The Spanish data protection authority (AEPD) has closed a procedure concerning the installation of a surveillance camera in a vehicle, considering that the mere presence of the device, without evidence of its activation and therefore of data processing, is not sufficient to characterize a GDPR infringement.

Facts and context

The Spanish data protection authority (AEPD) today published a decision to close a procedure against an individual for alleged breaches related to the installation of a surveillance camera inside their vehicle.

The case originated from a complaint filed on 31 January 2025, denouncing the installation of a camera in a vehicle, directed towards the public road and without information signage.

Reasons for the decision

The procedure had been initiated for an alleged violation of the data minimization principle. The individual argued that the camera, installed for security purposes following damage to their vehicle, only recorded during excessive proximity and generally remained off. The authority analyzed the alleged breach as follows:

• Data minimization principle (Article 5(1)(c) of the GDPR): The authority examined the installation of a camera in a vehicle for deterrent purposes, directed towards public space. While recognizing that an image is personal data within the meaning of Article 4(1) of the GDPR, it considered that the mere physical presence of a recording device does not in itself constitute data processing. In the absence of proof that the camera was active and collecting data, the authority concluded that the commission of an infringement could not be established, data processing being the prerequisite for the application of the GDPR.

Authority's decision

Consequently, the authority ordered the archiving of the procedure and the closure of the case without sanction.

Lessons learned

This decision reminds that:

• The mere physical presence of an image capture device, such as a camera, is not sufficient to characterize personal data processing; proof of its activation and effective data collection is necessary.
• It is up to the supervisory authority or the complainant to provide evidence that data processing is indeed taking place; the mere installation of equipment is not sufficient to presume an infringement.
• Data processing by video surveillance only begins at the moment of capturing, recording, or transmitting images, and not from the installation of the equipment.
• The installation of a camera in a private vehicle for security reasons, notably to prevent damage, may constitute a legitimate purpose, provided that the resulting data processing complies with the principles of the GDPR.