The Spanish data protection authority sanctioned a company for installing an excessive video surveillance system, filming the workstation, computer screen, and an employee's changing rooms without prior information, highlighting a violation of the principles of data minimization and transparency.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against UNEI INICIATIVA SOCIAL S.L. (including the imposition of a €2,400 fine) for breaches related to the installation of a video surveillance system at the workplace.

The case originated from a complaint filed by an employee on April 11, 2025, denouncing the installation of cameras filming her workstation, computer screen, as well as the changing rooms and lockers, without prior information.

Grounds for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority considered that capturing images of the employee's computer screen, personal work area, as well as lockers and changing areas, was excessive in relation to the purpose of protecting the premises. This data processing was not limited to what is strictly necessary, thus causing a disproportionate infringement of the employee's privacy and violating the minimization principle.
• Transparency and information obligation (Article 13 of the GDPR): The company did not demonstrate having informed workers about the presence of cameras and the purposes of the processing. By asserting that information signs were unnecessary, the company failed its fundamental obligation to inform data subjects about the processing of their personal data, constituting a direct violation of the GDPR's transparency requirements.

Authority's decision

Consequently, the authority imposed a €2,400 fine on UNEI INICIATIVA SOCIAL S.L. This amount results from a 40% reduction on the initial €4,000 fine, applied following the company's acknowledgment of responsibility and voluntary payment.

Furthermore, the authority ordered the company to redirect, within one month, the angle of the camera filming the employee's screen and to document the corrective measures implemented in the locker area.

Lessons learned

This decision confirms / specifies / recalls that:

• Prior information to data subjects, notably employees, about the implementation of a video surveillance system is a fundamental and non-negotiable obligation.
• The installation of cameras in the workplace must strictly respect the minimization principle, ensuring that the field of view is strictly limited to the pursued purpose, such as property security, and is not excessively intrusive.
• The positioning of cameras continuously filming an employee's computer screen or private life areas such as changing rooms or lockers is considered a disproportionate infringement of privacy and a violation of the minimization principle.
• Acknowledgment of responsibility and voluntary payment of the fine may allow benefiting from significant reductions in the sanction amount, as provided by Spanish procedures.