[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc19n_4FkXcJs6KUrFfbCkbC0jXIMohp2NzHCJTVVR-w":3},{"tableOfContents":4,"markDownContent":5,"htmlContent":6,"metaTitle":7,"metaDescription":7,"wordCount":8,"readTime":9,"title":10,"nbDownloads":11,"excerpt":7,"lang":12,"url":13,"intro":14,"featured":4,"state":15,"author":16,"authorId":17,"datePublication":21,"dateCreation":22,"dateUpdate":23,"mainCategory":24,"categories":39,"metaDatas":45,"imageUrl":53,"imageThumbUrls":54,"id":62},false,"The Spanish data protection authority has sanctioned **a video surveillance system company** for violating Articles 6 and 13 of the General Data Protection Regulation (GDPR).\r\n\r\nThe organization had installed a sign informing of the installation of a video surveillance system. However, \u003Cu>the sign did not indicate the identity of the controller\u003C/u>. Moreover, according to the document labeled \"Employee Confidentiality Undertaking\", provided by the company for signature by its employees, \u003Cu>the collection only concerned the viewing of the worker's image\u003C/u>, which was not the case in practice.\r\n\r\n## The possibility of setting up a video surveillance system\r\n\r\nThe physical image and voice of a person, as defined in Article 4.1 of the GDPR, are personal data. **Images and voice captured by a camera or video camera system are indeed personal data**: their processing is therefore subject to the Data Protection Act.\r\n\r\nNatural or legal persons, public or private, \u003Cu>may set up a video surveillance system for the purpose of preserving the security of persons and property\u003C/u>, as well as their facilities, in accordance with Article 6.1 of the GDPR. However, cameras and cameras installed for security purposes may not obtain images of the public highway, unless it is essential for this purpose or it is impossible to avoid it due to the location of the cameras. And, in such an extraordinary case, **cameras may only capture the minimum amount necessary** to preserve the safety of persons and property, as well as their facilities.\r\n\r\n## The obligation to inform data subjects\r\n\r\nArticle 12.1 of the GDPR states that **anyone who carries out processing of personal data**, such as the capture of images by a video surveillance system, **must provide data subjects with the information specified** in Articles 13 and 14 of the GDPR.\r\n\r\nThe basis of the necessary information must at least refer to the existence of the processing (video surveillance), the \u003Cu>identity of the controller\u003C/u>, the possibility to exercise the rights provided for in Articles 15 to 22 of the GDPR, and where to obtain further information about the processing of personal data.\r\n\r\nIn addition, the Spanish data protection authority found that **the company had not provided sufficient information about the video surveillance**, including information about the processing, the identity of the controller and the exercise of data subjects' rights.\r\n\r\nMoreover, there is no evidence in the proceedings that the controller informed customers and employees of the collection of their personal data \u003Cu>involving the voice of the data subjects\u003C/u>.","\u003Cp>The Spanish data protection authority has sanctioned \u003Cstrong>a video surveillance system company\u003C/strong> for violating Articles 6 and 13 of the General Data Protection Regulation (GDPR).\u003C/p>\r\n\u003Cp>The organization had installed a sign informing of the installation of a video surveillance system. However, \u003Cu>the sign did not indicate the identity of the controller\u003C/u>. Moreover, according to the document labeled \"Employee Confidentiality Undertaking\", provided by the company for signature by its employees, \u003Cu>the collection only concerned the viewing of the worker's image\u003C/u>, which was not the case in practice.\u003C/p>\r\n\u003Ch2 id=\"the-possibility-of-setting-up-a-video-surveillance-system\">The possibility of setting up a video surveillance system\u003C/h2>\r\n\u003Cp>The physical image and voice of a person, as defined in Article 4.1 of the GDPR, are personal data. \u003Cstrong>Images and voice captured by a camera or video camera system are indeed personal data\u003C/strong>: their processing is therefore subject to the Data Protection Act.