BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. – €4,000 Fine (Spain, 2025)

On 22 April 2025, a data subject lodged a complaint with the DPA against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., the controller. The data subject claimed that the controller had installed cameras recording both images and audio in workplace areas and had relied on the recordings in disciplinary proceedings against them. The controller confirmed that its video surveillance system, installed in 2019, consisted of seven cameras and was capable of recording both images and sound. Recordings were stored for seven days and could be accessed by the controller's security manager. The controller stated that the system pursued both security and employee-monitoring purposes. The controller argued that audio recording was necessary because of a previous burglary and because of the data subject's alleged inappropriate behaviour towards colleagues and management. According to the controller, the audio recordings had been used to substantiate the disciplinary proceedings. The DPA found that the continuous recording of workplace audio violated the data minimisation principle under Article 5(1)(c) GDPR. It considered audio recording particularly intrusive because it could capture private conversations and interfere with the workers' private sphere. The existence of information signs did not make such processing proportionate. The DPA rejected the controller's justification that audio recording was necessary for security and disciplinary purposes. In relation to the employee's conduct, the DPA considered that less intrusive evidence, such as statements from colleagues or supervisors, could have been used. Similarly, the previous burglary did not justify permanent audio recording, since video images alone could have been sufficient to establish the relevant facts. Therefore, the measure was neither necessary nor proportionate to the purposes pursued. The DPA also referred to [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Article 89(3) LOPDGDD], under which workplace audio recording is permitted only where risks to the security of installations, assets or persons arising from the activity carried out at the workplace make it necessary, and subject to proportionality and minimum-intervention requirements. The DPA considered that audio recording should be limited to exceptional situations rather than operate permanently. Consequently, the DPA imposed a €4,000 fine for infringement of Article 5(1)(c) GDPR. In addition, it ordered the controller, within one month after the decision became final and enforceable, to disable the audio functionality of the video-surveillance system, where applicable, and adapt its data protection policy accordingly.