AEPD - PS/00272/2019
|AEPD - PS/00272/2019|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 12 GDPR
Article 13 GDPR
Article 83(5) GDPR
|Parties:||COMUNIDAD DE PROPIETARIOSR.R.R|
|National Case Number/Name:||PS/00272/2019|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES) (in ES)|
The Spanish Data protection authority (the AEPD) imposed a 2,000 € fine for unlawful recording of personnal data throug surveillance cameras on a building facade.
English Summary[edit | edit source]
Facts[edit | edit source]
The claimant filed a complaint with the AEPD against the defendant for installing surveillance cameras on the building facade which are directed at common and transit areas, without any authorization from the owners’ cooperative. Moreover, the information poster installed next the surveillance cameras does not procedure for sufficient information regarding the controller of the processing. It is acknowledged that the surveillance cameras processe personal data as there are recording clear images of natural persons.
Dispute[edit | edit source]
The AEPD had to examine whether the recording of personal data carried through the video surveillance system is in accordance with the GDPR. Especially, if the installation of surveillance camera is contrary to the data minimisation principle, under Article 5(1)(c) GDPR.
Holding[edit | edit source]
First, the AEPD reminded that surveillance cameras installed by individuals cannot record images/sound from third party conversations, or affecting their privacy, unless there are less invasive measures necessary to protect the property. Also, it specified that the installation of a video surveillance system which may record partially the public area security could be lawful only it is indispensable for the achievement of security purposes or if it is impossible to avoid it due to the location of the cameras to the extent that the minimum space for that purpose is collected. Finally, the AEPD also mentioned that, pursuant to Articles 12 and 13 GDPR, the information related to the processing has to be sufficiently visible, and must include he controller’s identity, the purposes of the processing and the possibility of exercising the rights provided under the GDPR.
Then, in the situation based on the claim, the APED hold that the controller should have informed the President of the owners’ cooperative and that the recording must not affect common areas. Also, it must have an approved sign, indicating the controller's identity and an effective address to which it can be directed.
Therefore, by having installed some surveillance cameras without any appropriate safeguard, the controller infringed Article 5(1)(c) GDPR. In addition, the controller infringed Article 12 because he prevented the data subject to effectively exercised theirs rights under Articles 15 to 22 GDPR.
As a consequence, the APED imposed a 12,000 € fine to the controller
Comment[edit | edit source]
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1 1/7 Procedure No.: PS / 00272/2019 938-051119 RESOLUTION OF PENALTY PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on the following ACTS FIRST: On April 9, 2019, he had entry into this Spanish Agency of Data Protection a letter submitted by COMMUNITY OF OWNERS RRR (hereinafter the claimant), by means of which he claims against AAA with NIF *** NIF.1 (hereinafter, the claimed), for the installation of a system video surveillance installed at *** ADDRESS.1, there are indications of a possible breach of the provisions of art. 5.1 c) RGPD. The reasons underlying the claim and, where appropriate, the documents contributed by the claimant are the following: “Place cameras on the façade facing common areas, stairs and corridors, recording all the comuneros who pass by ”(folio nº 1). SECOND: Prior to the admission for processing of this claim, transferred the claimed, in accordance with the provisions of article 65.4 the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). The result of this action is described below. "It does not make any reply to the request of this body" THIRD: The claim was admitted for processing through a resolution of July 10 of 2019. FOURTH: On October 25, 2019, the Director of the Spanish Agency for Data Protection agreed to initiate sanctioning procedure to the claimed, by the alleged violation of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD. FIFTH: Consulted the database of this Agency on 02/13/20 it has not been received any allegation in this regard in relation to the system under complaint. In view of everything that has been done by the Spanish Protection Agency Data in the present procedure, the following are considered proven facts, ACTS C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 2 2/7 First. On 04/09/19, a complaint was received at this Agency from the denounced- cient through which the following is transferred as the main fact: “Place cameras on the façade facing common areas, stairs and corridors, recording all the comuneros who pass by ”(folio nº 1). The complaining party certifies the installation of the device on the facade of the real estate, without the authorization of the set of owners. (Evidentiary Doc No. 1). Second . Don AAA is identified as the main person in charge . Third. It is proven that it has proceeded to install a video surveillance on the facade of the property, oriented towards transit areas, without any authorization from the Board of owners. With the installed device, images are obtained according to the orientation of the same of the corridor area through which you access your home. Fourth . The person responsible is not informed in the informative poster (Probatory Doc. No. 2) of the treatment, nor any effective address is provided to which, where appropriate, to go. FUNDAMENTALS OF LAW I By virtue of the powers that article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), recognizes each Control Authority, and as established in articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Agency for Data Protection is competent you to start and solve this procedure. II In the present case, the complaint dated 09/04/19 is examined by gave of which the following is transferred as the main fact: “Place cameras on the façade facing common areas, stairs and corridors, recording all the comuneros who pass by ” (folio nº 1). The physical image of a person, according to article 4.1 of the RGPD, is a piece of information personal and their protection, therefore, is object of said Regulation. In Article 4.2 The RGPD defines the concept of "treatment" of personal data. It is, therefore, pertinent to analyze whether the processing of personal data (image of natural persons) carried out through the video surveillance system reported This is in accordance with the provisions of the RGPD. