The Spanish authority issued a warning against an individual whose video surveillance system filmed common areas and who had shared a recording, considering this practice contrary to the data minimization principle.

Facts and context

The Spanish Data Protection Agency (AEPD) today published a decision issuing a warning against A.A.A. for breaches related to the installation of a video surveillance system and the dissemination of images.

The case originated from a neighbor's complaint, filed on July 2, 2024, concerning a video surveillance system capturing common areas and the sharing of a recording showing him in a discussion group.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority found that one of the individual's cameras filmed beyond the limits of his private property, capturing common areas of the condominium. It judged that this processing was excessive and disproportionate relative to the security purpose, as any private video surveillance system must be strictly limited to the property of the person installing it. Furthermore, the dissemination of the captured images in a discussion group was considered an abusive use, confirming that the data processing exceeded what was strictly necessary.

Authority's decision

Consequently, the authority issued a warning to A.A.A.

Moreover, the authority ordered the individual to remove or reorient, within 15 working days, the cameras capturing spaces belonging to third parties and to provide dated photographic evidence of this compliance.

Lessons learned

This decision reminds that:

• A video surveillance system installed by an individual must be configured to capture only the strict boundaries of their private property.
• Capturing images of common areas, public roads, or neighboring properties is considered excessive and disproportionate, constituting a violation of the data minimization principle.
• The use of video surveillance recordings for purposes other than security, such as sharing them with third parties without a legal basis, constitutes a purpose limitation breach and unlawful processing.
• The data controller must be able to demonstrate that the installation complies with regulations, particularly regarding the cameras' field of view.