AEPD (Spain) - PS/00054/2020

AEPD - PS/00062/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 13 GDPR Article 22 LOPDGDD
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	19.02.2021
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	PS/00062/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Francesc Julve Falcó

The Spanish Data Protection Agency (AEPD) imposed a warning sanction on a private individual for the installation of a video surveillance system without informing the subjects who may be recorded of the data processing, in violation of Article 13 and Article 5 (1) (c) GDPR.

English Summary

Facts

The complainant lodged a complaint with the AEPD about the installation of video surveillance cameras in the neighbours' doorway, from which several entrances to homes could be monitored, and believed that excessive and disproportionate use was being made of the video surveillance system in relation to data protection regulations.

The defendant responded that the installation of the video surveillance system was necessary to protect himself and his family from neighbourhood disputes caused by non-payment by his tenants.

Dispute

Is the installation of a video surveillance system in a community of neighbours, without the authorization of the rest of the neighbours, a breach of Article 13 GDPR?

Holding

The AEPD held that the video surveillance system was excessive in relation to the purposes alleged by the defendant. It imposed a warning sanction and ordered that the system should only be operational when the defendant or his family were living at the address where the camera was located.

Given that the defendant is a natural person, that there is no evidence of recidivism and that, furthermore, he has shown cooperation with the AEPD in repairing the possible damage caused, it was decided to impose a warning sanction.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/14










     Procedure Nº: PS / 00054/2020


                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following



                                  BACKGROUND

FIRST: On September 6, 2019, you entered this Agency
Española de Protección de Datos a document submitted by A.A.A., on behalf of

by B.B.B. (hereinafter, the claimant), through which he makes a claim against
C.C.C. with NIF *** NIF.1 (hereinafter, the claimed one), for the installation of a system
video surveillance in the property located at *** ADDRESS.1 - *** LOCALIDAD.1
(OURENSE), with respect to which there are indications of a possible breach of the
provided in the regulations for the protection of personal data.


The reasons that support the claim are the following:

"Don C.C.C., installs surveillance camera in the stairwell, without authorization
for our part, no mention, that he is going to put a camera. The fact is that we
we feel totally intimidated and controlled by the owner of the house. Not in-

we have the end, because there is no vandalism, and this control of knowing our
entrances and exits of the farm, makes us think that it is for a bad purpose because of his
Part, because we know that it shows people our entrances and exits of the building.
Well, this man is the owner of a house with 2 houses, one of them is the one that
I have rented, and a place that is to use and enjoy it. For which there is no

Community of owners. And without further ado he has placed this camera that I am attaching a photo-
spellings. There is no sign of said camera […] "

Attach photo report showing the location of the camera.

SECOND: Prior to the admission for processing of this claim, a

transferred the defendant, in accordance with the provisions of article 65.4 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD). The aforementioned transfer was returned by
“Absent” and “surplus (not picked up in office)” on 10/31/2019. The day 07/11/2019 was
made a reiteration that was again returned as "absent" and "surplus (no
withdrawn in office) ”on 11/27/2019.


THIRD: The claim was admitted for processing by resolution of 18
February 2020.

FOURTH: On June 8, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure to the claimed, by the

alleged infringements of articles 5.1.c) and 13 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), typified in the
Article 83.5 of the same rule.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/14









FIFTH: As the notification of the initiation agreement was unsuccessful, the
proceeded to publish a notification announcement on the Single Edictal Board of the Bulletin

Official of the State on July 8, 2020, in accordance with the provisions of the
Article 44 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter, LPACAP).

SIXTH: On September 1, 2020, the instructor of the procedure agreed to the
opening of a period of practice of tests, requiring the Command of the

Civil Guard of Ourense so that, within 30 days, it would issue the corresponding
report where it was found:

 Effective address of the claimed at the indicated address.


 Existence of a video surveillance device in the aforementioned property.

 Presence of an informative poster adapted to the regulations in force.


 Orientation of the installed cameras and their catchment area. If allowed by the
claimed, it is requested that they be observed and informed about the images displayed
on the monitor.

 Any other aspect that is considered appropriate to review.


