The Spanish data protection authority dismissed a complaint concerning a video surveillance system, considering that the alleged facts were not proven after an on-site verification by the police, and recalled that disputes related to defamation on social networks fall under the jurisdiction of judicial authorities.

Facts and context

The Spanish data protection authority (AEPD) published a dismissal decision regarding a complaint filed against an individual for alleged breaches related to the installation of a video surveillance system and the dissemination of the captured images.

The case originated from a complaint filed by an individual on November 10, 2024, accusing their neighbor of using cameras to film their property and a public path, then disseminating the images on a monetized social network channel for purposes of denigration and mockery.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority examined whether the installation of the cameras constituted a disproportionate measure by capturing images of the public space without justification, which would violate the minimization principle. It recalled that surveillance of public roads falls under the exclusive jurisdiction of law enforcement and that private systems must be limited to the property perimeter. However, the investigation report requested from the national police did not corroborate the complainant's allegations. The officers dispatched to the site observed cameras pointing outward and compliant information signs but found no infringement, concluding that the system aimed to ensure perimeter protection of the property. In the absence of proof of excessive data collection and applying the presumption of innocence principle, the authority concluded that the violation was not established.

The authority also declared itself incompetent to rule on allegations of defamation and malicious dissemination of images on social networks. It specified that such facts, if proven, fall under the jurisdiction of judicial authorities and invited the complainant to refer the matter to the competent investigating judge. The AEPD emphasized that it should not be used to resolve neighborhood disputes outside its scope of competence.

Authority's decision

Consequently, the authority ordered the dismissal of the procedure, as no infringement of data protection regulations was formally proven.

Lessons learned

This decision reminds that:

• The burden of proof of an infringement lies with the supervisory authority; in the absence of conclusive factual elements, such as a conclusive police report, the presumption of innocence leads to dismissal of the complaint.
• In cases of video surveillance, on-site verification by a competent authority is a determining factor to establish the materiality of the facts, notably the actual orientation and field of view of the cameras.
• Issues of defamation or harassment, even if they involve the use of personal data, fall under the jurisdiction of judicial authorities and not that of the data protection authority.