The Spanish authority sanctions an individual for the use of a video surveillance system in a tourist rental, judging that the security purpose was not justified and that the information provided to tenants was absent or non-compliant.

Facts and context

The Spanish Data Protection Authority (AEPD) published a sanction decision against an individual, including the imposition of a fine of €4,000, for breaches related to the use of a video surveillance system in a property intended for tourist rental.

The case originated from a tenant's complaint, filed on 28 October 2024, denouncing the installation of several cameras filming private areas of the rental (garden, porch, jacuzzi, interior through a window) without any prior information.

Grounds for the decision

• Absence of legal basis for the processing (Article 6 of the GDPR): The authority considered that the data controller had no valid legal basis to film the tenants. Although the security purpose of the property was invoked, the AEPD noted that the majority of the six cameras were directed towards the rented part (terrace, garden, play area) and not towards the private residence of the owner. Furthermore, the controller could not demonstrate having obtained the tenants' explicit consent for this processing, rendering the surveillance unlawful. Some cameras even captured adjacent public spaces, thus exceeding the property's perimeter.
• Failure to comply with the information obligation (Article 13 of the GDPR): At the time of the facts, no compliant information was provided to the data subjects. The complainant attested to the absence of any informative device. Although the controller later claimed to have signage, it referred to a repealed law and was only brought into compliance after the complaint was filed, thus not fulfilling the prior information requirement.

Authority's decision

Consequently, the authority imposed a fine of €4,000 on the data controller, reduced to €3,200 following a voluntary payment.

Moreover, the authority ordered the data controller to redirect or remove cameras with an excessive field of view, to implement visible and GDPR-compliant information signage, and to formalize an information document for tenants, all within one month.

Lessons learned

This decision reminds that:

• Invoking property security does not constitute a sufficient legal basis to justify constant video surveillance of private living spaces made available to tenants.
• The field of view of video surveillance cameras must be strictly limited to the perimeter of the property to be protected and must in no case film the interior of dwellings, even through a window, nor excessively film public roads.
• Providing data subjects with visible and complete information signage is a prior and distinct obligation from having a legal basis; bringing it into compliance afterwards does not avoid sanction.
• In a rental relationship, if consent is the chosen legal basis for video surveillance, it must be obtained explicitly and demonstrably, and cannot be presumed merely from the signing of the rental contract.