The Spanish authority sanctions a landlord with €6,000 for installing a video surveillance system in the common areas of a rented apartment without a valid legal basis.

Facts and context

The Spanish Data Protection Authority (AEPD) published on 28 July 2026 a sanction decision against A.A.A. (including the imposition of a €6,000 fine) for breaches related to the installation of a video surveillance system in shared housing.

The case originated from a tenant's complaint filed on 16 August 2024, denouncing the installation of cameras in the common areas of the housing (kitchen, living room, balcony, corridor) without prior information or consent.

Grounds for the decision

• Lack of legal basis for the processing (Article 6 of the GDPR): The authority found the installation of four cameras in the common areas of a rented apartment, processing images of tenants. The data controller claimed that tenants were informed by a clause in the rental contract and by the house rules. However, the authority considered that this arrangement did not constitute a valid legal basis. It emphasized that processing images within a home, including its shared parts, significantly impacts privacy and requires a robust legal basis, such as the specific and informed consent of each data subject. In this case, the installation was carried out without obtaining such consent, rendering the processing unlawful under the GDPR.

Authority's decision

Consequently, the authority imposed a €6,000 fine on A.A.A.

Furthermore, the authority ordered the data controller to uninstall the entire video surveillance system and provide documented proof of this uninstallation (such as a dated photograph) within one month from the enforceability of the decision.

Lessons learned

This decision confirms / specifies / recalls that:

• The installation of a video surveillance system in the common areas of shared housing requires a valid legal basis, which, in such a private living context, generally relies on the free and informed consent of each tenant.
• A clause inserted in a rental contract or internal regulations cannot replace obtaining specific and explicit consent for data processing by video surveillance, especially when such processing is particularly intrusive.
• Before deploying a video surveillance system for security or conflict management purposes in housing, the data controller must assess the necessity and proportionality of the measure and consider less privacy-intrusive alternatives for the data subjects concerned.
• The dismissal of a criminal complaint regarding the installation of cameras does not prejudge the compliance of the processing under the GDPR, as the two legal regimes are distinct and pursue different objectives.