The Spanish data protection authority (AEPD) sanctioned a company for its video surveillance system, finding that the information provided to employees was insufficient and that the information signs were incomplete, violating the transparency obligation.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against REBOBINART, S.L. (including the imposition of a €2,000 fine) for breaches related to informing employees about a video surveillance system in the workplace.

The case originated from a complaint by an employee denouncing the installation of video surveillance cameras without prior information, including in rest areas.

Reasons for the decision

• Information obligation (Article 13 of the GDPR): The authority found that the company did not properly inform its employees about the presence of the video surveillance system. The information materials, notably the displayed signs, were incomplete as they did not indicate the modalities for exercising the rights of the data subjects. Furthermore, the investigation revealed a general lack of employee awareness regarding the exact purpose of the processing, which constitutes a direct violation of the transparency requirements imposed by the GDPR.

Authority's decision

Consequently, the authority imposed a €2,000 fine on REBOBINART, S.L.

Moreover, the authority ordered the company to bring its practices into compliance within one month. It must notably prove that it has properly informed employees about the presence of the cameras, their purpose, and the modalities for exercising their rights, by providing a report and updating the information signs.

Lessons learned

This decision reminds that:

• Information signs for video surveillance must imperatively contain all required mentions, including the practical modalities for exercising the rights of the data subjects.
• Information to employees about a video surveillance system must be complete and proactive, to ensure they have a clear and effective understanding of the purpose of the processing and their rights.