DPA case PS/00120/2020 – Complaint Upheld (Spain, 2020)

The decision is the consequence of a complaint filed by a Spanish citizen (the claimant) stating that at her workplace (nursery school) there are cameras inside the rooms recording the children. Their parents/tutors get access to those cameras through an App provided by the School, so they can observe, listen, record and take pictures of the children. The school provides all of the parents/tutors with a password (same password for everyone) and they can watch through this App any of the children inside of the rooms. According to the claimant, she has never given her consent regarding the recordings and there are not any signs in place warning about the rooms being a video-recorded zone. The work contrat between the nursery school and the claimant states the existence of the cameras but does not specify which is the purpose of the recording, and therefore, of the data processing. Are the requirements of the Article 13 GDPR satisfied in that case? The AEDP held, that the contractual clause in the work contract informing about the existence of cameras does not specify neither the purpose of the processing, nor where are being storaged the images of the claimant. Therefore, the AEPD has imposed a warning to the nursery school, requiring them to add a specific clause in the upcoming work contracts, by which all of the requirements of the Article 13 GDPR are satisfied. Furthermore, the AEPD has also recommended setting up an individual password for each of the parents/tutors.