SEVENTH: On September 16, 2019, the Civil Guard Command of
Ourense sends the report issued by the Commander of the Acctal Post. of the Guard
Civil of *** LOCALIDAD.1 on September 12, 2020. The content of the report is the

following:

"[…]1. In relation to the effective address of the claimed and if it is the indicated address
the complaint informs that the claimed person does not reside in the place where he / she is
installed the video surveillance system. It resides on the street *** ADDRESS. 2
belonging to the town of *** LOCALIDAD.2 (Madrid) and with telephone number

[…].

2 On the existence of a video surveillance device in the aforementioned property; I know
informs that a video camera installed on the aforementioned portal has been found
building, located on the wall opposite the entrance door to the portal, this being a

common area, from where the stairs that give access to the two floors start
superiors that make up the only dwellings in the building.

3º Regarding the presence of an informative poster adapted to the regulations in force.
It is reported that there are 2 informational signs, one of them in located on a door

metal just below the chamber and the other located on the wall adjacent to the place
where the camera is about ten feet away. It means that the two
Announcement signs are similar.

4th As has been outlined in point 2, regarding the orientation of the cameras
installed and catchment area of these. It is reported that there is only one camera, the

which is located on the wall opposite the entrance door to the building's portal.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/14








Supposedly this camera captures the images inside the portal. Regarding the
type of images that are recorded is unknown, since the holder does not reside and does not allow
the observation.


4th (Sic.) The person responsible for the recorded images is D. C.C.C. and it is specified
on the poster.

5th Photographic Annex is attached. "


Attach the following photos:

 Photographic image of the portal of the property where the camera and the two
posters.


 Enlarged photographic image of the poster.

EIGHTH: On the occasion of the knowledge of the claimed effective address, confirmed
by the Planning and Institutional Relations Service of the Tax Agency in

the consultation carried out, on October 2, 2020, a copy of the
report issued by the Civil Guard, as well as a copy of the agreement to initiate the
present proceeding.

The defendant presented, on October 21, 2020, an answering brief where
makes the following statements:


“[…] Reasons why a security camera is placed on the portal of said
edifice.

- On the second floor of said building there are some tenants of the company […]

(before). These men were evicted for non-payment in April 2019 by the
Court […]. In May of the same year the property was rented to me again by a man who
He claims to be the administrator of a company called […] (after), which is my surprise
that they send me a message on my mobile and it turns out that they are the same tenants who already
They had been evicted a month earlier mocking me and mocking that
they were back in the house, changing the name of the company. All this for

Of course, it was communicated at that time to my lawyer and the court.

- In August 2019, in our holiday stay, on the first floor of the
property; One night at dawn, one of the
people who are on the second floor rented (very aggressive and pushy). In that

At that moment my wife and I had an attack of anxiety and fear. These
events occurred on 08/07/2019 01:50 AM and 08/08/2019 05:30 AM, which
were testified in an appearance procedure before the Civil Guard and attested
No. […], which is communicated to the Court […].


- The most important reason why I have thought about putting a security camera is
to fully protect my family and me in case at some point they coincide
in the portal or on the stairs of the building so that the worst would not happen.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/14








- Upon my arrival in Madrid, I contact the AEPD to find out if I could proceed with the
installation of a security camera in the portal of the building (where the
camera currently). After exposing the location of the camera and the range of

the same, the answer by this organism was affirmative, informing me of
that I had to put all my personal data: responsible, exercise your rights
of data protection before and the information on the treatment of personal data;
as stated in the posters that were provided to me in the same AEPD and posts
visible in the portal of the building, where they are currently warning of
said camera, which was installed in August 2019 without going into operation until

on 09/21/2019.

- It is not in my interest at all to save images of who enters or leaves the building,
only to ensure the full safety of my family […]. I have not shown any kind of
image or personal data of these gentlemen. Therefore, the images

provided by the camera are erased absolutely and daily.

[…] "

Attach 7 images captured from October 15 to 19, 2020 in
different times showing the camera's field of view


NINTH: On December 11, 2020, a resolution proposal was formulated, in
which it is proposed that a penalty of warning be imposed on the defendant, for
an infringement of article 5.1.c) of the RGPD, typified in article 83.5 of the same

standard, as well as to certify the adoption of measures. In this proposal
grants a period of 10 days for the claimed person to be able to consider in his
defense, as well as present the documents and information that it considers
pertinent, in accordance with article 89.2 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP).


