AEPD - PS/00191/2020
|AEPD - PS/00191/2020|
|Relevant Law:||Article 5(1)(c) GDPR|
|National Case Number/Name:||PS/00191/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Paola L.|
The Spanish DPA (AEPD) imposed a fine of €2,000 against Ripobruna 207, S.L. (defendant) for the alleged violation of Article 5(1)(c) GDPR for the unauthorised use of two video surveillance cameras that also recorded parts of the public road without any justified cause. The original fine of €2,000 was reduced for voluntary payment to €1,600.
English Summary[edit | edit source]
Facts[edit | edit source]
A City Council office filed a complaint with the AEPD against Ripobruna 2007, S.L. for the use of cameras video surveillance oriented towards the public road without a justified cause. The AEPD requested the Local Police to verify that the establishment denounced was in operation and confirm the presence of the cameras in question.
The Local Police verified the operation of the establishment and confirmed that two cameras video surveillance were facing the public road without any justified cause.
Dispute[edit | edit source]
Is it an offence to have cameras facing the public road? Does it constitute a breach of Article 5(1)(c) GDPR?
Holding[edit | edit source]
The AEPD held, that the actions of the defendant constitute an infringement of Article 5(1)(c) GDPR " Data Minimisation principle". The AEPD further noted that:
- Those responsible must ensure that the installed systems comply with current legislation, proving that it complies with all the requirements of the regulations in force.
- The installation of this type of device must have the mandatory information notice, indicating the purposes and the responsible for the processing, where appropriate, of the personal data.
- With reference to its Resolution R/00818/2012, the capture of images of public spaces by private surveillance cameras must be limited to what is strictly necessary, applying in any case the principle of proportionality.
- Security cameras installed in private spaces will not be able to capture images of public spaces, the security function of public spaces corresponds exclusively to the State Security Forces and Bodies.
The AEPD imposed an initial fine of €2,000 which was reduced for voluntary payment to €1,600 in accordance with Article 85 (2) LPACAP).
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7 Procedure Nº: PS / 00191/2020 RESOLUTION R / 00056/2021 OF TERMINATION OF THE PROCEDURE FOR PAYMENT VOLUNTARY In the sanctioning procedure PS / 00191/2020, instructed by the Spanish Agency for Data Protection to RIPOBRUNA 2007, S.L., Considering the claim presented by *** LOCALITY CITY COUNCIL. 1, and based on the following, BACKGROUND FIRST: On September 2, 2020, the Director of the Spanish Agency of Data Protection agreed to initiate a sanctioning procedure against RIPOBRUNA 2007, S.L .. The initiation agreement has been notified and after analyzing the allegations presented, On January 11, 2021, the resolution proposal was issued that The following is transcribed: << Procedure number: PS / 00191/2020 Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following: ACTS FIRST: CITY COUNCIL OF *** LOCALITY. 1 (* hereinafter, the claimant) with On June 11, 2020, he filed a claim with the Spanish Agency for Data Protection. The claim is directed against RIPOBRUNA 2007, S.L. (RESTAURANT *** RESTAURANT.1) with NIF B64595242 (hereinafter, the reclaimed). The reasons on which the claim is based are installation of cameras video surveillance towards public space without just cause “It has been verified by the agents that the surveillance cameras are oriented towards the public thoroughfare, a fact that has also been verified in previous occasions and dates after the AEPD Resolution reference E / 00984/2018 (* is attached) ”- folio nº 1--. Along with the claim, it provides a photographic report made at the time of inspection and before the person in charge, stating in the same the orientation of two cameras towards public space (photos 1, 4 and 5). SECOND: On 06/25/20, the claim is TRANSFERRED to the entity denounce so that it manifests in law what it deems appropriate, without any allegation has been made for this purpose. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/7 THIRD: On September 2, 2020, the Director of the Spanish Agency of Data Protection agreed to initiate a sanctioning procedure to the claimed, with in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in the Article 83.5 of the RGPD. FOURTH: The aforementioned initiation agreement has been notified, the claimed party has not made any allegation in time and form to this body. FIFTH: Consulted the database of this AEPD on 01/10/21 there is no record any allegation in this regard, nor has the legality of the system been clarified. SIXTH: On the date, collaboration is requested from the Local Police (*** LOCALIDAD.1) to to verify that the reported establishment is in operation and confirm the presence of the cameras in question. SEVENTH: On 12/29 / w20 a report from the Local Police is received (*** LOCALIDAD.1) reporting the following: "That transferred to the scene, today 12/29/20, the Agents of this Local Police (*** LOCALIDAD.1) have verified that the activity of Maverick restoration continues in operation, open to the public and carried out functions of its hospitality activity " “That it has also been verified that the cameras installed object of this procedure, they are in the same position, focusing on the public highway without just cause ”. EIGHTH: A list of documents in the document is attached as an annex. process. Of the actions carried out in this procedure and of the documentation Obrante in the file, the following have been accredited: PROVEN FACTS First. A claim is received at this Agency on 06/11/20 by means of from which the presence of video surveillance cameras oriented towards this public space without just cause. Along with the claim, it provides a photographic report made at the time of inspection and before the person in charge, stating in the same the orientation of two cameras towards public space (photos 1, 4 and 5). Second. The entity Restauran- te *** RESTAURANTE. 