RECAMBIOS VILLALEGRE S.L. – €12,000 Fine (Spain, 2020)

On 23 July 2020, a citizen reported to the AEPD a harassment campaign that the company RECAMBIOS VILLALEGRE S.L. carried out through Facebook and WhatsApp against a homeless person who, according to the company, had stolen money from the office cash register. The aforementioned company used images collected with security cameras that recorded the street pavement, without having an informative poster on the premises that mentioned the use of these cameras. The same complainant presented another letter on July 25, 2020 to the AEPD informing that several newspapers had reported the alleged theft, that a quick trial had been held and that the indigent person had been acquitted for lack of evidence, since none of the published images could prove that the person had taken money from the offices. Once again, the company published images of the person on Facebook with the aim of negatively affecting their reputation. Is the recording of personal images (without a notice board) and their subsequent publication on social networks (Facebook and WhatsApp) an infringement of Articles 6 and 13 GDPR? The AEPD decided to impose, for infringement of Article 6 GDPR, a fine of € 10000 and, for infringement of Article 13 GDPR, a fine of € 2000. In addition, the company was required, within one month, to remove the Facebook posting and the comments affecting the homeless person who was harassed, to put up an information poster of the recording of images with video surveillance cameras, and to have the information for those affected required by the GDPR.