TENTH: In the event of a faulty first attempt to notify the proposed
resolution by the Post Office, the aforementioned
proposal. The notification took place on February 2, 2021 and the defendant has
submitted writing on February 15, 2021, in which it shows what

following:

"[...]

1º- On February 2, 2021, I received the proposed resolution of the letter that in its

day I sent to AEPD, the resolution proposal being a warning sanction.

I inform you that that same day the camera was disconnected, as
you have ordered me.

2º- On January 2, 2021, I proceed to sue the company […], whose

legal representatives or administrators are A.A.A. and B.B.B ..

The reason for the lawsuit is the non-payment of the rents or amounts due,
requesting the court No1 of instruction of XXXXXXXX eviction from the 2nd floor

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/14









of said property.

On February 3, 2021, I received the answer from the court that I contributed to my writing.

as evidence for the record, the legal grounds of which are listed therein, not
accommodating the enervation of the eviction action, leaving the view for the next
9/3/2021 and subsequent launch of direct eviction of the leased property for the
3/18/2021.


Being grateful in advance and very satisfied with the proposed resolution,
I remain entirely at your disposal. "


Enclosed Decree of February 3, 2021 issued by the Lawyer of the Administration
of Justice of the Court of 1st Instance and Instruction of XXXXXXXX in Verbal Trial
of Eviction.


In view of all the actions, by the Spanish Agency for Data Protection
In the present proceeding, the following are considered proven facts,











































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/14








                                       ACTS



FIRST: On September 6, 2019, you have entry into the Spanish Agency for
Written Data Protection of the claimant in which he informs the
existence of a camera in the stairwell of the building where the
housing where he resides under a lease and located at *** ADDRESS. 1 -
*** LOCALITY. 1 (Ourense).


The photographs provided together with the claim show a camera located in the
enclosure of the portal of the property. This building, divided into 3 floors (ground, 1st and 2nd) is
property in its entirety of the claimed, who has reserved use of the home of the
1st floor.


SECOND: The defendant does not have his habitual residence in the property, being his
address *** ADDRESS.2 - *** LOCALITY.2 (Madrid).

THIRD: In order to guarantee the right to defense of the defendant and the
principle of contradiction, it was agreed to refer the defendant on October 2, 2010,
once the address of your habitual residence is known, a letter accompanied by

copy of the agreement to initiate the sanctioning procedure, as well as the report to which
reference has been made in the previous event. This writing was collected by the claimed
on October 15.

FOURTH: The defendant declares in his answering brief of October 21,

2020 that the camera was installed in August 2019 and became operational on 21
September 2019. Does not include accreditation.

FIFTH: The frames of dates October 15 to 19, 2020 provided by the
claimed in their answering brief, they show that the field of view of the

chamber is circumscribed to the internal enclosure of the portal of access to the property and to part of the
flight of stairs.

SIXTH: The defendant states in his letter that the placement of the camera in his
current location responds to the purpose of guaranteeing the safety of its
person, as well as the members of his family, before unfriendly encounters with

the inhabitants of the rented apartment that could occur in the portal and on the stairs,
taking into account the problematic contractual relationship and various antecedents that
relates in his writing.

SEVENTH: The photographs attached to the report to which it is referred, evidence the presence of two

informative posters, which offer information about the person in charge, the
possibility and address where to go to exercise the rights contained in
articles 15 to 22 of the GDPR, as well as an email address and a
telephone where to request more information.


EIGHTH: The complained party communicates a change of address to Calle *** ADDRESS. 3 -
*** LOCALITY. 3.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/14








NINTH: In the brief presented on February 15, 2021, the defendant
states that he proceeded to disconnect the camera installed on February 2.



                            FOUNDATIONS OF LAW

                                             I

The Director of the Spanish Agency is competent to resolve this procedure

of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR and
in art. 47 and 48.1 of LOPDGDD.

