APDCAT (Catalonia) - IP-0347/2025
From GDPRhub
| APDCAT - IP-0347/2025 | |
|---|---|
 | |
| Authority: | APDCAT (Catalonia) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(2) GDPR Article 24 GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 02.05.2026 |
| Decided: | |
| Published: | 21.05.2026 |
| Fine: | n/a |
| Parties: | Transports de Barcelona, SA |
| National Case Number/Name: | IP-0347/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Catalan, Valencian |
| Original Source: | APDCAT (in CA) |
| Initial Contributor: | bms |
The DPA held that employers could be held accountable for the usage of camera glasses by its employees in a work-related setting. However, the DPA dismissed a specific complaint because the alleged recording was not proven.
English Summary
Facts
A bus driver filed a complaint with the DPA against Transports de Barcelona, SA, the controller. The complaint concerned alleged covert recordings carried out in the workplace.
The data subject claimed that, in the context of an internal workplace harassment investigation, another employee with inspection and control duties had admitted to using sunglasses with an integrated camera, connected by Bluetooth to a mobile phone, to record images and audio of bus drivers inside buses. According to the complaint, the recordings were allegedly made without the knowledge or consent of the drivers or the employee’s superiors. The device was not part of the controller’s corporate equipment.
The data subject submitted an unsigned and undated internal report, as well as email exchanges with the controller. In these emails, the data subject requested access to the alleged recordings. The controller replied that it did not have such recordings, stating that they had not been made using corporate equipment and had not been included in the internal harassment file.
The DPA opened a preliminary investigation and requested information from the controller. The controller denied having provided any employee with devices capable of recording images or sound, including camera glasses or similar devices. It also stated that such devices were not part of the tools assigned to operational supervisors and that there was no protocol authorising the use of personal recording devices for inspection or supervision purposes.
The controller further argued that it had not authorised, instructed or tolerated the use of such devices. It stated that any possible use of a personal recording device, if it had occurred, would have been an individual act, unknown to the controller and unrelated to the employee’s official duties. The controller also indicated that the final report of the workplace harassment investigation did not refer to any camera glasses or similar recording device.
Holding
The DPA dismissed the complaint and archived the proceedings.
The DPA noted that the recording of images or voice by an employee in the workplace through a private device may, in certain circumstances, constitute processing that is not compliant with data protection lawd. It also observed that wearable devices, such as camera glasses, may raise data protection risks because they can collect, process and transmit personal data, including images, audio, location data or biometric data.
The DPA emphasised that controllers must implement appropriate technical and organisational measures to ensure compliance with Article 24 GDPR in the workplace. This may include clear internal policies, protocols, staff training and supervision mechanisms. The DPA also recalled the controller’s accountability obligations, which require not only compliance with the GDPR but also the ability to demonstrate such compliance, including in relation to employees’ actions in the workplace.
However, in this case, the DPA found that the alleged recordings had not been proven. The controller did not acknowledge that the recordings had taken place, and the data subject did not provide sufficient evidence to establish that a worker had recorded other employees or third parties inside a bus with a private device.
The DPA held that, in order to initiate sanctioning proceedings, there must be sufficient evidence or reasonable indications that an infringement was committed and that it may be attributed to the controller. Since those elements were missing, the DPA applied the principle of presumption of innocence under national administrative law.
As a result, the DPA found no proven infringement of data protection law. No fine was imposed and no corrective measures were ordered.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Catalan, Valencian original. Please refer to the Catalan, Valencian original for more details.
DOCUMENTS REFERENCES
TYPEAnonymized resolution FILE-0347/2025
UNITAPDCAT Inspection and Technical Area APDCAT Process21/05/2026 11:51
SECURE VERIF CODE8e6f1397-ee94-48cd-a70b-2e3f890e776c
IDENTIFIED_A09018940_2026_0000000000000000000000000140381
ACCESS LEVEL: Definitive
File identification
Resolution for archiving of prior information no. IP-0347/2025, referring to Transports de
Barcelona, SA.
Background
1. On 02/05/2025, it was submitted to the Catalan Data Protection Authority a
letter of complaint against Transports de Barcelona, SA (henceforth, TMB), with
due to an alleged breach of the regulations on the protection of personal data.
In summary, the complainant (...) stated the following:
− That "el señor (...) [from now on, Mr. A] carrying out his inspection and control work,
has acknowledged in the workplace harassment procedure that he uses single-cone glasses
camera linked by Bluetooth to the mobile phone to record image and audio of
drivers at their workplace, inside the bus, without their consent
knowledge of the recorded persons, nor of their superiors, device that is not
equipment provided by the company."
- That "this is stated in his statement in the case report (...): 'when knowing the identity of
driver and that he was a conflicted driver before entering puts the recorder of the
phone running, he tells us that whenever a driver is conflictive
does'."
- That "it is also stated in the conclusions of the investigation report (...) 'a) Recognize
which always records when there are conflicting drivers, I previously did not know about it
number the driver, but the recording is from minute 0. (…). c) Appropriate or not
of a command to record their performances with the conductors.'"
The reporting person provided documentation relating to the events reported, specifically:
- TMB investigation report (document without signature or date).
- String of electronic messages exchanged between TMB and the complainant, in the context
of alleged workplace harassment. Some of these messages refer to the
reported events, specifically:
• Email message dated 07/04/2025, 13:06 hours, which the complainant
sent to the entity. Among other things, he requested “the images recorded from
the interior of the bus of my person by (...) [Mr. A] that
he made with his sunglasses with Bluetooth camera that are
provided in the file palte (...)/2024, recordings made by this
command during the provision of the service, as stated in the file.”
• Email message dated 08/04/2025, 14:36 hours, with which TMB responded
to the previous message. Among other things, it mentioned that “with regard to
PAGE: 1 ofDATE AND TIME OF COPY GENERATION: 05/22/2026 10:35
This document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.i DOCUMENTS REFERENCES
NOMRESOL_A ca_IP_2025-347a SIGNATURESP-0347/2025
UNITA Inspection and Technical Area of the APDCAT APDCAT Process21/05/2026 11:51
SECURE VERIFICATION CODE8e6f1397-ee94-48cd-a70b-2e3f890e776c
STATUS DEVELOPMENTDefinitiu026_00000000000000000000000000140381
ACCESS LEVEL:
images recorded with the sunglasses of the (...) I cannot provide them to you
simply because we do not have them: a) first because they have not been recorded
with a TMB-owned means and b) because they are not included in
the case file to which you refer.”
• Email message dated 02/05/2025, 11:55 hours, which the complainant
sent to TMB, with which, among other things, he requests “to know if you have
taken any action regarding the improper use, an irregularity, of sunglasses camera
to record at your convenience inside the bus while carrying out a work activity
of inspection and control, as the command (...) acknowledged that he was doing,
without authorization and knowledge of his superiors (...).”
• Email message dated 02/05/2025, 12:30 hours, with which TMB responds to the
previous message. As far as this is concerned, it mentions that “in relation to the
sunglasses that record, I already indicated to you that it is not a competence that
can manage (...) since the images you mention were recorded, it was not
done through a TMB medium (it is not a TMB camera nor do I have the option
of accessing anything) (...).”
2. The Authority opened a preliminary information phase (no. IP-0347/2025), in accordance with the provisions of Article 7 of Decree 278/1993, of 9 November, on the sanctioning procedure applicable to the areas of competence of the Generalitat, and Article 55.2 of Law 39/2015, of 1 October, on the common administrative procedure of public administrations (LPAC), to determine whether the facts were likely to justify the initiation of a sanctioning procedure. 3. In this information phase, on 16/02/2026, the reported entity was required to report on whether Mr. A, during his working day, had recorded other company workers inside buses with a glasses device with a built-in camera, without their authorization. He was also asked to indicate whether
Mr. A's functions include monitoring bus driver workers with
image/voice recording devices; whether the recordings subject to the complaint include
images/voice of third parties outside the company or on public roads; on what
dates these recordings were made and their duration; what categories of data
have been processed, specifically whether the recordings include images and voice and how many
people they have affected, distinguishing between workers and third parties and whether the files of
the recordings have been transferred to another or other devices owned by the company and
for how long the files have been kept.
4. On 26/02/2026, Transports de Barcelona SA responded to the request with a
letter in which, in summary, it stated the following:
− That “it does not provide any worker with devices that allow the recording of images or sound, nor
glasses with a camera, nor any other personal device or one linked by Bluetooth to
private or corporate mobile phones.”
− That “this type of equipment (glasses with a recording option) is not part of the
corporate tools assigned to operating managers, nor is there any protocol or
function that authorizes the use of recording devices within the framework of the supervision or inspection
of the service.”
2/6
PAGE: 2 of DATE AND TIME OF COPY GENERATION: 05/22/2026 10:35
This document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.i DOCUMENTS REFERENCES
TYPEAnonymized resolution FILE-0347/2025
UNITA Inspection and Technical Area of the APDCAT APDCAT Process 05/21/2026 11:51
SECURE VERIFICATION CODE8e6f1397-ee94-48cd-a70b-2e3f890e776c
STATUS FROM ELABORADefinitiu026_0000000000000000000000000140381
ACCESS LEVEL:
− That “the company has not authorized, entrusted, instructed or tolerated at any time the use of
personal recording devices —including glasses with cameras or equivalent devices— by any member of staff, nor is this type of equipment
part of the corporate tools or the operational supervision protocol.”
