Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Private Individual: Non-compliance with general data processing principles

€3,000 Fine
Private Individual
SPAIN
Art. 5 GDPR Art. 13 GDPR
Audit Logs IP Address Controllers Monitoring Processing Agreement Processing Security Data Controller
Apr 15, 2021 Source

How it connects

Related across sources

Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin CJEU Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Case Law Data Protection Commissioner v Facebook Ireland and Maximillian Schrems CJEU

Full text

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a private individual. The controller resides on the 1st floor of an apartment building, where he is the owner of apartments on the 2nd and 3rd floors. He regularly rents out these apartments to tourists. The controller had installed four video cameras on the three floors and in the entrance area of the building. He justified their operation with security concerns related to the rental to tourists. The owners' association had not granted permission for the operation of the cameras. Also, the controller did not put up a sign in the building informing about the operation of the camera. The DPA found this to be a violation of the principle of data minimization, as the cameras covered areas of the building used by the community, whose monitoring was not necessary for the protection of the controller's property. Furthermore, the controller violated its obligation to provide information, as he failed to inform the other residents of the building about the processing of their data.

Industry: Individuals and Private Associations

Original document at the source www.aepd.es

Similar Content