AEPD - PS/00273/2019
|AEPD - PS/00273/2019|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 12 GDPR
Article 13 GDPR
Article 30(1) GDPR
Article 58(2) GDPR
Article 83(2) GDPR
Article 83(5) GDPR
|Parties:||COMUNIDAD DE PROPIETARIOS DEMELZA BEACH|
|National Case Number/Name:||PS/00273/2019|
|European Case Law Identifier:||n/a|
|Original Source:||Agencia Española de Protección de Datos (in ES)|
|Initial Contributor:||Silvia López Arnao|
Spanish DPA (AEPD) holds that the installation of video surveillance systems that capture images of common areas of the neighborhood violates Article 5 of the GDPR (data minimization).
English Summary[edit | edit source]
Facts[edit | edit source]
A neighbor had placed cameras in his door directed to common areas, stairs and corridors, recording all of the rest of the neighbors who passed by
Dispute[edit | edit source]
Does the installation of surveillance systems that capture images of common areas of the neighborhood respect the principle of data minimization under the GDPR?
Holding[edit | edit source]
The DPA held that the installation of this type of system must be oriented preferably towards the access points to be protected and should not be oriented towards common or transit areas of the other neighbors, and it must also have the corresponding information sign, indicating that it is a video-surveillance area.
Comment[edit | edit source]
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
DECISION ON DISCIPLINARY PROCEEDINGS From the procedure instructed by the Spanish Data Protection Agency and on the basis of the following FACTS FIRST: DEMELZA BEACH OWNERS COMMUNITY (hereinafter referred to as the The complainant) filed a complaint with the Agency on 9 April 2019 Spanish Data Protection. The claim is directed against A.A.A. with NIF ***NIF.1 (hereinafter referred to as the Respondent). The grounds for the complaint and, where appropriate, the documents provided by the claimant are as follows: "Place cameras on facade aimed at common areas, stairs and corridors, recording all the communal farmers who pass by" (sheet no. 1). SECOND: In view of the facts denounced in the complaint and the documents provided by the claimant, the General Sub-directorate of Data Inspection proceeded to carry out previous investigative actions for the clarification of the facts in question, under the powers of investigation granted to the supervisory authorities in Article 57(1) of Regulation (EU) 2016/679 (Regulation Protection, hereinafter referred to as the RGPD), and in accordance with the provisions of Title VII, Chapter I, Section 2, of Organic Law 3/2018 of 5 December 1978 on the December, Protection of Personal Data and Guarantee of Digital Rights (in hereinafter LOPDGDD). As a result of the investigative actions carried out, it is noted that the person responsible for the processing is the one who is being claimed. THIRD: On 17 December 2019, the Director of the Spanish of Data Protection agreed to initiate sanctioning proceedings against the respondent, by the alleged violation of Article 5.1(c) of the GPRS, as defined in Article 83.5 of the RGPD. In view of all that has been done, by the Spanish Data Protection Agency The following are considered to be proven facts in these proceedings, PROVEN FACTS First, on 09/04/19, this agency received a complaint from the Community of owners-Demelza Beach-which is made concrete by the following facts: "Place cameras on facade directed to common areas, stairs and corridors, recording all the communal farmers who pass by" (sheet no. 1). Second. It is identified as the main responsible the neighbor of the same A.A.A. Third. The installation of a video-surveillance system is accredited into common areas without just cause. Fourth. It is noted that the information poster does not indicate the responsible party to whom exercise, where appropriate, the rights recognised in Articles 15 to 22 of the GPR. LEGAL GROUNDS I By virtue of the powers that Article 58.2 of the RGPD grants to each supervisory authority, and in accordance with the provisions of Articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to resolve this procedure. II In the present case, the complaint dated 09/04/19 is examined, by means of which the following is transferred as the main event: "Placing cameras on the facade aimed at common areas, stairs and corridors, recording all the communal farmers who pass by" (sheet no. 1). The physical image of a person, according to article 4.1 of the RGPD, is a piece of information personal and their protection, is therefore the subject of the said Regulation. In Article 4(2) of the RGPD defines the concept of "processing" of personal data. It is therefore relevant to analyse whether the processing of personal data (image of individuals) carried out through the reported video surveillance system is in accordance with the provisions of the RGPD. Cameras installed by private individuals cannot be directed at a third parties, obtaining images/sound from third party conversations, by affect your privacy, regardless of the fact that there are less invasive protection measures of the property, if necessary. The described facts suppose an affectation to the article 5.1 c) RGPD "The personal data will be: c) adequate, relevant and limited to what is necessary in relation to the purposes for those who are treated ("data minimization"). Individuals who install this type of device are responsible for It must comply with current legislation and must also meet the requirements established in the Horizontal Property Law (LPH). III In accordance with the above, the processing of images through a video surveillance system, in order to comply with the regulations in force, must comply with the following requirements: - Respect the principle of proportionality. - When the system is connected to an alarm centre, it may only be installed by a private security company that meets the requirements set out in Article 5 of Law 5/2014 on Private Security of 4 April. - The video cameras may not capture images of people outside the private space where the video surveillance system is installed, as image processing can only be carried out in public places, unless authorized by the government, by the Security Forces and Corps. Nor may spaces owned by third parties be captured or recorded without the consent of the owners or, where appropriate, of the people who are in them. This rule admits some exceptions since, on some occasions, for the protection of private spaces, where cameras have been installed on facades or in the may be necessary to ensure the security purpose of recording a portion of the public road. In other words, cameras and camcorders installed for security purposes may not obtain images of the public highway unless it is essential for that purpose, or it is impossible to avoid it because of the location of The minimum space for this purpose shall also be collected extraordinarily. Therefore, the cameras may exceptionally capture the minimum portion necessary for the intended security purpose. - The duty to inform those affected must be fulfilled, as provided for in Articles 12 and 13 of the RGPD, and it is applicable - as it does not contradict the provisions of the the manner provided for in Article 3 of Instruction 1/2006 of 8 of November, of the Spanish Data