AEPD (Spain) - PS-00159-2025

Summary

Spain's AEPD has fined ACVIL Aparcamientos S.L.U. €90,000 for violating GDPR. The car park operator failed to respond to a data subject's access request for video surveillance footage within the legally mandated timeframe and deleted the footage despite a request to preserve it for legal proceedings.

Full text

Help AEPD (Spain) - PS-00159-2025: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 08:38, 21 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators208 edits Tag: submission [1.0] (No difference) Latest revision as of 08:38, 21 July 2026 AEPD - PS-00159-2025 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 14 GDPR Article 15 GDPR Article 22(3) Spanish Data Protection Act (LOPDGDD)Article 24(1) Spanish Constitution (CE) Type: Complaint Outcome: Upheld Started: 13.12.2024 Decided: Published: 09.06.2026 Fine: 90,000 EUR Parties: ACVIL Aparcamientos S.L.U. National Case Number/Name: PS-00159-2025 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA fined a car park operator €90,000 for responding late to an access request and deleting video surveillance footage despite a request to preserve it for legal proceedings. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 13 December 2024, the DPA received a complaint against ACVIL Aparcamientos, S.L.U., the controller, concerning a request for video surveillance footage from a car park. The data subject’s vehicle had allegedly been damaged while parked in a facility operated by the controller. On 23 February 2024, the data subject’s legal representative requested access to the footage recorded between 12 and 19 February 2024. The request sought the images showing the collision or, alternatively, the licence plate of the vehicle responsible. The data subject also expressly requested that the controller preserve the relevant footage because it was required for the establishment, exercise or defence of legal claims. The controller acknowledged receipt of the request but did not provide a substantive response until 4 April 2024, after the one-month period under the GDPR had expired. It stated that the footage could only be disclosed to the police or a judge and instructed the data subject to file a police report. After the data subject challenged that requirement and reiterated both the access and preservation requests, the controller responded that it would not provide the recordings and that the footage had already been deleted. During the proceedings, the controller argued that the request was excessive because it covered footage from 16 cameras over several days, amounting to approximately 3,072 hours of recordings. It also maintained that the footage contained personal data relating to numerous third parties and that it was not established that the damage had occurred inside the car park. The controller acknowledged, however, that it had not explained these considerations to the data subject, asked the data subject to narrow the request or notified an extension of the response period. Holding The DPA held that the controller infringed Articles 15 and 18 GDPR. Regarding Article 15 GDPR, the DPA found that the controller failed to respond to the access request within the one-month period required under Article 12(3) GDPR. Although the controller considered the request complex and excessive, it neither informed the data subject of an extension within the initial one-month period nor explained why it considered the request excessive. The DPA noted that the controller could have asked the data subject to provide additional information to narrow the search. It could also have reviewed the recordings and provided only the footage necessary for the specific incident, applying measures such as blurring or limiting the disclosed extract to protect third parties. The DPA rejected the controller’s position that the footage could only be provided following a request from the police or a court. The exercise of the right of access was not conditional on the prior filing of a police report. The controller was required to assess the request under the GDPR and provide a reasoned and timely response. The failure to respond in time resulted in the deletion of the requested footage. Consequently, the data subject was prevented from obtaining information that could have been relevant to identifying the person responsible for the damage and pursuing a legal claim. Regarding Article 18 GDPR, the DPA held that the data subject had expressly requested the preservation of the recordings for the establishment, exercise or defence of legal claims. Under Article 18(1)(c) GDPR, processing must be restricted where the controller no longer needs the data for its original purposes but the data subject requires it for legal claims. The controller did not address this request and deleted the footage under its ordinary retention schedule. The DPA considered that Article 22(3) Spanish Data Protection Act (LOPDGDD), which generally requires video surveillance images to be erased within one month, did not justify disregarding a valid restriction request. Once the data subject requested preservation for potential legal proceedings, the controller was required to retain the relevant images rather than erase them. The DPA also linked the preservation of the evidence to the data subject’s right to effective judicial protection under Article 24(1) of the Spanish Constitution. Deleting the footage made it more difficult for the data subject to identify the responsible party and exercise their rights before a court. The DPA initially imposed two fines of €75,000: one for the infringement of Article 15 GDPR and one for the infringement of Article 18 GDPR, amounting to €150,000 in total. The controller acknowledged liability and voluntarily paid the fine. Under Article 85 of Spanish Administrative (Law 39/2015), it received a 20% reduction for acknowledging liability and a further 20% reduction for voluntary payment. Consequently, the initial fine of €150,000 was reduced by 40% to a final amount of €90,000. The DPA also ordered the controller to adopt the compliance measures specified in the decision initiating the proceedings and to report their implementation to the DPA within three months after the decision became final and enforceable. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. File No.: EXP202500616 RESOLUTION TERMINATING THE PROCEEDINGS DUE TO ACKNOWLEDGMENT OF LIABILITY AND VOLUNTARY PAYMENT From the proceedings initiated by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On March 2, 2026, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against ACVIL APARCAMIENTOS, S.L.U. (hereinafter, ACVIL), by means of the agreement transcribed below: << File No.: EXP202500616 AGREEMENT TO INITIATE SANCTIONING PROCEEDINGS From the actions carried out by the Spanish Data Protection Agency and based on the following FACTS FIRST: On December 13, In 2024, a complaint was filed with the Spanish Data Protection Agency (AEPD) regarding a possible infringement attributable to ACVIL APARCAMIENTOS, S.L.U., with Tax Identification Number (NIF) B73454134 (hereinafter, ACVIL or the respondent). The facts brought to the attention of this authority are as follows: The complainant states that, following an incident involving their vehicle while parked in a garage managed by the respondent, they requested access to the garage's video surveillance system footage via email on February 23, 2024, in order to obtain the recording of the incident affecting their vehicle. He states that he received a response on April 4, 2024, outside the deadline established for this purpose by data protection regulations, denying his requested access and urging him to file a complaint with a

Entities