OLPPD and to Instruction 1/2006 of 8 November of the SDPA on the processing
of personal data with monitoring purposes through cameras or video cameras,
9
and they must meet a series of specific requirements: (1) the worker must be
informed (the worker must be aware that the measure will be adopted and that the
data collected, for example, with the GPS device, may be used to sanction and
dismiss them); (2) the proportionality principle must be applied: the measure will
only be adopted if more appropriate measures cannot be adopted
10 ; (3) the data
must be adequate, pertinent and not excessive with regard to its sphere of action
and the purposes for which they were collected (purposes established in the SWR
and legal purposes allowed by the existing regulations); (4) the right to privacy,
11
the fundamental right to data protection and the right to self-image must be
respected. In the case of the processing of personal data for monitoring purposes
through cameras or video cameras, the data will be cancelled—according to
Instruction 1/2006—within a maximum of 1 month, and only those images that
record an infraction of working obligations or a breach of contract may be stored.
In the field of video surveillance, the CC judgements 29/2013 of 11 February and
39/2016 of 3 March and the Supreme Court judgement of 13 May 2014 (RJ 2014,
3307) are particularly relevant, and they reveal that: (1) the use of these measures to
prove an infraction at work requires that the worker has been previously informed;
(2) failure to warn the worker about the purposes of the working surveillance
associated to the capture of images of the workers could invalidate the evidence in
case of dismissal or any other sanction, because it affects the fundamental rights of
the individual. See also ECHR judgement (third section) of 9 January 2018, in the
case of López Ribalda v. Spain, in which the employer had informed the workers
about the visible cameras, but not about the hidden ones.
Similar conclusions can be reached with regard to geolocation data: the judgements from the Madrid High Court of Justice (hereafter, HCJ) of 21 May, 2014
(AS 2014\823), Madrid HCJ of 29 September, 2014 (AS 2014\2981), Andalusia
HCJ of 19 October, 2017 (JUR 2018\12280),
12 state that if the employer wants to
use GPS devices, they must inform the workers beforehand and warn them about the
purposes of said surveillance, and this control must be strictly limited to the duration
of the working hours.
9 With regard to Instruction 1/2006, the Legal Report 0019/2007 and Legal Report 0212/2007 of the
SDPA specify that the reproduction of images in real time, even if they are not recorded, constitutes
an act of data processing which lies within the scope of application of Instruction 1/2006 and the
OLPPD.
10 The proportionality principle is observed if: (a) the measure is susceptible of achieving its purpose
(judgement of suitability); (b) there is no other more moderate measure that may achieve its purpose
with the same effectiveness (judgement of necessity); (c) the measure is balanced (judgement of
strict proportionality) [e.g. CC judgements 10/2000 of 10 July and 39/2016 of 3 March].
11 Right recognized in Art. 4.2 e) of the SWR.
12 The SDPA had previously issued its Report 193/2008 on the possibility of using GPS systems to
control the activity of workers. The report insists that the file generated must be included in the
General Registry of Data Protection of the SDPA.
Data Protection in the Internet: National Report Spain
379
of personal data with monitoring purposes through cameras or video cameras,
9
and they must meet a series of specific requirements: (1) the worker must be
informed (the worker must be aware that the measure will be adopted and that the
data collected, for example, with the GPS device, may be used to sanction and
dismiss them); (2) the proportionality principle must be applied: the measure will
only be adopted if more appropriate measures cannot be adopted
10 ; (3) the data
must be adequate, pertinent and not excessive with regard to its sphere of action
and the purposes for which they were collected (purposes established in the SWR
and legal purposes allowed by the existing regulations); (4) the right to privacy,
11
the fundamental right to data protection and the right to self-image must be
respected. In the case of the processing of personal data for monitoring purposes
through cameras or video cameras, the data will be cancelled—according to
Instruction 1/2006—within a maximum of 1 month, and only those images that
record an infraction of working obligations or a breach of contract may be stored.
In the field of video surveillance, the CC judgements 29/2013 of 11 February and
39/2016 of 3 March and the Supreme Court judgement of 13 May 2014 (RJ 2014,
3307) are particularly relevant, and they reveal that: (1) the use of these measures to
prove an infraction at work requires that the worker has been previously informed;
(2) failure to warn the worker about the purposes of the working surveillance
associated to the capture of images of the workers could invalidate the evidence in
case of dismissal or any other sanction, because it affects the fundamental rights of
the individual. See also ECHR judgement (third section) of 9 January 2018, in the
case of López Ribalda v. Spain, in which the employer had informed the workers
about the visible cameras, but not about the hidden ones.
Similar conclusions can be reached with regard to geolocation data: the judgements from the Madrid High Court of Justice (hereafter, HCJ) of 21 May, 2014
(AS 2014\823), Madrid HCJ of 29 September, 2014 (AS 2014\2981), Andalusia
HCJ of 19 October, 2017 (JUR 2018\12280),
12 state that if the employer wants to
use GPS devices, they must inform the workers beforehand and warn them about the
purposes of said surveillance, and this control must be strictly limited to the duration
of the working hours.
9 With regard to Instruction 1/2006, the Legal Report 0019/2007 and Legal Report 0212/2007 of the
SDPA specify that the reproduction of images in real time, even if they are not recorded, constitutes
an act of data processing which lies within the scope of application of Instruction 1/2006 and the
OLPPD.
10 The proportionality principle is observed if: (a) the measure is susceptible of achieving its purpose
(judgement of suitability); (b) there is no other more moderate measure that may achieve its purpose
with the same effectiveness (judgement of necessity); (c) the measure is balanced (judgement of
strict proportionality) [e.g. CC judgements 10/2000 of 10 July and 39/2016 of 3 March].
11 Right recognized in Art. 4.2 e) of the SWR.
12 The SDPA had previously issued its Report 193/2008 on the possibility of using GPS systems to
control the activity of workers. The report insists that the file generated must be included in the
General Registry of Data Protection of the SDPA.
Data Protection in the Internet: National Report Spain
379