Protection Agency, on the Processing of Personal Data for Surveillance Purposes through Camera or Video Systems. In particular, at least one information sign must be placed in the video-surveillance areas, in a sufficiently visible place, both in open spaces as closed, which shall identify at least the existence of a treatment, the identity of the person responsible and the possibility of exercising the rights provided for in those precepts. The information must also be kept available to those affected referred to in the aforementioned RGPD. - The person responsible must keep a register of processing activities carried out under his responsibility which includes the information to which he reference to Article 30.1 of the RGPD. - Installed cameras cannot obtain images from space that is exclusive to third party and/or public space without duly accredited cause, nor can to affect the privacy of passers-by who are freely passing through the area. It is therefore not permitted to place cameras on the private property of neighbours with the purpose of intimidating them or affecting their privacy without just cause. - In no case shall the use of surveillance practices be allowed beyond the environment that is the object of the installation and in particular, they may not affect the surrounding public spaces, adjacent buildings and vehicles other than those that access the space under surveillance. In relation to the above, to facilitate consultation by interested parties, the Spanish Data Protection Agency offers through its website [https://www.aepd.es] access to the legislation on personal data protection, including the RGPD and the LOPDGDD (section "Reports and resolutions" / "regulations"), as well as the Guide on the use of video cameras for security and other purposes, as well as the Guide for the fulfilment of the duty to inform (both available in the section "Guides and tools") It is also of interest, in case of data processing under risk, the free tool Facilita (in the section "Guides and tools"), which by means of specific questions, allows the assessment of the situation of the person responsible with regard to the processing of personal data that he/she carries out, and if appropriate, to generate various documents, informative and contractual clauses, as well as an annex with Indicative security measures considered as minimum. IV The claim is based on the installation of a video surveillance system with alleged orientation towards common areas, without the authorization of the Board of owners and without the appropriate approved information sign. It is identified in the claim as the main responsible the neighbour of the property referenced above. The known facts constitute an infringement, attributable to the defendant, for violation of art. 5.1 c) RGPD, described above. In addition, the complainant warns that the property in question does not have a sign informing about the presence of the chambers and the identity of the data controller, so that the data subjects can exercise the rights provided for in articles 15 to 22 of the RGPD. Article 83(5) of the RGPD states: 'Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines not exceeding EUR 20 000 000 or, in the case of an undertaking, by a sum equivalent to a maximum of 4 % of the total annual turnover of the previous financial year, whichever is higher: (a) the basic principles for treatment, including the conditions for consent under articles 5, 6, 7 and 9; (...)". V The corrective powers available to the Spanish Protection Agency of Data, as supervisory authority, are set out in Article 58(2) of the GPRS. These include the power to sanction with a warning - Article 58.2 b), the power to impose an administrative fine under Article 83 of the GPRS -Article 58(2)(i), or the power to instruct the controller or processor that the processing operations comply with the provisions of the RGPD, when proceed, in a certain manner and within a specified period - Article 58. 2 d)-. In accordance with Article 83(2) of the RGPD, the measure provided for in Article 58(2)(d) of that Regulation is compatible with the sanction consisting of a fine administrative. Without prejudice to the provisions of Article 83 of the GPRS, the said Regulation Article 58(2)(b) provides for the possibility of a warning in relation to with what is stated in Recital 148: "In the event of a minor infringement, or if the fine likely to be imposed constitute a disproportionate burden on a natural person, a warning may be imposed instead of a penalty in the form of a fine. It should however be provided special attention to the nature, gravity and duration of the infringement, to its character the measures taken to mitigate the damage suffered, to the extent liability or any previous relevant breach, the way in which the supervisory authority became aware of the breach, compliance with measures ordered against the responsible person or person in charge, adherence to codes of conduct and any other aggravating or mitigating circumstances. In the present case, it is considered that the owners' association has warned the defendant about the "disagreement" of the owners' association, and may have given at least the necessary explanations to avoid the reporting of the "facts" to This organism, the chambers according to the indications given affect common areas and are not properly marked, which justifies the imposition of a penalty in the 2 000 (two thousand euros), taking into account the absence of any previous infringement and the particular nature of the infringement. It should be remembered that the installation of this type of system should preferably be oriented towards the access points to be protected (e.g. door and window particular) should not be oriented towards common or transit areas of neighbours (as), it must also have the corresponding information device, informing that this is a video-surveillance area. The reported party must clarify the cause/reason for the installation of the camera, as well as the technical characteristics of the same, providing photographs with date and time of what it captures with the same in a situation plane, or in its absence Contentious-Administrative Jurisdiction, within two months from day following notification of this act, as provided for in Article 46(1) of referred to Law. Finally, it is pointed out that in accordance with the provisions of article 90.3 a) of the LPACAP, the final resolution may be suspended in administrative proceedings as a precautionary measure if the interested party expresses his intention to file an administrative appeal. If this is the case, the interested party must formally communicate this made by writing to the Spanish Data Protection Agency, by submitting it through the Agency's Electronic Register [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registrations provided for in Article 16.4 of the aforementioned Law 39/2015 of 1 October. Also must send to the Agency the documentation proving the effective intervention of the contentious-administrative appeal. If the Agency was not aware of the the lodging of the contentious-administrative appeal within two months of day following notification of this resolution, would terminate the precautionary suspension. Mar EspañaMartí Director of the Spanish Data Protection Agency