AEPD · PS-00159-2025
On 13 December 2024, the DPA received a complaint against ACVIL Aparcamientos, S.L.U., the controller, concerning a request for video surveillance footage from a car park.
Status Not cited by any decision here yet
Holding
The DPA held that the controller infringed Articles 15 and 18 GDPR. Regarding Article 15 GDPR, the DPA found that the controller failed to respond to the access request within the one-month period required under Article 12(3) GDPR. Although the controller considered the request complex and excessive, it neither informed the data subject of an extension within the initial one-month period nor explained why it considered the request excessive. The DPA noted that the controller could have asked the data subject to provide additional information to narrow the search. It could also have reviewed the recordings and provided only the footage necessary for the specific incident, applying measures such as blurring or limiting the disclosed extract to protect third parties. The DPA rejected the controller’s position that the footage could only be provided following a request from the police or a court. The exercise of the right of access was not conditional on the prior filing of a police report. The controller was required to assess the request under the GDPR and provide a reasoned and timely response. The failure to respond in time resulted in the deletion of the requested footage. Consequently, the data subject was prevented from obtaining information that could have been relevant to identifying the person responsible for the damage and pursuing a legal claim. Regarding Article 18 GDPR, the DPA held that the data subject had expressly requested the preservation of the recordings for the establishment, exercise or defence of legal claims. Under Article 18(1)(c) GDPR, processing must be restricted where the controller no longer needs the data for its original purposes but the data subject requires it for legal claims. The controller did not address this request and deleted the footage under its ordinary retention schedule. The DPA considered that Article 22(3) Spanish Data Protection Act (LOPDGDD), which generally requires video surveillance images to be erased within one month, did not justify disregarding a valid restriction request. Once the data subject requested preservation for potential legal proceedings, the controller was required to retain the relevant images rather than erase them. The DPA also linked the preservation of the evidence to the data subject’s right to effective judicial protection under Article 24(1) of the Spanish Constitution. Deleting the footage made it more difficult for the data subject to identify the responsible party and exercise their rights before a court. The DPA initially imposed two fines of €75,000: one for the infringement of Article 15 GDPR and one for the infringement of Article 18 GDPR, amounting to €150,000 in total. The controller acknowledged liability and voluntarily paid the fine. Under Article 85 of Spanish Administrative (Law 39/2015), it received a 20% reduction for acknowledging liability and a further 20% reduction for voluntary payment. Consequently, the initial fine of €150,000 was reduced by 40% to a final amount of €90,000. The DPA also ordered the controller to adopt the compliance measures specified in the decision initiating the proceedings and to report their implementation to the DPA within three months after the decision became final and enforceable.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
The data subject’s vehicle had allegedly been damaged while parked in a facility operated by the controller. On 23 February 2024, the data subject’s legal representative requested access to the footage recorded between 12 and 19 February 2024. The request sought the images showing the collision or, alternatively, the licence plate of the vehicle responsible. The data subject also expressly requested that the controller preserve the relevant footage because it was required for the establishment, exercise or defence of legal claims. The controller acknowledged receipt of the request but did not provide a substantive response until 4 April 2024, after the one-month period under the GDPR had expired. It stated that the footage could only be disclosed to the police or a judge and instructed the data subject to file a police report. After the data subject challenged that requirement and reiterated both the access and preservation requests, the controller responded that it would not provide the recordings and that the footage had already been deleted. During the proceedings, the controller argued that the request was excessive because it covered footage from 16 cameras over several days, amounting to approximately 3,072 hours of recordings. It also maintained that the footage contained personal data relating to numerous third parties and that it was not established that the damage had occurred inside the car park. The controller acknowledged, however, that it had not explained these considerations to the data subject, asked the data subject to narrow the request or notified an extension of the response period.
