GRUPO TRANSAHER, S.L. – €50,000 Fine (Spain, 2023)

In June 2022, the data subject filed a complaint with the Spanish DPA, claiming that GRUPO TRANSAHER, the controller, had installed surveillance cameras in workers' rest areas such as the canteen. The data subject also claimed that the informative notice regarding the cameras was not visible or did not exist. In July 2022, the controller replied to the complaint, admitting the installation of the cameras and providing more detailed information about them. First, the controller argued that it has a logistics park where a large number of people circulate and therefore it is necessary to ensure a high level of security, monitoring and protecting property and people in the building. For this reason, the controller considered that it was legitimate to video-surveil the entire work center, including the industrial building and the offices. Second, with regard to the workers' rest area, it argued that it is actually a common area open 24 hours and is not intended for the exclusive rest of the workers. According to the controller, the room does not have restricted access for the exclusive use of employees, also being used by clients, customers, suppliers and freelancers. Third, the controller pointed out that it performed a proportionality test and implemented mitigating measures such as providing informative notices, deleting the recordings after 30 days and limiting the access to the images to only 5 persons. Finally, the controller stated that in the employment contract there is a clause informing employees about the use of video surveillance systems for security purposes. The Spanish DPA found that the use of surveillance cameras in an enclosed room, used as a canteen, was disproportionately invading the employee's privacy. The DPA highlighted that while [https://www.boe.es/buscar/act.php?id=BOE-A-2015-11430 Article 20.3 Workers' Statute Law] allows the use of videocameras for labor control, this control must respect some limitations, such as the worker's dignity.