AEPD - PS/00028/2021
|AEPD - PS/00028/2021|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 6(1)(e) GDPR
Article 22 LOPDGDD
|Parties:||MINISTERIO DE DEFENSA|
|National Case Number/Name:||PS/00028/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The Spanish DPA warned the Ministry of Defence for having cameras outside of its building that partly recorded private parking spots belonging to nearby houses, where this was not strictly necessary for security purposes.
English Summary[edit | edit source]
Facts[edit | edit source]
The Spanish DPA (AEPD) received a complaint from a data subject living close to a building owned by the Spanish Ministry of Defence. Such building had cameras recording its outside perimeter, that included private parking spots from homes more than five meters apart.
The data subject alleged that, as they owned one of those homes, they were recorded by the cameras every time they moved around their home, so any security workers of the building could know what time they left and entered the house, recording their vehicle, including its licence plate, and themselves while doing it.
The Ministry of Defence acknowledged that, even if there were informing banners about the cameras, some made reference to the former data protection act, and that the angles of some cameras should be adjusted. Those cameras showed part of an avenue, including private homes, and part of the facade of some buildings, showing the inside of the homes through them. They also alleged that the images could only be watched in certain cases authorized by law. Also, that the legal basis for the recording was Article 6(1)(e), given the fact that the surroundings of the building were classified as military-home-zone, and they had authorization to proceed in such a way.
Holding[edit | edit source]
The Spanish DPA acknowledged the right of the Ministry of Defence to obtain such recordings through the camera, with grounds on Article 6(1)(e) GDPR and Article 22 of the Spanish Data Protection Act (LOPDGDD), that allows the recording of public spaces when it is necessary to ensure the security of strategic facilities, as long as they do not record the inside of private homes.
However, the AEPD held that there had been a violation of Article 5(1)(c) GDPR. Even if the Ministry had a legal basis for the treatment, the minimization principle shall always be complied with. The AEPD concluded that some of the cameras gathered images that were not strictly necessary for security purposes (such as the ones that recorded a whole avenue, obtaining images of private parking spots, or the ones pointing to the facade of buildings), therefore infringing Article 5(1)(c).
For this, the AEPD warned the Ministry of Defence, given that the Spanish Data Protection Act does not allow for fines to public institutions.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/8 Procedure No.: PS / 00028/2021 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following FACTS FIRST: Mr. A.A.A. (* hereinafter, the claimant) dated October 4, 2019 filed a claim with the Spanish Data Protection Agency. The The claim is directed against MINISTRY OF DEFENSE with NIF S2801407D (in ahead, the claimed one). The reasons on which the claim is based are so succinctly the following: “The cameras capture the parking lot of the surrounding houses, taking license plates with more than five meters of separation from its fence that limits the terrain of said residence, in such a way that the workers of the residence with access to camera screens or recordings know what time I arrive, when I leave and they record my license plate and the movements of my vehicle and myself ”(folio nº 1). Along with the claim, it provides documentary evidence (Annex I) that proves the presence of a device that could obtain image (s) of the area of Claimant's vehicle parking. SECOND: In view of the facts denounced in the claim and the documents provided by the claimant, the General Sub-Directorate for Inspection of Proprietary Data agreed to carry out preliminary investigation actions to clarify of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of Regulation (EU) 2016/679 (Regulation General Data Protection, hereinafter RGPD), and in accordance with the provisions cido in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5 of December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD). As a result of the investigative actions carried out, it is verified that the responsible for the treatment is the one claimed. The result of the previous investigation is reflected in the file you with reference number E / 12131/2019. THIRD: On October 29, 2019, the claim is transferred to the Ministry of Defense requesting clarification on the causes that have motivated the claim. FOURTH: On December 30, 2019, without receiving a letter from German tions of the aforementioned Ministry, the Spanish Agency for Data Protection agreed to to carry out the present investigation actions in relation to the facts related to cried out. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/8 FIFTH: On January 13, 2020, it is received at this Agency, with number registration 001176/2020, answer sent by the Ministry of Defense manifes- considering that after the analysis of the system, two aspects that could be improved could be cause of claim: one, relative to the degree of fulfillment of the duty of informing and of transparency, concretized in some deficiency of the signage; Y another, relative to the orientation of some of the outer cameras. Regarding the obligation to inform the interested party of the video-monitored area, there are posters both outside the Residence and inside, detecting that al- some of them made reference to the previous data protection regulations, therefore that instructions have been given to the facility for their correction. They provide photographic report tographic of a total of 9 informative posters and their situation. It is verified that the video-surveillance area is reported through posters in all the entrances to the enclosure and other places of the perimeter and in the common areas of the interior of the residence, indicating the person responsible for the treatment and where the inter- sado to exercise the rights contained in the RGPD. They also inform this Agency that regarding the capture of images by the video surveillance cameras, have proceeded to modify their orientation in order to in order to minimize the capture of areas beyond the perimeter of the Residence and to Above all, the visualization of the windows of the adjoining houses (facades East and West Side). In this sense, they provide screen printing of the images captured by the sixteen video surveillance cameras as seen on the monitor display. The reorientation of cameras 2 and 7 installed in the East Lateral façade and chambers 4 and 5 on the West Lateral façade. In relation to the capture of the video surveillance camera claimed (camera No. 2 located on the East Side façade) it is observed that it no longer captures the windows of the adjoining house but still partially visualizing Avenida *** AVENIDA.1 that is located between the Residence and the adjoining houses and where the parking indicated in the claim. SIXTH: On February 9, 2021, the Director of the Spanish Agency for Pro- Data protection agreed to initiate a sanctioning procedure for the complained party, in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, on the Procedure Common Administrative Procedure of Public Administrations (hereinafter, LPA- CAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the GDPR. SEVENTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written allegations in which, in summary, it stated the following: -Responsible for the installation 4th General Subinspection Army Land (ET), *** ADDRESS.1 (*** LOCATION.1). -It is only intended to allow the viewing of images, as intended In the law (…). -As already indicated, the change of the posters, adapting the text with reference to the new regulations. -There are 9 informative posters in the installation of the existence of an area video-surveillance. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/8 EIGHTH: A list of documents in the document is attached as an annex. procedure, remembering full accessibility to the file if required. NINTH: On 03/08/21 a "Proposal for a Resolution" is issued by which the declares the commission of the infringement of article 5.1 c) RGPD, by disposing of it denounced of several cameras oriented excessively towards the public area, making a "Data processing" of third parties without just cause. TENTH: On 03/22/21 this Agency receives a written reply to the "Resolution proposal" arguing the following: Nullity of the procedure due to defenselessness. It is not until February 15, 2021, in the document signed on that date, that The AEPD notified the Agreement to initiate the sanctioning procedure, which has been proof of the author's Complaint and the facts allegedly sanctioned, without any other mention of the transcript of the quotation of part that is included in the brief of the allegedly irregular facts. The art. 53.2 Law 39/2015, (October 1) establishes the rights of the alleged responsible for the sanctioning procedure in accordance with the provisions of the Article 24 EC. In conclusion of what has been stated so far and with express invocation of the provided in art. 47 point 1 a) and e) of the aforementioned Law 39/15 we request the Archive of the performances. On the substance of the matter. It turns out that from what has been done so far, it has It has been proven that the area in which the events took place is about houses that are characterized to military groups, since these areas are classified currently in the 2019 PGOU as “military-housing-zones”. Therefore, the person responsible for the treatment has the legitimacy to carry it out under art. 6.1 E) RGPD, as it is necessary for the fulfillment of a mission carried out in the public interest in the exercise of public powers conferred on the responsible for the treatment finding its legality in the regulations above cited. REQUEST: On behalf of the MDEF that I hold, that you previously Timely verifications that proceed in Law and taking into account the allegations (…) The File of the present proceedings is decreed " Of the actions carried out in this procedure and of the documentation Obrante in the file, the following have been accredited: PROVEN FACTS First. On 10/04/20 a claim is received against the entity-Ministry of Defense. sa-transmitting as main fact: “The cameras capture the parking lot of the surrounding houses, taking license plates with more than five meters of separation from its fence that limits the terrain of said residence, in such a way that the workers of the residence with access to camera screens or recordings know what time I arrive, when I leave and they record my license plate and the movements of my vehicle and myself ”(folio nº 1). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/8 Second. It is proven that the video surveillance system is associated with the Ministry of Defense Territory (AGE). Third. It is proven that the Ministry of Defense (denounced) did not have the signage in legal form, showing certain “deficiencies” that are being remedied swimming. Bedroom. The denounced system is aimed at the security of the Department of nisterial, building and staff of the same, being responsible for the effective control of the system the Second Chief of Staff Army Land (ET). Fifth. Of the set of cameras installed (16 in total) it was found that four performed caused excessive uptake, proceeding to correct their angle or pro- yielding to the "masking" of the images. Annex II (Evidentiary Documentary) shows the before and after of the gulo corrected. 48-16112 FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to re- solve this procedure. II Before going into the merits of the matter, it is convenient to examine the request for Annulment of the present proceedings claiming helplessness. Article 62 of Law 39/2015 81 October) provides: “A complaint is understood to be cia, the act by which any person, in compliance or not with a legal obligation, gal, informs an administrative body of the existence of a certain fact that could justify the ex officio initiation of an administrative procedure. vo ". Having consulted the base of this body, there is no record that the defendant exercised her right (art. 53.1 "in fine" Law 39/2015) "to access and obtain a copy of the documents contained in the aforementioned procedures ”. Therefore, it is not possible to use "defenselessness" when it has not exercised in time and form your legally recognized rights. As stated in the brief of allegations dated 03/22/21 in the Agreement Initiation of this Agency is already expressly mentioned that the procedure begins by Complaint of the claimant, being clear the "facts" that were imputed to him and Those who have had the opportunity to claim what has been considered appropriate. Furthermore, it does not specify what the defenselessness produced consists of, making a generic argument, when the reality is that it has been allowed C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/8 argue all that is necessary to prove the legality of the camera system object- to denounce. Therefore, it is not considered that there is any cause for nullity, reason by which the application in this regard should be rejected. III In the present case, we proceed to examine the claim for the date of entry into this Agency 10/04/19 by means of which the following is transferred as the main event next: “The cameras capture the parking lot of the surrounding houses, taking license plates with more than five meters of separation from its fence that limits the terrain of said residence, in such a way that the workers of the residence with access to camera screens or recordings know what time I arrive, when I leave and they record my license plate and the movements of my vehicle and myself ”(folio nº 1). The facts are therefore specified in the proportionality of the obtaining of images through video surveillance cameras, considering "excessive" the target perimeter uptake. Article 22 section 2 of the LOPDGDD provides the following: “Images of the public road may only be captured to the extent that it is Essential for the purpose mentioned in the previous section. However, it will be it is possible to capture the public road in a greater extension when necessary ary to ensure the security of strategic assets or facilities or infrastructure structures related to transport, without in any case involving the capture of images of the interior of a private home " The allegations made initially were considered insufficient to determine create the File of the claim presented, by continuing to affect the system to the claimant's parking area, without any reasoned explanation being made in this regard, the "facts" that are the object of the complaint subsist. Video surveillance, as a solution to a security problem, should be a adequate, pertinent and not excessive measure in relation to the purpose pursued and that justifies the installation of surveillance cameras. Furthermore, the proportionality requires that the end of security cannot be achieved through other alternative means. native, less intrusive to the fundamental rights of users. Through the use of sound and image recording systems and their post- subsequent treatment, the level of protection of the assets and liberties of the people. IV In accordance with the evidence available in this proceeding sanctioner, it is considered that the defendant has a video camera system C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/8 deo-surveillance whose capture of images had been "excessive", affecting this way to third party rights. Specifically, some of the exterior cameras were oriented towards the area of public transit and adjacent buildings, exercising excessive control of di- chas areas without just cause. The known facts are constitutive of an infraction, attributable to the claim. mado, for violation of the content of art. 5.1 c) GDPR. Article 58 section 2 of the RGPD provides the following: Each authority of control will have all of the following corrective powers listed below: d) order the person in charge of the treatment that the operations of treatment comply with the provisions of this Regulation, where appropriate, in a certain way and within a specified time; The behavior described is subsumed in the offending type of art. 83.5 a) GDPR, which prescribes the following: "Violations of the following provisions will be sanctioned, in accordance with with paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or, for a company, an amount equivalent to a maximum of 4% of the volume total annual global business menu for the previous financial year, opting for the higher amount: a) the basic principles for the treatment, including the conditions for the treatment consent in accordance with articles 5, 6, 7 and 9; V Article 77 section 1 of the LOPDGDD provides: "The regime established in this article will be applicable to the treatments of those who are responsible or in charge: c) The General State Administration, the Administrations of the communities Autonomous entities and entities that make up the Local Administration. 