The Spanish authority sanctions a company for using a video surveillance system capturing images of public roads and employee rest areas, violating the data minimization principle.

Facts and context

The Spanish Data Protection Agency (AEPD) has today published a sanction decision against TBO WORKING SEGURIDAD, S.L. (including the imposition of a €6,000 fine) for breaches related to the installation of an excessive video surveillance system.

The procedure was initiated following a complaint filed on July 30, 2024, denouncing the capture of more than 400 images of the complainant and their minor children, which were then used in divorce proceedings.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority found that the company's video surveillance system captured images of public roads as well as indoor spaces, including employee rest areas and restroom entrances. It considered this processing excessive and lacking adequate justification, violating the principle that personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. This practice also contravenes Article 89(2) of the Spanish Organic Law on Data Protection (LOPDGDD), which restricts the use of cameras in such locations.

Authority's decision

Consequently, the authority imposed a fine of €10,000 on TBO WORKING SEGURIDAD, S.L., reduced to €6,000 after applying reductions for acknowledgment of responsibility and voluntary payment.

Furthermore, the authority ordered the company to take the necessary corrective measures to bring its video surveillance system into compliance with the regulations, notably by removing cameras deemed invasive, and to notify their implementation within one month.

Lessons learned

This decision confirms / specifies / recalls that:

• The implementation of a video surveillance system must be strictly limited to areas relevant to the pursued security purpose, systematically excluding public roads or the surroundings of third-party premises.
• Capturing images in employee rest areas, such as break rooms or restroom entrances, is considered a violation of the minimization principle and a disproportionate infringement on employees' privacy.
• Each installed camera must serve a legitimate, explicit, and clearly justified purpose, and its orientation must be as non-intrusive as possible to achieve that objective.
• Excessive data collection, even for security purposes, exposes the data controller to the risk that such data may be misused and used for unlawful secondary purposes, aggravating the scope of the initial violation.