| AEPD - PS/00055/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | 15.09.2020 |
| Fine: | None |
| Parties: | Susana Palma Ortodoncia, S.L. |
| National Case Number/Name: | PS/00055/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | Miguel Garrido de Vega |
The Spanish Data Protection Agency (AEPD) decided to dismiss the procedure against Susana Palma Ortodoncia, S.L. (the controller). The case concerned the alleged non-adequate installation of a video surveillance system pointing to the public road, with the alleged consequent infringement of the data minimisation principle as per Article 5(1)(c) GDPR.
English Summary
Facts
The controller's video surveillance system is oriented toward the public space. The complainant questions its lawfulness.
Dispute
The complaint puts forward the idea that the personal data collected through the surveillance system is not adequate, relevant and limited to what is necessary in relation to the purposes for which they are collected and processed (Article 5(1)(c) GDPR).
In its defense, the controller makes the following points: (1) the surveillance system was meant to protect the company property after previous vandalism acts, (2) recordings are filtered in order to reduce their identification power, (3) data subjects are informed about ongoing surveillance through a warning. The controller also submitted a certificate by an external company ensuring that the surveillance system only points to the façade of the establishment.
Holding
The AEPD accepts the arguments put forward by the controller and concludes that the processing does not infringe the data minimisation principle. In so doing, the EAPD considered different factors including the the presumption of innocence principle that can only be overcome by persuasive evidence. In this case, there was no such an evidence that the video surveillance system had recorded the public road. Therefore the Authority closed the procedure without imposing any fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1
1/5 Procedure No.: PS / 00055/2020938-300320RESOLUTION OF SANCTIONING PROCEDUREOf the procedure instructed by the Spanish Agency for Data Protection andbased on the followingACTSFIRST: Mr. AAA (* hereinafter, the claimant) dated October 2, 2019filed a claim with the Spanish Agency for Data Protection. Theclaim is directed against SUSANA PALMA ORTODONCIA SL with NIFB13467626 (hereinafter, the claimed one).The reasons on which the claim is based are “installation of avideo surveillance cameras ”with presumed orientation towards public space.Along with the claim, it provides documentary evidence (Annex I) that proves thepresence of the devices on the facade of the establishment.SECOND: In view of the facts reported in the claim and the documentsprovided by the claimant, the General Subdirectorate for Inspection of Datayielded to carry out preliminary investigation actions to clarifyof the facts in question, by virtue of the powers of investigation granted to thecontrol authorities in article 57.1 of Regulation (EU) 2016/679 (RegulationGeneral Data Protection, hereinafter RGPD), and in accordance with the provisions ofcido in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5December, Protection of Personal Data and guarantee of digital rights (inhereinafter LOPDGDD).As a result of the investigation actions carried out, it is verifiedthat the person responsible for the treatment is the one claimed.THIRD: On 11/04/19 the claim is TRANSFERRED to the partydenounced, so that he could allege in law what he deemed appropriate, not receivingany answer in this Agency.FOURTH: On June 8, 2020, the Director of the Spanish Agency forData Protection agreed to initiate a sanctioning procedure to the claimed, by thealleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of theRGPD.FIFTH: On 07/10/20 this Agency receives a written allegations from thedenounced party, stating the following:-The installation of the cameras was entrusted to an external company as a resultof the vandalism suffered against the façade and door of the establishment.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/5-The installation company certifies the legality of the installation in terms ofdata protection by applying security masks to recordings so thatdata collected is "adequate, relevant and limited" (Certification is attachedas Doc. No. 1).-The facility has sufficient signage where the purposes are indicatedand the person responsible for the processing of personal data.Together with the allegations, it provides a Certificate issued by the installation companyRentavisión SL that certifies the legality of the system in the terms set forth (Doc.Evidence No. 1).In view of all the actions, by the Spanish Agency for Data ProtectionIn this proceeding, the following are considered proven facts,ACTSFirst. On 02/10/19, this Agency receives a complaint from the complainant formeans of which he conveys the following suspicions:"Installation of a video surveillance camera system" with allegedorientation towards public space ”(folio nº 1).Second. The Equipment is accredited as the main person responsible for the installationde Control Rentavisión S. L, who is responsible for the installation of avideo surveillance.Third. According to the defendant, the establishment has the postersenough to inform that it is a video-monitored area.Fourth. The installed cameras have a privacy mask, collecting theexterior cameras exclusive images of the façade of the establishment thatregenta (Evidentiary Document No. 1).Fifth. All the recordings made by the cameras are deletedautomatically within 20 days.FOUNDATIONS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authoritycontrol, and according to what is established in articles 47 and 48 of the LOPDGDD, therector of the Spanish Data Protection Agency is competent to initiate andto solve this procedure.