                                             II


The defendant is charged, on the one hand, with the commission of an offense for violation
of article 5.1.c) of the RGPD that personal data will be “adequate, pertinent and
limited to what is necessary in relation to the purposes for which they are processed
("Data minimization"). "

On the other hand, the commission of another offense for violation of the

Article 13 of the RGPD, which establishes that:

"1. When personal data relating to him are obtained from an interested party, the
responsible for the treatment, at the time these are obtained, will provide
all the information indicated below:


a) the identity and contact details of the person in charge and, where appropriate, of their
representative;

b) the contact details of the data protection officer, if applicable;


c) the purposes of the treatment to which the personal data are destined and the legal basis
of the treatment;

d) when the treatment is based on article 6, paragraph 1, letter f), the interests
legitimate of the person in charge or of a third party;


e) the recipients or categories of recipients of personal data, in their
case;

f) where appropriate, the intention of the person responsible to transfer personal data to a third party

country or international organization and the existence or absence of a decision of
adequacy of the Commission, or, in the case of transfers indicated in the
Articles 46 or 47 or Article 49, paragraph 1, second subparagraph, reference to the
adequate or appropriate warranties and the means to obtain a copy of these or
to the fact that they have been borrowed.


2. In addition to the information mentioned in section 1, the person responsible for the
treatment will facilitate the interested party, at the time the data is obtained


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/14








personal information, the following information necessary to guarantee data processing
loyal and transparent:


a) the period during which the personal data will be kept or, when it is not
possible, the criteria used to determine this deadline;

b) the existence of the right to request the data controller for access to the
personal data relating to the interested party, and its rectification or deletion, or the limitation
of its treatment, or to oppose the treatment, as well as the right to portability

of the data;

c) when the treatment is based on article 6, paragraph 1, letter a), or article
9, paragraph 2, letter a), the existence of the right to withdraw consent in
at any time, without affecting the legality of the treatment based on the

consent prior to its withdrawal;

d) the right to file a claim with a supervisory authority;

e) if the communication of personal data is a legal or contractual requirement, or a
necessary requirement to sign a contract, and if the interested party is obliged to provide

personal data and is informed of the possible consequences of not
provide such data;

f) the existence of automated decisions, including profiling, to be
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information

significant on the applied logic, as well as the importance and consequences
provided for said treatment for the interested party.

3.When the data controller plans the further processing of data
personal data for a purpose other than that for which they were collected, will provide the

interested party, prior to said further processing, information on that other purpose
and any additional relevant information pursuant to section 2.

4.The provisions of paragraphs 1, 2 and 3 shall not apply when and in the
to the extent that the interested party already has the information. "


The aforementioned infractions are classified in article 83.5 of the RGPD, which
provides the following:

"Violations of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,

in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:

a) the basic principles for the treatment, including the conditions for the treatment

consent in accordance with articles 5, 6, 7 and 9;

b) the rights of the interested parties in accordance with articles 12 to 22 […] "


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/14








For the purposes of the statute of limitations for offenses, both offenses are
considered very serious and prescribe after three years, in accordance with article 72.1 of the
LOPDGDD, which establishes that:


"Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:


a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679. […]

h) The omission of the duty to inform the affected party about the processing of their data
personal in accordance with the provisions of articles 13 and 14 of Regulation (EU)

2016/679 and 12 of this Organic Law. […] "

                                           III

Article 6.1 of the RGPD establishes the cases in which the
processing of personal data, providing within them - article 6.1.e) - the

that refers to the legality "the treatment is necessary for the fulfillment of
a mission carried out in the public interest or in the exercise of public powers
conferred on the person responsible for the treatment ”.

In the specific field of data processing for video surveillance purposes, the

Article 22.1 of the LOPDGDD provides that “people may carry out the
Image processing through camera or video camera systems with the
purpose of preserving the safety of people and property, as well as their
facilities ”dedicating the rest of the sections of this article to the
specificities to which this data processing must be submitted.


In this sense, and with regard to the specific case that is the object of this present
sanctioning procedure, it can be affirmed, taking into account the declarations
made by the defendant about the purpose pursued with the chamber of
video surveillance installed on the portal of the property of which it is the owner and in which
maintains a home for his personal use, that said treatment responds to the

objective of guaranteeing the safety of people (the claimed person and the
family members) in the face of the problematic relationships maintained with
tenants who reside in the rented dwelling within the property owned by the
reclaimed. We would, therefore, be faced with a case in the person responsible for the treatment
performs a mission in the public interest.


