A merchant received a warning for filming the public road with a surveillance camera, violating the data minimization principle.

Facts and context

The Spanish data protection authority (AEPD) issued a decision warning a merchant for breaches related to the installation of a video surveillance system.

The case originated from a complaint filed on September 26, 2024, by an individual concerning a camera installed in a fruit shop that filmed not only the entrance of the business but also the public road and passersby.

Reasons for the decision

The authority found a breach by the data controller:

• Data minimization obligation (Article 5, paragraph 1, point c) of the GDPR): The authority found, based on the evidence provided (images and video), that the camera was operational and captured a public space without justification. It recalls that capturing images in public spaces is an exclusive competence of law enforcement. The data processing was therefore excessive compared to the purpose of securing the business. In the absence of a response from the merchant to the authority's requests, the authority relied on a body of evidence, citing the Spanish Supreme Court's case law on circumstantial evidence, and considered the lack of cooperation as an additional indication confirming the materiality of the facts.

Authority's decision

Consequently, the authority issued a warning to A.A.A. for violation of the data minimization principle.

Furthermore, the authority ordered the merchant, under Article 58, paragraph 2, point d) of the GDPR, to remove or redirect the device within one month and to provide dated and timestamped photographic evidence of the new system configuration.

Lessons learned

This decision reminds that:

• Capturing images in public spaces by a private data controller is generally prohibited, this prerogative being reserved for law enforcement.
• A video surveillance system must be configured to capture only images strictly necessary for the pursued purpose, such as monitoring a private access, excluding public areas or neighboring properties.
• The absence of response or cooperation from a data controller during an investigation can be considered as incriminating evidence by the supervisory authority to establish the materiality of the alleged facts.
• Even a dummy camera must be directed towards a private space, as its mere presence can be perceived as intimidating and infringe on the privacy of third parties who believe they are being filmed.