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/5IIIn the present case, the claim dated 10/02/19 is examined by me-of which the complainant transfers the following as the main event:"Installation of a video surveillance camera system" with allegedorientation towards public space.According to the complainant's criteria, they could be misdirected, to theconsider that they can obtain disproportionate images of public space withoutjust cause.The art. 5.1 c) RGPD provides the following: Personal data will be:"Adequate, relevant and limited to what is necessary in relation to the purposesfor those who are processed ("data minimization").It should be remembered that individuals are responsible for ensuring that systemsmost installed comply with current legislation, proving that it complies withall the requirements demanded by the regulations in force.The installation of this type of device must have the mandatory posterinformative, indicating the purposes and responsible for the treatment, where appropriate, of the dataof a personal nature.In any case, the cameras should preferably be oriented towards theprivate space, avoiding intimidating neighboring neighbors with this type of device,as well as control areas of transit of the same without just cause.Neither with this type of device can image (s) be obtained frompublic service, as this exclusive competence of the Security Forces and Bodiesof the State.It should be remembered that even in the case of a "simulated" camera theIt should preferably be oriented towards private space, since it isconsiders that this type of device can affect the privacy of third parties, whichare intimidated by it into believing that they are the object of permanent recording.tea.IIIAccording to the available evidence, it was considered that theclaimed had a video surveillance system that could be misdirectedtowards public space.The known facts could be constitutive of an infraction, attributable to theclaimed , for violation of article 5.1 c) RGPD.The art. 83.5 RGPD provides the following: “Violations of the following provisionsThese will be sanctioned, in accordance with section 2, with administrative fines of 20C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/5EUR 000 000 maximum or, in the case of a company, an equivalent amountat a maximum of 4% of the total global annual turnover for the financial yearabove, opting for the one with the highest amount:a) the basic principles for the treatment, including the conditions for theconsent in accordance with articles 5, 6, 7 and 9;For the denounced party, in writing dated 07/10/20 it is stated thatof a video surveillance system for security reasons of the establishment, whenhave been the same object of vandalism attacks, having the cameras of the mosttimely privacy faces.The establishment has an informative poster (s) indicating the person in chargeof the treatment, to which you can contact in case of exercise of rights (articles 15-22RGPD).It should be remembered that “the data that are subject to treatment through thesurveillance will be treated for the purpose that motivated the installation of the samewhich is linked to guaranteeing the safety of people, goods and facilitiesnes ".In such a way, the cameras obtain images of an area proportional to thefacade of the establishment that runs in what is essential for the safety of thesame.IVThe presumption of innocence must govern without exceptions in the legal systemsanctioner and must be respected in the imposition of any sanctions, sincethe exercise of ius puniendi in its various manifestations is conditioned bygame of evidence and a contradictory procedure in which they can defend themselvesown positions. In this sense, the Constitutional Court in its Judgment76/1990, of 04/26, considers that the right to the presumption of innocence involves:"That the sanction is based on acts or probative means of charge or incriminatingof the reproached conduct; that the burden of proof rests with the accuser, withoutthat no one is obliged to prove their own innocence; and that any insufficiency inthe result of the tests carried out, freely assessed by the bodysanctioning, must be translated into an acquittal.The presumption of innocence governs without exceptions in the Ordinancesanctioner and must be respected in the imposition of any sanction, whether criminalor administrative (TCo 13/1981), since the exercise of the sanctioning right inany of its manifestations, is conditioned to the game of the test and acontradictory procedure in which their own positions can be defended.In accordance with this principle, no sanction can be imposed by reason of theguilt of the accused if there is no probationary activity of the charge, which in theassessment of the authorities or bodies called to resolve, destroy thispresumption (TCo Auto 3-12-81).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/5The mere appreciation of the cameras does not imply that they obtain imagesof public space, as they are equipped with privacy masks that allow limiting therecording area to what is necessary to fulfill its purpose of protecting theestablishment.VBased on the foregoing, it can be concluded that the reported system does not violate theregulations in force on data protection, which is why it is appropriate to ordernar the FILE of this procedure.Therefore, in accordance with the applicable legislation and the criteria ofgraduation of sanctions whose existence has been proven,the Director of the Spanish Agency for Data Protection RESOLVES:FIRST: ORDER the FILE of this procedure, as there will be nothe commission of any administrative offense has been accredited.SECOND: NOTIFY this resolution to SUSANA PALMA ORTODONCIASL and INFORM the complainant Mr. AAA.In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once it has been notified to the interested parties.Against this resolution, which puts an end to the administrative procedure in accordance with art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of theLPACAP, the interested parties may optionally file an appeal for reversalbefore the Director of the Spanish Agency for Data Protection within a period ofmonth from the day after notification of this resolution or directlycontentious-administrative appeal before the Contentious-Administrative Chamber of theNational High Court, in accordance with the provisions of article 25 and section 5 ofthe fourth additional provision of Law 29/1998, of July 13, regulating theContentious-administrative jurisdiction, within a period of two months from theday following notification of this act, as provided in article 46.1 of thereferred Law.
Mar España Martí
Director of the Spanish Agency for Data Protection
