The Spanish Data Protection Authority (AEPD) issued a warning to an individual whose video surveillance system, although primarily aimed at their property, minimally captured part of the outside space. This decision highlights the strict application of the data minimization principle, requiring the reorientation or masking of the camera even for marginal capture of third-party spaces.

Facts and context

The Spanish Data Protection Authority (AEPD) published a decision issuing a warning against an individual for breaches related to the installation of a video surveillance system capturing spaces outside their property.

The case originated from a complaint filed by an individual on April 27, 2025, denouncing that their neighbor's surveillance cameras captured the public road as well as their property, including their minor daughter in the swimming pool.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority found that one of the two cameras installed by the individual, although mainly intended to monitor their property, also captured an outside space. Based on a photograph provided by the individual for their defense, the authority judged that even if the encroachment was minimal, it constituted a violation of the minimization principle. It recalled that private video surveillance must be strictly limited to the boundaries of the property and that any capture of public spaces or third-party properties is disproportionate, as the security of public spaces falls under the exclusive competence of law enforcement.

Authority's decision

Consequently, the authority issued a warning to A.A.A.

Furthermore, the authority ordered the individual, within 15 days, to reorient or mask the disputed camera so that it no longer captures any space outside their property, and to provide dated and timestamped photographic evidence of this compliance.

Lessons learned

This decision reminds that:

• The data minimization principle in private video surveillance is interpreted strictly: even marginal and unintentional capture of public roads or third-party property constitutes a breach.
• The burden of proof of compliance lies with the data controller, who must ensure that the camera's field of view is strictly limited to their private space.
• Technical measures such as precise reorientation or the use of privacy masks are appropriate and necessary solutions to ensure the compliance of a video surveillance system when the field of view might exceed property boundaries.