BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. – €4,000 Fine (Spain, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. was fined for using audio recording in the workplace without following proper rules. This matters because it highlights the need for companies to respect employees' privacy while monitoring for security.
What happened
BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. was fined for violating the data minimization principle by continuously recording audio in the workplace.
Who was affected
Employees working at BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. were affected by the audio recordings.
What the authority found
The Spanish authority found that the company's audio recording practices were intrusive and did not comply with GDPR's data minimization principle.
Why this matters
This case underscores the importance of balancing security measures with employee privacy. Companies should carefully consider how they monitor employees to avoid privacy violations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
On 22 April 2025, a data subject lodged a complaint with the DPA against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., the controller. The data subject claimed that the controller had installed cameras recording both images and audio in workplace areas and had relied on the recordings in disciplinary proceedings against them. The controller confirmed that its video surveillance system, installed in 2019, consisted of seven cameras and was capable of recording both images and sound. Recordings were stored for seven days and could be accessed by the controller's security manager. The controller stated that the system pursued both security and employee-monitoring purposes. The controller argued that audio recording was necessary because of a previous burglary and because of the data subject's alleged inappropriate behaviour towards colleagues and management. According to the controller, the audio recordings had been used to substantiate the disciplinary proceedings. The DPA found that the continuous recording of workplace audio violated the data minimisation principle under Article 5(1)(c) GDPR. It considered audio recording particularly intrusive because it could capture private conversations and interfere with the workers' private sphere. The existence of information signs did not make such processing proportionate. The DPA rejected the controller's justification that audio recording was necessary for security and disciplinary purposes. In relation to the employee's conduct, the DPA considered that less intrusive evidence, such as statements from colleagues or supervisors, could have been used. Similarly, the previous burglary did not justify permanent audio recording, since video images alone could have been sufficient to establish the relevant facts. Therefore, the measure was neither necessary nor proportionate to the purposes pursued. The DPA also referred to [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Article 89(3) LOPDGDD], under which workplace audio re
Related Enforcement Actions (0)
No other enforcement actions found for BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
22 April 2025
Authority
Agencia Española de Protección de Datos
Fine Amount
€4,000
GDPRhub ID
gdprhub-10222About this data
Cite as: Cookie Fines. BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. - Spain (2025). Retrieved from cookiefines.eu
Last updated: