Enforcement · AEPD ·PS-00637-2025 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

The AEPD fined an employer €4,000 for continuously recording workplace audio through CCTV

The measure was disproportionate and violated the data minimisation principle under Article 5(1)(c) GDPR.

€4,000 Fine
Spain
Video Surveillance Monitoring Supervisory Authorities Video Surveillance Retention Period Controllers Personal Data
Aug 26, 2026 Source

How it connects

Related across sources

Case Law VG Berlin - 42 K 51.25 Administrative Court Berlin Case Law VG Berlin - 42 K 73/25 Administrative Court Berlin Guidance Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED EDPB Case Law Court of Justice of the European Union - Case C-422/24 - AB Storstockholms Lokaltrafik. CJEU Guidance Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB

Full text

The AEPD fined an employer €4,000 for continuously recording workplace audio through CCTV. The measure was disproportionate and violated the data minimisation principle under Article 5(1)(c) GDPR. English Summary. Facts. On 22 April 2025, a data subject lodged a complaint with the Spanish Data Protection Authority (AEPD) against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., the controller. The data subject claimed that the controller had installed cameras recording both images and audio in workplace areas and had relied on the recordings in disciplinary proceedings against them. The controller confirmed that its video surveillance system, installed in 2019, consisted of seven cameras and was capable of recording both images and sound. Recordings were stored for seven days and could be accessed by the controller's security manager. The controller stated that the system pursued both security and employee-monitoring purposes. The controller argued that audio recording was necessary because

Original document at the source gdprhub.eu
Related documents