The Spanish authority closes a procedure concerning a video surveillance camera in a rental apartment, after the data controller demonstrated its inoperability, but reminds that such devices are generally prohibited as they constitute a disproportionate interference with the privacy of tenants.

Facts and context

The Spanish data protection authority (AEPD) published a decision to close the procedure against the company MY CITY STAY, S.L. for the absence of personal data processing via a video surveillance system in a rental apartment.

The case originated from a complaint by a tenant denouncing the presence of an unreported video surveillance camera in an apartment he occupied.

Reasons for the decision

The authority analyzed the following potential breach before pronouncing the closure of the procedure:

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The sanction procedure had been opened for a potential violation of the obligation to have a legal basis for image capture. However, the company demonstrated, through statements from the installer and a technical report, that the camera was not operational during the complainant's stay and was only put into service later. In the absence of personal data processing, the authority concluded that no infringement of Article 6 of the GDPR could be constituted, the prerequisite condition for processing not being met.

Decision of the authority

Consequently, the authority ordered the closure of the procedure against MY CITY STAY, S.L.

Furthermore, the authority ordered the publication of its decision after notification to the concerned parties.

Lessons learned

This decision reminds that:

• The presence of video surveillance devices inside short-term rental accommodations is generally prohibited, as it constitutes a disproportionate interference with the right to privacy of the occupants.
• Consent to video surveillance cannot be considered freely given when included in the general terms of a rental contract, as the tenant has no real choice if they wish to access the accommodation.
• It is the responsibility of the data controller to prove the absence of data processing (for example, the non-functional nature of a camera) to exclude the application of the GDPR.