\u003C/p>\r\n\u003Cp>Natural or legal persons, public or private, \u003Cu>may set up a video surveillance system for the purpose of preserving the security of persons and property\u003C/u>, as well as their facilities, in accordance with Article 6.1 of the GDPR. However, cameras and cameras installed for security purposes may not obtain images of the public highway, unless it is essential for this purpose or it is impossible to avoid it due to the location of the cameras. And, in such an extraordinary case, \u003Cstrong>cameras may only capture the minimum amount necessary\u003C/strong> to preserve the safety of persons and property, as well as their facilities.\u003C/p>\r\n\u003Ch2 id=\"the-obligation-to-inform-data-subjects\">The obligation to inform data subjects\u003C/h2>\r\n\u003Cp>Article 12.1 of the GDPR states that \u003Cstrong>anyone who carries out processing of personal data\u003C/strong>, such as the capture of images by a video surveillance system, \u003Cstrong>must provide data subjects with the information specified\u003C/strong> in Articles 13 and 14 of the GDPR.\u003C/p>\r\n\u003Cp>The basis of the necessary information must at least refer to the existence of the processing (video surveillance), the \u003Cu>identity of the controller\u003C/u>, the possibility to exercise the rights provided for in Articles 15 to 22 of the GDPR, and where to obtain further information about the processing of personal data.\u003C/p>\r\n\u003Cp>In addition, the Spanish data protection authority found that \u003Cstrong>the company had not provided sufficient information about the video surveillance\u003C/strong>, including information about the processing, the identity of the controller and the exercise of data subjects' rights.\u003C/p>\r\n\u003Cp>Moreover, there is no evidence in the proceedings that the controller informed customers and employees of the collection of their personal data \u003Cu>involving the voice of the data subjects\u003C/u>.\u003C/p>\r\n",null,420,2,"[SPAIN] Sanction of a company of video surveillance systems",0,"en","spain-sanction-of-a-company-of-video-surveillance-systems","The Spanish data protection authority has sanctioned a video surveillance system company for violating Articles 6 and 13 of the General Data Protection Regulation (GDPR). ","Published",{"id":17,"displayName":18,"avatarUrl":19,"bio":7,"blogUrl":7,"color":7,"userId":17,"creationDate":20},2986,"Maëva Vidal","https://static.dastra.eu/tenant-3/avatar/2986/maeva-min-min-min-150.png","2022-09-05T13:22:36","2022-12-13T09:00:00","2022-12-12T17:03:57.4883913","2022-12-13T09:32:11.0345052",{"id":9,"name":25,"description":26,"url":27,"color":28,"parentId":7,"count":7,"imageUrl":7,"parent":7,"order":11,"translations":29},"Blog","A list of curated articles provided by the community","blog","#28449a",[30,33,36],{"lang":31,"name":25,"description":32},"fr","Une liste d'articles rédigés par la communauté",{"lang":34,"name":25,"description":35},"es","Una lista de artículos escritos por la comunidad",{"lang":37,"name":25,"description":38},"de","Eine Liste von Artikeln, die von der Community verfasst wurden",[40],{"id":9,"name":25,"description":26,"url":27,"color":28,"parentId":7,"count":7,"imageUrl":7,"parent":7,"order":11,"translations":41},[42,43,44],{"lang":31,"name":25,"description":32},{"lang":34,"name":25,"description":35},{"lang":37,"name":25,"description":38},[46,49],{"typeMetaDataId":9,"value":47,"id":48},"https://www.dastra.eu/en/audit/referential/b7fde3de-99e2-4e62-17f3-08da42104674",106015,{"typeMetaDataId":50,"value":51,"id":52},3,"Find our Privacy Impact Analysis template",106016,"https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-1000.jpg",[55,56,57,58,59,60,61],"https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-1000.webp","https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280.webp","https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-1500.webp","https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-800.webp","https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-600.webp","https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-300.webp","https://static.dastra.eu/content/179e9390-125b-469d-97df-83567e6b160a/concrete-25627811280-100.webp",53322]