The Spanish data protection authority (AEPD) has issued a sanction decision against the company GRUPO MANSERCO, S.L., including the imposition of a €2,000 fine, for a failure to inform regarding a video surveillance system at the workplace.

Facts and context

The case originated from a complaint by an employee concerning the installation of new cameras, potentially equipped with microphones and speakers, in the company’s offices, including a dining area and an office.

The company argued that these cameras were not operational, did not record images or sound, and served only a deterrent purpose. It specified that it also had a separate active security system managed by an external provider. Although the procedure was initially initiated for potential violations of the principles of minimization and information, only the violation of the information obligation was retained in the final decision.

Reasons for the decision

The authority found a breach of the transparency and information obligation towards data subjects:

• Information obligation (Article 13 of the GDPR): The authority considered that the mere presence of image capturing devices, even if inactive, creates an expectation of surveillance that requires the controller to comply with the information obligation. In this case, the company had a dual camera system (one active and managed by a third party, the other internal and inactive) but had not provided employees with complete and clear information about all these devices. The authority emphasized that the controller retained the discretionary power to activate the inactive cameras, making prior information all the more necessary to guarantee the rights of the data subjects.

Authority's decision

Consequently, the authority imposed a €2,000 fine on GRUPO MANSERCO, S.L.

Furthermore, the authority ordered the company to inform its employees and their representatives, within one month, of the presence of video surveillance devices and to provide proof of this action.

Lessons learned

This decision reminds that:

• The information obligation of Article 13 of the GDPR also applies to video surveillance devices installed for purely deterrent and non-operational purposes, as long as they can be activated.
• The information provided to data subjects must cover all existing processing systems, including in cases of coexistence of multiple systems (for example, an active system managed by a provider and an inactive internal system).
• Sound recording in the workplace is subject to a strict principle of proportionality and is prohibited by Spanish law in areas dedicated to employee rest, such as changing rooms, toilets, or dining rooms.