Full text 3 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
File No.: EXP202500616 RESOLUTION TERMINATING THE PROCEEDINGS DUE TO ACKNOWLEDGMENT OF LIABILITY AND VOLUNTARY PAYMENT From the proceedings initiated by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On March 2, 2026, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against ACVIL APARCAMIENTOS, S.L.U. (hereinafter, ACVIL), by means of the agreement transcribed below: > SECOND: On March 17, 2026, ACVIL paid the fine in the amount of €90,000.00, taking advantage of the two reductions provided for in the initial agreement transcribed above, which implies acknowledgment of responsibility in relation to the facts referred to in the initial agreement and their legal classification. THIRD: The initial agreement transcribed above indicated that, should the infringement be confirmed, the controller could be ordered to adopt appropriate measures to bring its actions into compliance with the regulations mentioned in this act, in accordance with Article 58.2(d) of the GDPR, which states that each supervisory authority may "require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time frame...". Having acknowledged responsibility for the infringement, the measures included in the initial agreement should be imposed. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 29/31 LEGAL BASIS I Jurisdiction In accordance with the powers conferred upon each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures." II Termination of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading “Termination of Sanctioning Procedures,” provides the following: “1. Once a sanctioning procedure has been initiated, if the offender acknowledges their responsibility, the procedure may be resolved by imposing the appropriate sanction.
When the sanction is solely monetary, or when a monetary sanction and a non-monetary sanction are applicable but the impropriety of the latter has been justified, voluntary payment by the alleged offender, at any time prior to the resolution, will imply the termination of the procedure, except with regard to restoring the altered situation or determining compensation for the damages caused by the commission of the infraction.
In In both cases, when the sanction is solely monetary, the competent body for resolving the proceedings will apply reductions of at least 20% to the proposed sanction amount. These reductions are cumulative. These reductions must be specified in the notification initiating the proceedings, and their application is conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. The percentage reduction provided for in this section may be increased by regulation. III Voluntary Payment and Acknowledgment of Responsibility C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 30/31 In accordance with the provisions of Article 85 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), the notified initiation agreement informed the parties of the possibility of acknowledging responsibility and making voluntary payment of the proposed penalty, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the penalty would be set at €90,000.00, and its payment would result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following notification of the aforementioned initiation agreement, ACVIL has proceeded to acknowledge responsibility and make voluntary payment of the penalty, taking advantage of the two reductions provided for. In accordance with paragraph 3 of Article 85 of the LPACAP, the effectiveness of The aforementioned reductions will be conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. It should be noted that, in accordance with the provisions of the LPACAP (Law on Administrative Procedure of Public Administrations), as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Likewise, Article 88 of the aforementioned law establishes that the resolution that concludes the proceedings will decide all issues raised by the interested parties and any other issues arising therefrom. Therefore, in accordance with the applicable legislation and having assessed the criteria for determining the severity of the sanctions, the Presidency of the Spanish Data Protection Agency resolves: FIRST: To declare the commission of the infringements and to confirm the sanctions determined in the operative part of the initial agreement transcribed in This resolution. The sum of the aforementioned amounts totals €150,000.00. Following ACVIL APARCAMIENTOS, S.L.U.'s prompt payment and acknowledgment of liability, pursuant to Article 85 of the LPACAP (Law on Administrative Procedure), the aforementioned total is reduced by 40%, resulting in a final amount of €90,000.00. The effectiveness of these reductions is conditional, in any case, on withdrawal or waiver of any action or appeal through administrative channels. SECOND: DECLARE the termination of procedure EXP202500616, in accordance with the provisions of Article 85 of the LPACAP. THIRD: ORDER ACVIL APARCAMIENTOS, S.L.U. to, within 3 months from the date this resolution becomes final and enforceable, Notify the Agency of the adoption of the measures described in the legal grounds of the initiation agreement transcribed in this resolution. FOURTH: NOTIFY ACVIL APARCAMIENTOS, S.L.U. of this resolution. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 31/31 FIFTH: In accordance with the provisions of Article 85 of the LPACAP, which conditions the reduction for voluntary payment and acknowledgment of liability on the withdrawal or waiver of any action or appeal through administrative channels, this resolution will be final through administrative channels and fully enforceable upon its notification. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public. Publication will take place once the resolution has been notified to the interested parties. Against this resolution, which concludes the administrative process as stipulated Pursuant to Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an administrative appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law. However, in accordance with the provisions of Article 90.3.a) of the LPACAP, the final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. In this case, the interested party must formally notify the Spanish Data Protection Agency in writing, submitting it through the Agency's Electronic Registry , or through any of the other registries provided for in Article 16.4 of Law 39/2015, of October 1 They must also provide the Agency with documentation proving the effective filing of the administrative appeal. If the Agency does not receive notification of the filing of the administrative appeal within two months from the day following notification of this resolution, the precautionary suspension will be terminated. 1259-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es