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 3 3/7 The cameras installed by individuals cannot be oriented towards the area exclusive to third parties, obtaining images / sound from third party conversations, by affect your privacy, apart from the fact that there are less invasive protection measures of the property, if necessary. The facts described suppose an affectation to article 5.1 c) RGPD “The data- Personal coughs will be: c) adequate, pertinent and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"). The individuals who install this type of device are responsible for it complies with current legislation, and must comply with the established requirements- also cited in the Horizontal Property Law (LPH). III In accordance with the aforementioned, the treatment of images through a system subject of video surveillance, to be in accordance with current regulations, you must comply with the following requirements: - Respect the principle of proportionality. - When the system is connected to a central alarm, you can only be installed by a private security company that meets the required requirements set forth in article 5 of Law 5/2014 on Private Security, of April 4. - Camcorders will not be able to capture images of people who are are outside the private space where the video surveillance system is installed- cia, since image processing in public places can only be performed, unless there is governmental authorization, by the Security Forces and Bodies. Neither can spaces owned by third parties be captured or recorded without the consent ment of their owners, or, where appropriate, of the people who are in them. This rule admits some exceptions since, on some occasions, for the tection of private spaces, where cameras have been installed on facades or in the indoor, it may be necessary to ensure the security purpose of recording a portion of the public highway. In other words, the cameras and video cameras installed with Security authorities will not be able to obtain images of public roads unless it is impossible dispensable for this purpose, or it is impossible to avoid it due to the location of those and, extraordinarily, the minimum space for said fin- quality. Therefore, cameras could exceptionally capture the smallest portion- mind necessary for the intended security purpose. - The duty to inform the affected parties as provided in the articles must be fulfilled. 12 and 13 of the RGPD, resulting from application -in not contradicting the provisions of the said Regulation-, the way provided for in article 3 of Instruction 1/2006, of 8 November, from the Spanish Agency for Data Protection, on the Treatment of Personal Data for Surveillance Purposes through Camera or Video Systems of cameras. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 4 4/7 Specifically, at least a different distinction must be placed in the video-monitored areas. informative sign located in a sufficiently visible place, both in open spaces as closed, which will identify, at least, the existence of a treatment, the identity of the person responsible and the possibility of exercising the rights provided for in said precepts. Likewise, the information must be kept available to those affected to which the aforementioned GDPR refers. - The person responsible must keep a record of treatment activities carried out under his responsibility in which the information he makes is included Reference article 30.1 of the RGPD. - The installed cameras cannot obtain images of private space of third and / or public space without duly accredited justified cause, nor can affect the privacy of passers-by who freely pass through the area. It is not per- therefore, the placement of cameras towards the private property of neighbors with the purpose of intimidating them or affecting their private environment without just cause. - In no case will the use of surveillance practices be accepted beyond the lathe object of the installation and in particular, not being able to affect public spaces Surrounding buildings, adjoining buildings, and vehicles other than those that access the space monitored. In relation to the aforementioned, to facilitate the consultation of those interested, the Agency Spanish company for Data Protection offers through its website [https://www.aepd.es] access to the legislation on personal data protection- , including the RGPD and the LOPDGDD (section “Reports and resolutions” / “norms mativa ”), as well as the Guide on the use of video cameras for security and other as well as the Guide for the fulfillment of the duty to inform (both available bles in the section "Guides and tools"). It is also of interest, in case of low data processing risk, the free tool Facilitates (in the “Guides and tools” section), which by means of specific questions, it allows assessing the situation of the person responsible pect of the processing of personal data that it carries out, and where appropriate, generate di- verses documents, informative and contractual clauses, as well as an annex with Guidance security measures considered minimal. IV The claim is based on the installation of a video surveillance system with alleged orientation towards common areas, without the authorization of the Board of owners and without having the proper approved informative poster. The neighbor of the property referenced above. In order to install a video surveillance camera, in the case of the your property, you must inform the President of the Community of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 5 5/7 owners, in any case must be oriented towards the door and sale- of your property, not affecting common areas (such as traffic aisles) given that the privacy of third parties is affected without just cause. Likewise, you must have an approved poster , indicating the person responsible of the treatment, its purpose and an effective direction to which to go, especially if it is seasonal housing in this country. The known facts are constitutive of an infraction, attributable to the claim mado , for violation of art. 5.1 c) RGPD, previously described. In addition, the claimant warns that the listed property does not have a poster in which the presence of the cameras and the identity of the res- responsible for data processing, so that interested persons can exercise cite the rights provided for in arts. 15 to 22 of the RGPD. Article 83.5 RGPD provides the following: “Violations of the provisions- Subsequent measures will be sanctioned, in accordance with section 2, with administrative fines you go for a maximum of 20,000,000 EUR or, in the case of a company, a quantity equivalent to a maximum of 4% of the total global annual turnover for the year. previous financial year, opting for the largest amount: to) the basic principles for treatment, including conditions for con sentiment under articles 5, 6, 7 and 9; (…) ”. V The corrective powers available to the Spanish Protection Agency Data, as the control authority, are established in article 58.2 of the RGPD. In- Among them are the power to sanction with warning -article 58.2 b) -, the power to impose an administrative fine pursuant to article 83 of the GDPR -article 58.2 i) -, or the power to order the controller or data controller that the processing operations comply with the provisions of the GDPR, when proceed, in a certain way and within a specified period -article 58. 