− That “(...) any eventual use of a personal device with recording capability
(...), if it had actually taken place, would constitute a strictly individual action, not
communicated, not known and completely unrelated to the functions of their job and to any organizational power of TB in particular (and of TMB in general).”
− That “these actions, if they had occurred, cannot be qualified as data processing carried out by TB or as an organizational practice, and are completely
outside its scope of legal responsibility.”
− That “the Final Report of the conclusions of the Labor Harassment Commission corresponding to
the File (...), makes no reference, at any time, to the existence or use
of sunglasses with a built-in camera or any other similar device by
Mr.(...) [Mr. A] or any other command.”
− That “the available documentation is limited to describing an interpersonal conflict and episodes
of work tension, but none of the stories provided mentions the use of glasses connected
by Bluetooth, so this statement is not part of the internal background and
has not been the subject of investigation or verification within the framework of the procedure (...).”
− That Mr. A “(...) holds the position of (...) within the structure of Transports de Barcelona,
S.A.”
− That “this is a position (...) with functions (...), which includes tasks of regulating the service,
functional supervision of the driving staff and carrying out specific inspection actions
on the development of the bus service.”
− That “these functions (...), in no case, incorporate or require the capture of images
or sounds of workers or third parties.”
− That “none of the functions of the position of (...) requires (...) the use of image or voice recording devices.”
− That “operational supervision is carried out through direct observation and through the existing corporate systems (for example, the phone/radio system with the Bus Control Center), but never through personal audiovisual capture devices.”
− That “this type of instrument is not part of the assigned corporate tools nor is it contemplated in any current internal procedure.”
− That “it has also not given any instruction that enables or allows this type of practice
in the exercise of control functions.”
− That “it has no evidence of the existence of any recording made using alleged Bluetooth-linked camera glasses, nor does it have objective elements
that prove that image or voice recordings have been made in the
circumstances described in the complaint (...).”
3/6
PAGE: 3 of DATE AND TIME OF COPY GENERATION: 05/22/2026 10:35
This document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.i DOCUMENTS REFERENCES
NAME:RESOL_A ca_IP_2025-347a SIGNATURESP-0347/2025
UNITAspect of Inspection and Technique of the APDCAT APDCAT Process21/05/2026 11:51
SECURE VERIFICATION CODE8e6f1397-ee94-48cd-a70b-2e3f890e776c
STATUS FROM ELABORADefinitiu2026_00000000000000000000000000140381
ACCESS LEVEL:
− That “it is completely unaware of the existence of the recordings that are the subject of the complaint, that
these have not been reported or detected at any stage of the internal procedures
carried out and that, therefore, the company does not have any data that allows it to respond
to material aspects associated with their alleged production.”
− That “it cannot provide information on categories of data or affected persons because
there is no data processing carried out by the company or under its order in
relation to the events described (...).”
The entity complained about attached various documents to the letter, including the final report
of conclusions, dated 14/01/2025, relating to the case mentioned in the complaint.
This document does not make any reference to the recording of images.
Legal basis
1. In accordance with the provisions of articles 90.1 of the LPAC and 2 of Decree 278/1993, in
relation to article 5 of Law 32/2010, of October 1, of the Catalan Data Protection Authority, and article 15 of Decree 48/2003, of February 20, which approves
the Statute of the Catalan Data Protection Agency, the director of the Catalan Data Protection Authority is competent to issue this
resolution.
2. Based on the report of the background, it is necessary to analyze the reported facts that are the object of this
resolution to close the case.
The complainant complains that, in the context of a case of workplace harassment investigated
by TMB, a worker of the company with functions (...) admitted that he used
sunglasses with a camera and a Bluetooth connection with his mobile phone, to record
the image and sound of bus drivers at his workplace, without the consent or
knowledge of the people recorded, or of their superiors, and mentioned that it is a
device that is not part of the company's equipment.
To prove the reported facts, he provided a report without signature or date, and a
series of electronic messages exchanged with TMB, in which the complainant requested
information about recordings made with glasses by a worker of the company and the entity denied having these recordings, in the event that
they had been taken to term.
On the other hand, the reported entity alleges that it has no evidence that these recordings
have been made and, in any case, denies that this type of device is part of the
corporate tools assigned to workers or that it allows this type of practice
in the exercise of control functions. It also denies that in the processing of the file
relating to a case of harassment referred to by the complainant, the existence
of these recordings was established.
Thus, according to the background, during the investigation phase it has not been proven that a
TMB worker (...) has captured images of other workers or third parties
inside a bus, through a device that is not part of the
company's equipment, in this case, glasses with a built-in camera. With regard to the
reported events, the entity does not acknowledge that they have occurred and the complainant has not provided
any evidence that the confirm.
