The Spanish authority sanctions a restaurant with a fine of €2,000 (reduced to €1,600) for using a video surveillance system capturing audio without prior information to the data subjects, violating the principles of data minimization and transparency.

Facts and context

The Spanish Data Protection Agency (AEPD) has today published a sanction decision against the operator of a catering establishment, including the imposition of a fine of €2,000, for breaches related to the use of a video surveillance system.

The procedure was initiated following a complaint filed on 8 July 2024 by a person concerning the installation of video surveillance cameras capturing audio in a restaurant, without any information signage.

Grounds for the decision

The authority found two breaches against the data controller, despite her claims that the device was fake and had been removed:

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority considered that the presence of cameras capturing sound in the establishment was not compliant with the regulation. Audio capture by a video surveillance system is deemed excessive and disproportionate in relation to the purposes usually pursued, thus constituting a violation of the data minimization principle.
• Information obligation (Article 13 of the GDPR): The absence of any signage informing employees and customers of the existence of the video surveillance system, its purposes, and other required information was established. The authority concluded that this lack of prior information constituted a breach of the transparency obligation.

Authority's decision

Consequently, the authority imposed a fine of €2,000 on A.A.A., reduced to €1,600 due to a voluntary payment made by the latter.

Lessons learned

This decision reminds that:

• Audio capture by a video surveillance system is, in principle, considered excessive and non-compliant with the minimization principle, unless an absolute and specific necessity is demonstrated.
• The obligation to inform through clear and visible signage is an essential prerequisite for the implementation of any video surveillance system in a place accessible to employees or the public.
• Failure to respond to the supervisory authority's requests during an investigation does not prevent the continuation of the procedure and the imposition of a sanction based on the collected evidence.
• Voluntary payment of a proposed fine may allow benefiting from a reduction of its amount, in accordance with applicable national administrative procedures.