AEPD (Spain) - PS-00637-2025

Summary

The Spanish Data Protection Authority (AEPD) has fined BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. €4,000 for continuously recording workplace audio through CCTV. The AEPD ruled that this practice violated the data minimisation principle under Article 5(1)(c) of the GDPR, deeming it disproportionate and overly intrusive. The company was ordered to disable the audio recording functionality and update its data protection policies.

Full text

Help AEPD (Spain) - PS-00637-2025: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 13:40, 26 August 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators281 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 13:40, 26 August 2026 AEPD - PS-00637-2025 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(c) GDPR Type: Complaint Outcome: Upheld Started: Decided: 22.04.2025 Published: 20.08.2026 Fine: 4000.0 EUR Parties: BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. National Case Number/Name: PS-00637-2025 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The AEPD fined an employer €4,000 for continuously recording workplace audio through CCTV. The measure was disproportionate and violated the data minimisation principle under Article 5(1)(c) GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 22 April 2025, a data subject lodged a complaint with the Spanish Data Protection Authority (AEPD) against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., the controller. The data subject claimed that the controller had installed cameras recording both images and audio in workplace areas and had relied on the recordings in disciplinary proceedings against them. The controller confirmed that its video surveillance system, installed in 2019, consisted of seven cameras and was capable of recording both images and sound. Recordings were stored for seven days and could be accessed by the controller's security manager. The controller stated that the system pursued both security and employee-monitoring purposes. The controller argued that audio recording was necessary because of a previous burglary and because of the data subject's alleged inappropriate behaviour towards colleagues and management. According to the controller, the audio recordings had been used to substantiate the disciplinary proceedings. Holding The DPA found that the continuous recording of workplace audio violated the data minimisation principle under Article 5(1)(c) GDPR. It considered audio recording particularly intrusive because it could capture private conversations and interfere with the workers' private sphere. The existence of information signs did not make such processing proportionate. The DPA rejected the controller's justification that audio recording was necessary for security and disciplinary purposes. In relation to the employee's conduct, the DPA considered that less intrusive evidence, such as statements from colleagues or supervisors, could have been used. Similarly, the previous burglary did not justify permanent audio recording, since video images alone could have been sufficient to establish the relevant facts. Therefore, the measure was neither necessary nor proportionate to the purposes pursued. The DPA also referred to Article 89(3) LOPDGDD, under which workplace audio recording is permitted only where risks to the security of installations, assets or persons arising from the activity carried out at the workplace make it necessary, and subject to proportionality and minimum-intervention requirements. The DPA considered that audio recording should be limited to exceptional situations rather than operate permanently. Consequently, the DPA imposed a €4,000 fine for infringement of Article 5(1)(c) GDPR. In addition, it ordered the controller, within one month after the decision became final and enforceable, to disable the audio functionality of the video-surveillance system, where applicable, and adapt its data protection policy accordingly. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202506417 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On April 22, 2025, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to the entity BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., with Tax ID No. B91843060 (*hereinafter, BCE). The facts brought to the attention of this authority are as follows: The complainant alleges that the respondent company has installed cameras that record audio and movement in work areas without the consent of the employees, and that the footage has been used to justify the initiation of a disciplinary proceeding. Along with the complaint, the claimant submits a statement of defense in response to a CFR, which was served on him on ***DATE.1, notifying him of the initiation of a disciplinary proceeding leading to dismissal. In the SECOND complaint, the claimant points out that the disciplinary proceedings are based on a single piece of evidence: the installation of video surveillance cameras without having provided information or obtained his consent, thereby violating Article 89.1 of the LOPDGDD. SECOND: In accordance with Article 65.4 of Organic Law 3/2018, dated December 5, on data protection and the Guarantee of Digital Rights (hereinafter hereinafter “LOPDGDD”), said complaint was forwarded to BCE so that it could analyze it and inform this Agency, within one month, of the actions taken to comply with the requirements set forth in the data protection regulations. The notification of the referral of the complaint, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was issued on April 24, 2025, as evidenced by the acknowledgment of receipt on file. On May 23, 2025, this Agency received a written response indicating that the party against whom the complaint was filed states that it has a video surveillance system installed contracted through the enterprise ***ENTERPRISE.1 (a copy of the contract is provided). It was installed on March 4, 2019, in common areas (hallways, entrance, and management office). It records both video and audio. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/10 The system consists of seven cameras; five of them are fixed and located in areas at risk of intrusion, and the other two cameras—one in the warehouse and the other in an office facing the street—both record 24 hours a day. There is no monitor; the images are viewed on the mobile phone of the security manager via a User name and password. The recordings are stored for 7 days in encrypted form on a server belonging to the security enterprise, and only the security manager of the defendant has access to them. The system’s operating manual, according to the defendant’s complaint, was communicated to all staff, as it was part of the office’s internal security procedures. The respondent states that there are informational signs regarding both video and audio recording next to the devices, which are accessible to all affected individuals. It provides photographs of the signs, but due to their size, it cannot be verified whether they actually also inform of the existence of audio recording and whether they comply with the requirements of Article 22.4 of the LOPDGDD. It provides photographs of the devices but does not provide images of the field of view of the cameras to verify whether, as the respondent claims, there are no cameras in restrooms, service areas, cafeterias, or employee break rooms. Regarding audio recording, the respondent asserts that it is necessary for two reasons: first, due to external risk, as they suffered a burglary in the year 2023 (they provide a copy of part of the police report); and second, because they had experienced prob

Entities