The Spanish data protection authority sanctions a company for using a video surveillance system capturing sound in work areas, considering this audio data collection excessive and unjustified under the data minimization principle.

Facts and context

The Spanish Data Protection Agency (AEPD) today published a sanction decision against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. (including the imposition of a €4,000 fine) for breaches related to the use of a video surveillance system with audio capture at the workplace.

The case originated from a complaint filed by an employee on April 22, 2025, denouncing the installation of cameras recording sound and movement without his consent, whose recordings were used to support disciplinary proceedings against him.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority found that the company had installed a video surveillance system capturing both image and sound in work areas. It judged that the collection of audio data was an excessive and disproportionate measure compared to the invoked security and work control purposes. The justifications put forward, such as a previous theft and the behavior of a former employee, were not considered sufficient to legitimize such an intrusive measure into employees' private lives. Consequently, the processing of audio data was deemed non-compliant with the minimization principle, as it was neither adequate, relevant, nor limited to what is necessary.

Authority's decision

As a result, the authority imposed a €4,000 fine on BODENSE ESTRUCTURAS Y CALDELERÍA, S.L.

Furthermore, the authority ordered the company to disable the audio capture functionality of its video surveillance system and to adapt its data protection policy accordingly, within one month from the enforceability of the decision.

Lessons learned

This decision reminds that:

• Audio capture in the professional environment is an exceptionally intrusive measure that cannot be justified by general security reasons and requires a demonstration of absolute necessity, proportionality, and time limitation.
• The minimization principle requires collecting only data strictly necessary for the pursued purpose; audio data collection for premises security is, in principle, considered excessive.
• The presence of information signs about video surveillance, even if mentioning audio capture, does not make the processing lawful if it is otherwise excessive and violates the minimization principle.
• When a video surveillance system is used both for security and employee activity control, employees must be clearly and distinctly informed of this second purpose.