1 (Ripobruna 2007 S.L). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/7 Third. It has been proven that, once the act of force was transferred to the scene of the events, While the aforementioned establishment is “operational”, the cameras remain in the position sition reported (Report 12/29/20) -Local Police *** LOCALITY. 1. Bedroom. According to attached report dated 12/29/20 of the Local Police *** LOCALI- DAD.1 the following is verified: “That it has also been verified that the cameras installed object of this procedure, they are in the same position, focusing on the public highway without just cause ”. Fifth. Consulted the database of this Agency 01/10/21 has not been carried out- any allegation in relation to the facts described. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority control, and according to what is established in articles 47 and 48 of the LOPDGDD, the rector of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II In the present case, the claim dated 06/11/20 is analyzed through from which the installation of a video surveillance system that obtains images genes from public space without just cause. The art. 5.1 c) RGPD provides the following: Personal data will be: “Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"). It should be remembered that individuals are responsible for ensuring that the systems installed felled comply with current legislation, proving that it complies with all the requirements demanded by the regulations in force. The installation of this type of device must have the mandatory information poster tive, indicating the purposes and responsible for the treatment, where appropriate, of the ca- personal character. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/7 In any case, the cameras should be oriented preferably towards the space particular, avoiding intimidating neighboring neighbors with this type of device, thus how to control areas of transit of the same without just cause. Also with this type of device it is not possible to obtain images of public space. co, as this exclusive competence of the Security Forces and Corps of the State tado. It should be remembered that even in the case of a "simulated" camera the same should preferably be oriented towards private space, since it is considered that this type of device can affect the privacy of third parties, who are seen to be measured by it in the belief of being the object of permanent recording. On the part of private individuals, it is not possible to install devices for obtaining images of public space, outside the cases allowed in the regulations. III In accordance with the evidence available at present, ment of the sanctioning procedure, it is considered that the defendant has a video surveillance system oriented towards public space without just cause, affecting Going to the right of third parties to process your data without your informed consent. Article 77 section 5 of Law 39/2015 (October 1) provides the following: “The documents formalized by the officials who are recognized as condition of authority and in which, observing the corresponding legal requirements teeth are collected the facts verified by the former, they will prove these except that the opposite is accredited ”. Security cameras installed in private spaces will not be able to obtain images of public spaces, the security function of public spaces it corresponds exclusively to the State Security Forces and Bodies. For its part, the Spanish Agency for Data Protection in its Resolution R / 00818/2012 of May 18 indicates: “The treatment of images in public places can only be carried out, sal- vo that government authorization concurs, by the Security Forces and Bodies ". Therefore, the capture of images of public spaces by the cameras of private surveillance, must be limited to what is strictly necessary, applying in any case the principle of proportionality. The known facts are constitutive of an infraction, attributable to the claim. mado, for violation of the content of art. 5.1 c) GDPR, previously transcribed. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/7 The installation of two video surveillance cameras oriented towards public space, without any explanation of them having been made, is- having proven its clear orientation towards third party space, producing a deviation from the purpose of controlling them. Article 83.5 RGPD provides the following: "Violations of the following provisions will be sanctioned, in accordance with with paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or, for a company, an amount equivalent to a maximum of 4% of the volume total annual global business menu for the previous financial year, opting for the higher amount: a) the basic principles for the treatment, including the conditions for the treatment consent in accordance with articles 5, 6, 7 and 9; When motivating the sanction, the following is taken into account: -the nature of the offense by having a video surveillance system that it is oriented towards public space without just cause 8art. 83.5 a) GDPR). -the way in which this body has had knowledge of the facts, being transferred by the State Security Forces and Bodies (eg Local Police), having been repeatedly warned by the acting force about the illegality of the conduct (art. 83. 5 h) RGPD). Therefore, it is considered correct to propose a sanction in the amount of € 2,000 (Two Thousand euros), a penalty located on the lower scale for this type of conduct. tas, all without prejudice to proceeding with the regularization of the denounced system. In view of the above, the following is issued MOTION FOR A RESOLUTION That the Director of the Spanish Data Protection Agency sanction RI- POBRUNA 2007, S.L., With NIF B64595242, for a violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 2,000 (Two Thousand Euros). Likewise, in accordance with the provisions of article 85.2 of the LPACAP, informs that it may, at any time prior to the resolution of this transfer, carry out the voluntary payment of the proposed sanction, which will mean a reduction of 20% of the amount thereof. With the application of this reduction tion, the sanction would be set at € 1,600 and its payment will imply the termination of the process. The effectiveness of this reduction will be conditioned to the withdrawal or waiver of any action or appeal in administrative proceedings against the sanction. In the event that you choose to proceed to the voluntary payment of the amount specified above, Subsequently, in accordance with the provisions of the aforementioned article 85.2, it must be carried out tiva by entering the restricted account number ES00 0000 0000 0000 0000 0000 C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/7 opened in the name of the Spanish Agency for Data Protection in the banking entity- ria CAIXABANK, S.A., indicating in the concept the reference number of the procedure statement that appears in the heading of this document and the cause, by voluntary payment luntario, of reduction of the amount of the sanction. Likewise, you must send the receipt of entry to the Subdirectorate General of Inspection to proceed to close the expe- tooth. By virtue of this, you are notified of the foregoing, and the procedure is revealed so that within TEN DAYS you can claim whatever you consider in your defense and present the documents and information it deems pertinent, in accordance with Article 89.2 of the LPACAP). 926-300320 A.A.A. INSPECTOR / INSTRUCTOR >> SECOND: On February 5, 2021, RIPOBRUNA 2007, S.L. has proceeded to payment of the penalty in the amount of 1,600 euros making use of the planned reduction in the proposed resolution transcribed above. THIRD: The payment made entails the waiver of any action or recourse in progress. administrative against the sanction, in relation to the facts to which the motion for a resolution. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 of December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation; infractions of article 48 of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT), in accordance with the provisions of the article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the information and electronic commerce (hereinafter LSSI), as provided in article 43.1 of said Law. II Article 85 of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), under the rubric "Termination of sanctioning procedures" provides the following: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/7 "1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is solely of a pecuniary nature or it fits impose a pecuniary and a non-pecuniary sanction but it has been justified the inadmissibility of the second, the voluntary payment for the alleged responsible, at any time prior to the resolution, will imply the termination of the procedure, except in relation to the reinstatement of the situation altered or to the determination of compensation for damages caused by the commission of the offense. 3. In both cases, when the sanction is solely of a pecuniary nature, the competent body to resolve the procedure will apply reductions of, at less, 20% of the amount of the proposed penalty, these being cumulative with each other. The aforementioned reductions must be determined in the notification of initiation of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of any action or remedy in administrative against the sanction. The percentage of reduction foreseen in this section may be increased regulations. " In accordance with the above, the Director of the Spanish Agency for the Protection of Data RESOLVES: FIRST: DECLARE the termination of procedure PS / 00191/2020, of in accordance with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to RIPOBRUNA 2007, S.L .. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, interested parties may file an appeal administrative litigation before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 968-150719 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es