2. When the managers or managers listed in section 1 commit- have any of the infractions referred to in articles 72 to 74 of this law organic, the competent data protection authority will issue a resolution sanctioning them with warning. The resolution will thus establish The measures to be adopted to stop the behavior or correct the effects of the offense that had been committed. The resolution will be notified to the person in charge of the treatment, to the earning that depends hierarchically, where appropriate, and those affected who had the condition of interested party, if applicable (…) ”. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/8 4. The data protection authority must be informed of the resolutions tions that fall in relation to the measures and actions referred to in the previous sections. 5. They will be communicated to the Ombudsman or, where appropriate, to the institutions of the autonomous communities, the actions carried out and the resolutions rules issued under this article. SAW By the denounced party, as a result of this procedure, it has been proceeded to correct the "deficiencies" of the system, showing an attitude of full collaboration with this organism. We have proceeded to correct the "irregularities" consisting of a collection excessive perimeter areas, which could affect the rights of neighbors adjoining, preserving their privacy. Orders have been given to update the posters to the regulations in force, es- taking the measures pending compliance to date. On this aspect, it should be emphasized that no documentary evidence has been provided. that certifies the effective change of the signage adapting it to the RGPD. Remember in any case that current regulations (RGPD) allow a greater uptake of adjacent areas of public buildings, to avoid vandalized acts and incardinated in the security of state institutions. “However, it will be possible to capture the public highway in a sub- superior when necessary to guarantee the safety of goods or facilities strategic (…) ”-art. 22 LOPDGDD--. The data processing (license plate) of the cars that park in an adjacent area Centence is an issue incardinated in the security of the complex, and may be of interest For this reason, the control of the same, without being considered excessive a priori, that they remain recorded within the deadlines set in the regulations. It should be remembered that cameras improve public safety because they affect different reducing subjective insecurity, allow early reaction to emergencies of diverse nature, as well as help to the pursuit of nature activities criminal. Notwithstanding the foregoing, it is necessary to verify the commission of the offense described, since the corrections have occurred after the notification of the Agreement of Initiation of this sanctioning procedure, although it is not necessary to impose any corrective measure (s) as they have been diligently adopted by the Ministry outlined, except in relation to the corrections of the posters of the complex. Remember that if you proceed to modify the angle of the cameras, as long as it is necessary to preserve the safety of the installation for the sake of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/8 of greater protection of the building and personnel at your service, you must notify this body with reference to the procedure number in question. For the aforementioned reasons, the request for the Archive of the present procedure, since some of the outer cameras “dealt with data ”in excess of public area (eg catchment of the entire avenue); it has not been accredited despite the time elapsed the change of the signage in the terms widely recommended and finally, the "reminders" made by the Instructor of the procedure cannot be used in this phase of the procedure to claim the Archive of the same. Therefore, in accordance with the applicable legislation and the graduation criteria assessed tion of the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE the MINISTRY OF DEFENSE, with NIF S2801407D, for an fraction of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a san- tion of APPRECIATION. SECOND: NOTIFY this resolution to the MINISTRY OF DEFENSE. THIRD: COMMUNICATE this resolution to the Ombudsman, of in accordance with the provisions of article 77.5 of the LOPDGDD. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the inte- Residents may file, optionally, an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from the day after notification of this resolution or directly contentious appeal administrative before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the additional provision Fourth nal of Law 29/1998, of July 13, regulating the Contentious Jurisdiction- administrative, within a period of two months from the day following the notification tion of this act, as provided in article 46.1 of the aforementioned Law. 938-131120 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es