Now, to consider the concurrence of the public interest, this must be
proportionate with respect to the purpose pursued, inasmuch as its exercise is
susceptible to affect the physical image as personal data and therefore represents a
interference in the field of fundamental rights of people. What

Consequently, it will be necessary to make a weighting between the mission of
public interest to ensure the safety of people carried out by the
responsible for the treatment and the rights of the tenants, who in the present
Of course, their privacy and freedom of movement may be affected by the fact that the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/14








The area captured by the camera affects the common area that serves as access to both
households.


In order to carry out this weighting and evaluate the proportionality of the
measure, it is necessary to take into consideration the Judgment of the Constitutional Court
207/1996, in which the High Court determines that “to verify whether a measure
restriction of a fundamental right exceeds the judgment of proportionality, it is
It is necessary to verify if it meets the following three requirements or conditions: if such
measure is capable of achieving the proposed objective (suitability judgment); Yes,

Furthermore, it is necessary, in the sense that there is no other more moderate measure to
the achievement of such purpose with equal effectiveness (judgment of necessity); and finally yes
it is weighted or balanced, as more benefits or advantages derive from it
for the general interest that damages to other goods or values in conflict (judgment
of proportionality in the strict sense) ”.


Applying, therefore, this judgment of proportionality to the specific assumption proceeds
note the following:

● The installation of a video surveillance system can be considered an ideal means
to achieve in order to guarantee the safety of the claimed and their family, for

how much it is capable of fulfilling both a preventive objective and proving
documentary evidence of the occurrence of certain events that suppose an attack on said
security.

● It can be considered that the treatment complies with the principle of minimizing

data and is moderate with respect to the area captured by the camera since it is
limits to areas only to areas common to both houses where they can
coincide the claimed and the tenants, without affecting the area in any way
exclusive of use and enjoyment of these.


● It can also be considered that the treatment complies with the principle of
minimization of data and is moderate in relation to the conservation period of
the images, for the aforementioned term, in accordance with what was stated by the
claimed, it is only 1 day.

● However, given that the purpose alleged by the defendant is

ensure the safety of your person and your family members during the
time in which any of them makes use of their home in the property and therefore
both can coincide spatially and temporally with the tenants (without there being any
alleged at no time the need to preserve the safety of one's own
property), the processing of data would be excessive when those circumstances

they do not take place, since they would exceed the purpose for which they respond.

In conclusion, it cannot be said that it is proportionate that the system of
installed video surveillance is operational at all times as the purpose
pursued by the person in charge is not reached when the defendant or a member of

your family is not using the home in the property; in this
In this circumstance, it could not be concluded that the mission of public interest prevails over
fundamental rights of those affected.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/14








In accordance, therefore, with the foregoing, the video surveillance system, to the extent
that was operational all the time (it was disconnected on February 2),
violated the provisions of article 5.1.c) of the RGPD.


                                            IV

Regarding the duty of information provided for in article 12 of the RGPD (with
the content provided in the subsequent article 13, article 22.4 of the LOPDGDD
determines that


“[…] It will be understood that it has been fulfilled by placing an information device in
sufficiently visible place identifying, at least, the existence of the treatment, the
identity of the person in charge and the possibility to exercise the rights provided in the
Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the

informational device a connection code or internet address to this
information.

In any case, the data controller must keep at the disposal of the
affected the information referred to in the aforementioned regulation ”.


According to the report and the photographic images provided by the report of the
Commander of the Acctal Post. of the Civil Guard of *** LOCALIDAD.1, the system
video surveillance has two informative posters that comply with the provisions
in the previously transcribed precept as it identifies the existence of
treatment and offers information about the person in charge, the possibility and direction to

Where to go to exercise the rights contained in articles 15 to 22 of the
RGPD, as well as an email address and a telephone number where to request more
information.