4/6
PAGE: 4 ofDATE AND TIME OF COPY GENERATION: 05/22/2026 10:35
This document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.i DOCUMENTS REFERENCES
NOMRESOL_A ca_IP_2025-347a SIGNATURESP-0347/2025
UNITA Inspection and Technical Area of the APDCAT APDCAT Process21/05/2026 11:51
SECURE VERIFICATION CODE8e6f1397-ee94-48cd-a70b-2e3f890e776c
STATUS BY ELABORADefinitiu026_00000000000000000000000000140381
ACCESS LEVEL:
However, it is worth mentioning that the capture of images or voice by a worker
within the work environment, through a private device, could constitute, in certain
cases, a treatment that does not respect data protection regulations. In addition
to mobile phones, it should be borne in mind that the use of
portable devices called “wearables”, designed to be worn on the body (as
clothing or an accessory), which incorporate digital technology to collect, process and, often,
transmit data continuously or automatically, is increasingly normal. These devices can integrate
cameras, microphones, GPS or biometric sensors, and can even interact with the user or
with other computer systems, such as artificial intelligence. For this reason,
it is convenient for the person in charge of The data controller shall adopt appropriate technical and organisational measures, such as clear internal policies, action protocols, staff training and supervision mechanisms, to ensure that personal data is processed in the corporate environment in accordance with the principles of the GDPR. In accordance with the General Data Protection Regulation (GDPR), the controller has a proactive responsibility that requires it not only to comply with the regulations, but also to be able to demonstrate compliance, including with regard to the actions of its employees in the work environment. It should be remembered that the controller is responsible for any infringements that may occur within the framework of the activity of its employees when these demonstrate a lack of prevention or diligence, thus reinforcing the need for a data protection culture integrated into the daily functioning of the organisation.
However, as has been said and for what is of interest here, in this case it has not been proven that the
disputed recording has occurred.
Having said that, it must be borne in mind that the administrative sanctioning procedure is
particularly guarantor, due to the consequences that can arise from it. Therefore, in order to
initiate it, there must be sufficient evidentiary elements or rational indications that allow
to attribute the commission of an offence to the reported entity, elements that do not exist in
the case under examination. Due to the circumstances described, it is necessary to apply the principles of
the presumption of innocence in the scope of the sanctioning power. This principle is
contained in article 53.2.b of the LPAC and recognizes the right to the presumption of non-existence of
administrative responsibility until the contrary is proven. Consequently, in application of the principle of presumption of innocence, it is appropriate to file these proceedings, since the facts have not been proven.
3. Article 10.2 of Decree 278/1993, of 9 November, on the sanctioning procedure
applicable to the areas of competence of the Generalitat, provides that “(…) no charge sheet will be formulated
and the case will be dismissed and the proceedings will be ordered to be filed
when the proceedings and evidence carried out prove the non-existence
of an offence or liability. This resolution will be notified to the interested parties.” And Article
20.1 of the same decree determines that dismissal is appropriate: “(…) b) When there are no
rational indications that the facts that have been the cause of the initiation of
the procedure have occurred; (...).”
In accordance with everything that has been explained in the 2nd legal basis, and given that during the actions carried out within the framework of the prior information, no fact has been proven that may constitute any of the violations provided for in the legislation on data protection, it is appropriate to agree to archive it.
5/6
PAGE: 5 of DATE AND TIME OF COPY GENERATION: 05/22/2026 10:35
This document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.i DOCUMENTS REFERENCES
TYPEAnonymized resolution CASETYP-0347/2025
NAME:RESOL_A ca_IP_2025-347 SIGNATURES
SECURE VERIFICATION CODE8e6f1397-ee94-48cd-a70b-2e3f890e776c APDCAT Process05/21/2026 11:51
IDENTIFIED_A09018940_2026_000000000000000000000000140381
STATUS OF PROCESSINGFinal
ACCESS LEVEL:
Resolution
Therefore, I resolve:
1. To file the prior information actions number IP-0347/2025, relating to Transports
de Barcelona SA, since it has not been established that any act has occurred that could constitute any of the infringements provided for in the legislation on data protection.
2. To notify this resolution to Transports de Barcelona SA and to the person making the complaint.
3. To order that this resolution be published on the Authority's electronic headquarters, in
accordance with article 17 of Law 32/2010.
Against this resolution, which puts an end to the administrative procedure in accordance with articles 26.2 of
Law 32/2010 and 14.3 of Decree 48/2003, of 20 February, which approves the Statute of
the Catalan Data Protection Agency, interested parties may, on an optional basis,
file an appeal for reconsideration with the director of the Catalan Data Protection Authority, within a period of one month from the day following its notification, in accordance
with the provisions of article 123 and following of Law 39/2015. You can also directly file an administrative appeal before the administrative courts of Barcelona, within two months from the day after its notification, in accordance with Law 29/1998, of 13 July, regulating administrative jurisdiction. The director 6/6 This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=8e6f1397-ee94-48cd-a70b-2e3f890e776c The recipient of the document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
