AEPD - PS/00253/2020
|AEPD - PS/00253/2020|
|Relevant Law:||Article 5(1)(c) GDPR|
|National Case Number/Name:||PS/00253/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) imposed a fine of €5,000 on the owner of a property that he rented out. The defendant had placed a video camera inside the rented property which went beyond filming the entrance as he claimed. This breached Article 5(1)(c) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
The Complainant filed a complaint before the Spanish DPA (AEPD) against an unnamed data controller (the defendant). The Complainant rented two rooms from the defendant, the property owner. The Complainant claims to have been told by the defendant that the surveillance camera inside only focused on the front door of their property for security.
However, the Complainant later discovered that the camera did not focus only on the door as the defendant showed the Complainant a recording (with sound) of the Complainant breaking the television whilst vacuuming.
The Complainant highlighted to the AEPD that they felt spied on, especially as they had private telephone conversations in parts of the room where the camera also focused on (rather than just the door as claimed by the defendant).
The defendant, the owner of the property, claimed that the video camera was inside their private house and focused on the interior to scare potential thieves. They asserted that they were the only person with access to the data stored on the camera's memory card.
The AEPD found whilst investigating that there was no informational poster on the door of access to the property regarding the video-surveillance camera.
Dispute[edit | edit source]
Is the presence of a video surveillance camera placed by the owner of a rented property in violation of Article 5(1)(c)?
Holding[edit | edit source]
The Spanish DPA (AEPD) held that the facts highlighted that there was a video surveillance camera installed in a rental property processing personal data without a reason or clear purpose.
The DPA referred to Article 5(1)(c) GDPR on data minimisation. It also highlighted that it is for the individual in charge of camera to comply with the requirement of the law.
The DPA held that when it comes to a property that is rented out (the object of a contract), the notion of personal of "purely personal or household activities" disappears. The owner of the property (that is rented to a third party), who is in charge of the video camera, must comply with the GDPR. The DPA went on to highlight a Constitutional Court decision (nº 22/1984 (Rec.59/1983)) on the concept of a private home, which stated that this is a place where an individual can exercise their freedom more intimately, outside of social conventions.
Therefore, the Spanish DPA concluded that the defendant processed personal data without just cause by filming the complainant inside their rented house. This was particularly because the video camera did not just record the entrance to scare burglars, but instead also filmed some other parts of the property. Therefore, the defendant breach Article 5(1)(c) GDPR.
The Spanish DPA imposed a fine of €5,000 on the defendant.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7 Procedure Nº: PS / 00253/2020 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following ACTS FIRST: Mrs. A.A.A. (hereinafter, the claimant) dated January 30, 2020 filed a claim with the Spanish Data Protection Agency. The claim is directed against B.B.B. with NIF *** NIF.1 (hereinafter, the claimed one). The reasons on which the claim is based are the following: "He has a surveillance camera that supposedly told me he was only focusing to the front door for security and the sound was turned off. For a mishap vacuuming I broke the television, he sent me the video which does not focus the entrance door as assured and above it has sound, I felt spied on since focuses on part of the room where I have had private conversations on the phone and he has been able to see everything he did. Not only is it here, an expert had to come to see the damage and was listening to the conversation and watching us ”(folio nº 1). Along with the claim, you provide a CD to support your claim about the facts described (Evidentiary Document No. 1) that corroborate the presence of the device in the table in the hall of the premises rented as a home. SECOND: On 06/18/20 the defendant requests from this Agency a copy of the administrative file for the appropriate legal purposes. THIRD: On 03/24/20, the claim is TRANSFERRED to the denounced to express what it deems appropriate in relation to the facts exposed. "I do not understand why the Complaint has been received at my ex-partner's house, NO I understand the reason for the Complaint, because the camera is inside my house, it is not a local as indicated in the writing but my private home. The camera is tabletop purchased on Amazon, located in the hall furniture and focused on the interior (…) to scare away potential thieves. The data is stored in a memory card installed in the same camera and the only person who has access it's me". BEDROOM. On September 1, 2020, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure against the complained party, with according to the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Pro- Common Administrative Assignment of Public Administrations (hereinafter, LPA- CAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the GDPR. