover employees’ surveillance.

Holding

The AEPD ruled that the use of the surveillance video was against the principle of purpose limitation, Article 5(1)(b) GDPR.

Indeed, the controller carried out a disciplinary control though surveillance cameras and did not inform the affected data subjects accordingly. Insofar the data subjects have not been properly informed of the surveillance specific purpose, the controller could not have legitimated the processing disputed on the consent.

The APED ruled that it constituted a misused of the system and as mentioned in another court case-law, “it was necessary to expressly, precisely, clearly and unequivocally inform the workers of the monitoring purpose with a prior notice” and that “it should specify the characteristics and scope of the data processing to be carried out, i.e. in which cases the recordings could be examined, for how long and for what purposes, explaining in particular that they could be used to impose disciplinary measures for breaches of the employment contract”.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.

to be completed