2 d) -. In accordance with the provisions of article 83.2 of the RGPD, the measure provided for in article Article 58.2 d) of said Regulation is compatible with the sanction consisting of a fine administrative. Without prejudice to the provisions of article 83 of the RGPD, the aforementioned Regulation provides in its art. 58.2 b) the possibility of sanctioning with warning, in relation with what is stated in Recital 148: "In the event of a minor offense, or if the fine is likely to be imposed constituted a disproportionate burden for a natural person, instead of san- With a fine, a warning may be imposed. You must nevertheless pay special attention to the nature, seriousness and duration of the offense, its character intentional, to the measures taken to mitigate the damages suffered, to the extent of responsibility or any pertinent previous infraction, to the way in which the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 6 6/7 control entity has been aware of the infringement, compliance with days ordered against the person responsible or in charge, to adhere to it already covers any other aggravating or mitigating circumstance. ” In the present case, it is considered that the community of owners has warned given to the accused, about the “disagreement” of the Board of owners, being able to- have given at least the necessary explanations to avoid reporting the "facts" to this body, the cameras according to the evidence provided affect common areas and are not properly marked, which justifies the imposition of a figure sanction- gives in the amount of € 2000 (Two Thousand Euros), taking into account the absence of infringement previous provisions and the particular nature of the same, but being the denounced knowledgeable of the “illegality” of the installation of the camera in question. The denounced party must clarify the cause / reason for the installation of the camera. mara, as well as its technical characteristics, providing photographs with cha and time of what it captures with it in a situation plane, or failing that has proceeded to remove it from the scene (eg, providing photographs (date / time before / after). It is warned that not meeting the requirements of this body may be considered an administrative offense in accordance with the provisions of the RGPD, typified as an offense in its article 83.5 and 83.6, being able to motivate such conduct the opening of a further administrative sanctioning procedure. The President of the Community of owners or, where appropriate, the Administrator, You can deliver a copy of this resolution to the accused, since you must have a address to communicate with it, or make reliable delivery in the bus- post office of this, being able once accredited the access to the same or in tempted the notification, file a new complaint if the accused persists in his offending conduct. Therefore, in accordance with the applicable legislation and the criteria of graduation of sanctions whose existence has been proven, the Director of the Spanish Agency for Data Protection RESOLVES : FIRST: TO IMPOSE Don AAA , with NIF *** NIF.1 , for a violation of the article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 2000 (Two Thousand Euros). SECOND: NOTIFY this resolution to Don AAA and INFORM the result of the actions to the complaining party COMMUNITY OF OWNERS RRR. THIRD: Warn the sanctioned that they must make effective the sanction imposed a once this resolution is executive, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period volunteer established in art. 68 of the General Collection Regulation, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, December 17, by entering, indicating the NIF of the sanctioned and the number C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 7 7/7 of procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000 , opened in the name of the Agency Spanish Data Protection at Banco CAIXABANK, SA . Otherwise, will be collected in the executive period. Notification received and once executive, if the date of enforcement is finds between the 1st and 15th of each month, both inclusive, the deadline to carry out the Voluntary payment will be until the 20th of the following month or the next business day, and if is between the 16th and last day of each month, both inclusive, the term of the Payment will be until the 5th of the second following month or immediately following business. In accordance with the provisions of article 50 of the LOPDGDD, the This Resolution will be made public once the interested parties have been notified. Against this resolution, which ends the administrative procedure pursuant to art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, interested parties may file, optionally, appeal for reversal before the Director of the Spanish Agency for Data Protection within one month from the day after notification of this resolution or directly administrative contentious appeal before the Contentious-administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from day after notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, the firm resolution may be provisionally suspended in administrative proceedings if the interested party expresses his intention to file a contentious appeal- administrative. If this is the case, the interested party must formally communicate this made by writing addressed to the Spanish Agency for Data Protection, presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest records provided in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too You must transfer to the Agency the documentation that proves the effective filing of the contentious-administrative appeal. If the Agency had no knowledge of the filing of the contentious-administrative appeal within two months from the day after notification of this resolution, would terminate the precautionary suspension. Sea Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es