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/7 FIFTH. On 10/07/20, a copy of the Declaration Act made before the State security forces and bodies by the defendant himself dated 01/17/20, where he acknowledges being responsible for the installation of a camera in the interior of the room rented to the complainant. SIXTH: A list of documents in the document is attached as an annex. procedure, being at your disposal the content of the administrative file. SEVENTH. On the date a proposal for a Resolution is issued by means of which the accredits the infringement of the content of art. 5.1 c) RGPD, proposing a sanction in the amount of € 5,000 (Five Thousand Euros). EIGHTH. Consulted the database of this organization on 11/30/20, it has not been received any allegation in relation to it, nor has the payment of any amount for the appropriate legal purposes. Of the actions carried out in this procedure and of the documentation Obrante in the file, the following have been accredited: PROVEN FACTS First. On 01/30/20, this AEPD receives a claim from the complainant for means of which translates the following: "He has a surveillance camera that supposedly told me he was only focusing to the front door for security and the sound was turned off. For a mishap vacuuming I broke the television, he sent me the video which does not focus the entrance door as assured and above it has sound, I felt spied on since focuses on part of the room where I have had private conversations on the phone and he has been able to see everything he did. Not only is it here, an expert had to come to see the damage and was listening to the conversation and watching us ”(folio nº 1). Second. It is identified as the main responsible B.B.B., which is the owner of the property where the camera was installed, not denying that it was the responsible for its presence. Third. In the statement provided before the Security Forces and Bodies (Direc- General Assembly of the Police 01/17/20) states that “he has rented two rooms to a girl named A.A.A. " “That from the beginning A.A.A. knew of the existence of the camera at the entrance of the house and that works as a deterrent for thieves ”. Bedroom. There is no contract with a specific clause on data protection, informing of the purpose of the treatment of the same. Fifth. There is no record that the defendant had an informational poster on the door of access to the rented premises as a home, informing that it was an area video-surveillance. Sixth. It is known that the images obtained from the webcam were used when affirm in a statement dated 01/17/20 before the General Police Directorate C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/7 "That by showing the images to A.A.A., it denies what happened." FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority control, and according to what is established in articles 47 and 48 of the LOPDGDD, the rector of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II In the present case, the claim dated 01/30/20 is examined by me- of which the claimant transfers the following as the main event: "Installation of camera in the house that has rented, obtained images inside the same without just cause ”(folio nº 1). The facts are specified in the installation by the defendant of a device recording (web-cam) you have used to obtain images / sound from the rental of the same, without justified cause, proceeding to treat the data of this without there is any apparent reason. The art. 5.1 c) RGPD provides the following: Personal data will be: “Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"). It should be remembered that individuals are responsible for ensuring that systems most installed comply with current legislation, proving that it complies with all the requirements demanded by the regulations in force. The installation of this type of device must have the mandatory poster informative, indicating the purposes and responsible for the treatment, where appropriate, of the data of a personal nature. In the present case, we have a lease contract whose leased object is to satisfy the primary and permanent housing need of the tenant. A video camera is installed in the property that is the object of the contract. surveillance (web-cam), specifically in the room under its use and enjoyment, in a that it allows the landlord to obtain images of the interior of the room (lo- lime as a home) and proceed to listen to what happens in it. From the moment the use (enjoyment) of the property was transferred to a third (tenant), the notion of “personal and domestic sphere” disappears, is- allowing the capture of images from third parties subject to the data protection regulations cough, being mandatory to comply with a series of guarantees that are included in the regulations in force, especially if the owner was the main responsible for the images. tions obtained when entering / exiting the dwelling in question. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/7 The description that the Constitutional Court makes regarding the concept of micilio, taking as such "the space where the individual lives exercising their freedom more intimate, outside of social conventions ”. The inviolability of the home protects not only the physical space itself considered but what is in it of emanation from the person and his private sphere, having defined by the Constitutional Court, in its judgment nº 22/1984 (Rec. 59/1983), of 17 February, the inviolable home as: “a space in which the individual lives without be necessarily subject to social customs and conventions and exercise their freedom more intimate ”. III In accordance with the evidence available in these proceedings, sanctioning, it is considered that the claimed had a web-cam, proce- giving the claimant's data to be processed through the device installed inside of the (local) home that he proceeded to lease, treating them without just cause. gives. Specifically, the images obtained are used by it to reproduce tell the tenant the breaking of the television screen that was in the interior of the house. Manifests before the State Security Forces and Bodies (Declaration date (01/17/20) “That when you see the images you see how Mrs. A.A.A., while using the vaccum cleaner. He has thrown the screen and has broken the television, the screen and a design table what's behind". So it is proven that the orientation of the camera was not ex- clusive as he asserts “only towards the entrance of the door”, since television is ba inside the cabin, and only by viewing the images was able to know with such precision of detail that the breakage of the television occurred "while passing the vacuum cleaner and that affected a design table behind it ”. The proven known facts are constitutive of an administrative infraction. trative, attributable to the complained party, for violation of the content of article 5.1 c) RGPD. IV Regarding the alleged non-existence of culpability in the commission of the offending conduct, Torah. In this sense, there is no doubt that guilt constitutes an essential note in sanctioning matter and that so-called strict liability has no place in De- administrative sanctioning right. Indeed, article 28 of Law 40/2015 (October 1) provides that “They may only be sanctioned for acts constituting an administrative offense, individuals who legal, as well as, when a Law recognizes their capacity to act, the groups types of affected, unions and entities without legal personality and patrimonies independent or autonomous, who are responsible for them as fraud or guilt ”. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/7 This simple non-observance cannot be understood as admission to the Law administrative sanctioning of strict liability, since the doctrine of the Court Constitutional (Sentences 15/1999, of July 4, and 76/1990, of April 26) and the majority prudence of our Supreme Court (for all Judgment of 23 of January 1998), as well as the requirements inherent to a rule of law, require that the principle of guilt requires the existence of fraud or fault. The Supreme Court (Judgments of April 16 and 22, 1991) considers that the ele- of guilt it follows “that the action or omission, classified as an infringement, administratively punishable action, must be, in any case, attributable to its author, due to fraud or recklessness, negligence or inexcusable ignorance. " The National High Court, in Judgment of June 29, 2001, on protection of personal data, has stated that “simple negligence or incum- compliance with the duties that the Law imposes on the persons responsible for files or of the data processing of extreme diligence ... ”. The Supreme Court (Judgments of July 5, 1998 and March 2, 1999) comes understanding that there is recklessness whenever a legal duty of care is disregarded. given, that is, when the offending subject does not behave with the required diligence. Dili- The degree of exigency of which will be determined according to the circumstances currents in each case, such as the special value of the protected legal asset or the professionalism required of the offender. In this sense, the aforementioned Judgment of June 5 1998 demands from professionals in the sector “a duty to know especially the applicable standards ”. In the present case, the defendant is responsible for the installation of a web- cam, having obtained personal data from the denounced, for a purpose not to per- mitigated by the legal system, such as the use of them to reproach him for the "Break" of a television of his property, for which the intentionality is accredited of the accused by way of gross negligence at least. V Article 83.5 RGPD provides the following: "Violations of the following provisions will be sanctioned, in accordance with with paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or, for a company, an amount equivalent to a maximum of 4% of the volume total annual global business menu for the previous financial year, opting for the higher amount: a) the basic principles for the treatment, including the conditions for the treatment consent in accordance with articles 5, 6, 7 and 9; When motivating the sanction, the following is taken into account: -the seriousness of the offense when obtaining data (s) from a space reserved for the privacy, as was the space leased to the claimant, being able to listen to the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/7 Versions of the same and treating the data of this without just cause (art. 83.2 a) GDPR). -the intentionality or negligence of the infringement, by not informing in the contract of leasing of the purpose of processing the data obtained with the device vo denounced and exceeding the recording area (article 83.2 b) RGPD). In the present case, the seriousness of the events described is taken into account, which represent an attack on the inviolability of the home, in this case the object of giving to the complainant, proceeding to process data of the same in their tasks newspapers without just cause, all of which justify imposing a civil sanction. frada in the amount of € 5,000 (Five Thousand Euros). Therefore, in accordance with the applicable legislation and assessed the criteria of graduation of sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE Don B.B.B., with NIF *** NIF.1, for a violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 5,000 (Five A thousand euros). SECOND: NOTIFY this resolution to Mr. B.B.B. and INFORM the result of the proceedings against the complainant Doña A.A.A .. THIRD: Warn the sanctioned person that the sanction imposed by a Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case Otherwise, it will be collected in the executive period. Received the notification and once executive, if the date of execution is found Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment volunteer will be until the 20th of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediate business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/7 counting from the day after the notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the final resolution through administrative channels if the interested party expresses his intention to file contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through writing addressed to the Spanish Agency for Data Protection, presenting it through of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web /], or through any of the other records provided for in art. 16.4 of the cited Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the effective filing of the contentious appeal- administrative. If the Agency was not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would terminate the precautionary suspension. 938-131120 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es