Regarding the possible breach of this duty at the time of filing

the claim, it is noted that the defendant declares that, even when the cameras are
installed in August 2019, the video surveillance system did not go into operation
until September 21. Therefore, since it has not been proven that the
camera will be in operation at the time of filing the claim
(the claimant indicates that the person in charge has shown images of their tickets and
exits from the building, but does not provide an indication in this regard), it is not possible to determine that

there would have been on that date an effective data processing and, therefore, a
omission of the duty of information.

The principle of the right to the presumption of innocence, recognized as a right
subjective fundamental in article 24 of the Spanish Constitution, prevents imposing

an administrative sanction when a proof of
charge accrediting the facts that motivate the imputation or the intervention in the
the alleged offender and applying the principle "in dubio pro reo" in case of
doubt regarding a concrete and determined fact, which in any case obliges
resolve said doubt in the most favorable way to the interested party.


The aforementioned right to the presumption of innocence is also included in a
expressed in article 53.2.b) of Law 39/2015, of October 1, on the Procedure


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/14








Common Administration of Public Administrations (hereinafter, LPACAP), which
states that:


"two. In addition to the rights provided in the previous section, in the case of
administrative procedures of a sanctioning nature, the alleged
Responsible parties will have the following rights:

[…] B) The presumption of non-existence of administrative responsibility while not
the contrary is proven. "


In relation to this principle, the Constitutional Court in its Sentence 76/1990, of 26
April, considers that the right to the presumption of innocence entails: “that the
sanction is based on acts or probative means of charge or incriminating of the
reproached conduct; that the burden of proof rests with the accuser, without

no one is obliged to prove their own innocence; and that any insufficiency in the
result of the tests carried out, freely assessed by the sanctioning body,
it must be translated into an acquittal. "

                                           V


However, what is established in article 83.5, sections a) and b), of the RGPD, its art.
58.2 b) provides the possibility of sanctioning with warning, in relation to the
indicated in Recital 148:

"In the event of a minor offense, or if the fine that is likely to be imposed

would constitute a disproportionate burden for an individual, rather than
sanction by fine may be imposed a warning. It must however
pay special attention to the nature, severity and duration of the offense, to its
intentional nature, to the measures taken to alleviate the damages suffered,
the degree of responsibility or any relevant prior infringement, the way in which

that the supervisory authority has had knowledge of the infringement, to the fulfillment
of measures ordered against the person in charge or in charge, to the adherence to codes of
conduct and any other aggravating or mitigating circumstance. "

In the present case, when deciding the sanction to impose, they have taken into account
count the following items,


 That the person responsible is a natural person.

 That there is no recidivism or repetition due to the fact that the commission of

previous infractions.

● That it has shown collaboration in this organization within the present
sanctioning procedure


Therefore, it is considered that the sanction that would correspond to impose is
warning, in accordance with the provisions of article 58.2 b) of the RGPD, in
relation to what is stated in Considering 148, cited above.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/14








On the other hand, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD,
according to which each supervisory authority may 'order the person in charge or in charge
of the treatment that the treatment operations conform to the provisions of the

this Regulation, where appropriate, in a certain way and within a
specified term […] ”, the person in charge must adapt the operation of the system
video surveillance installed so that it is only operational when he or
a member of your family make use of the home they have in the property
where that is installed.


Regarding this issue, the defendant has stated in his brief presented on the day
February 15, having proceeded to disconnect the camera, so it is considered that
the adequacy measure has been adopted and must be maintained as long as he or someone
member of your family do not use the house.



Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of the sanctions whose existence has been accredited, the Director of the
Spanish Agency for Data Protection RESOLVES:



FIRST: IMPOSE C.C.C., with NIF *** NIF.1, for a violation of article 5.1.c),
typified in article 83.5 of the aforementioned rule, a sanction of
APPEARANCE.

SECOND: ORDER, under the provisions of article 58.2.d) of the RGPD,

that the video surveillance system is only operational when he or someone else
member of their family make use of the home they have in the property where
that one is installed.

THIRD: NOTIFY this resolution to C.C.C. and inform the claimant.



In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.



Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly

contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/14









interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through

writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in art. 16.4 of the

cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the

notification of this resolution would terminate the precautionary suspension.


                                                                                       938-131120
Mar Spain Martí

Director of the Spanish Agency for Data Protection














































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es