Grúas Barea, S.L.U. – Complaint Upheld (Spain, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Spain's data protection authority found that Grúas Barea's security cameras were recording more than necessary, including public areas. The cameras were supposed to ensure safety but captured areas beyond the property. The company cooperated and removed the cameras, avoiding a fine but setting a clear example of data minimization requirements.
What happened
Grúas Barea installed security cameras that recorded areas beyond their property, including public spaces.
Who was affected
People in the vicinity of Grúas Barea's property, including those on the sidewalk and nearby road.
What the authority found
The AEPD found that the video surveillance system violated GDPR's data minimization principle by recording unnecessary areas.
Why this matters
This case underscores the importance of ensuring that surveillance systems only capture necessary footage. Businesses should regularly review their security measures to comply with data protection laws and avoid capturing excessive data.
GDPR Articles Cited
The decision is the consequence of a complaint submitted by a Spanish citizen stating that the defendant has installed a video surveillance system allegedly pointing to a parking area without the consent of the owner of such area. The complaint included pictures proving that the video surveillance system was installed. The claimant was the landlord of the defendant. The defendant answered to the AEPD investigation requests stating that: (i) it has installed the corresponding information poster, (ii) it has installed six cameras in order to ensure the safety of its establishment, (iii) the cameras pointing to the parking are only recording heavy equipment, and, considering that the property is leased and that the defendant and the claimant do not have a good relationship, the defendant understands that this complaint is a pressure measure by the lessor, and (iv) the defendant is planning to leave the property before May 2020. The AEPD started the corresponding sanction procedure; after that, the defendant submitted the corresponding pleadings document, in which it declared that it has left the property and uninstalled all the cameras, attaching pictures of the same as a proof. As a result of its investigation, the AEPD considered that the claimant had a video surveillance system with an excessive orientation to an area out of its property, and without due cause: two of the six cameras were directly recording not only the entrance, but also the sidewalk and nearby road; in order to ensure the safety of the establishment it was not necessary to record such a big area. Thus, the AEPD understood that the video surveillance system infringed the data minimisation principle (Article 5(1)(c) GDPR) and, after considering certain factors [(i) the defendant has collaborated with the AEPD, (ii) there is no intentionality by the defendant, and (ii) the video surveillance system has been uninstalled and the property has been left by the defendant, but (iii) in the end, the
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Grúas Barea, S.L.U. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Grúas Barea, S.L.U. - Spain (2020). Retrieved from cookiefines.eu
Last updated: