20,000 fine for real estate agency in Spain for taking photos of residents' mailboxes during visits

A real estate agent was dismissed by his company for refusing to carry out an illegal practice - taking photos and videos of the mailboxes of the residential buildings he would visit. He did not leave things there and decided to file a complaint. Now, Spain's data protection agency (AEPD) has fined the real estate agency for breaching data protection regulations.

The company implemented the practice in April 2023. The aim of the photos was to use the information to create a database, without seeking the consent of the people concerned and without informing them. The task for the real estate agents was to provide the name of the street, the number, the names on the mailboxes, as well as the flats corresponding to the names.

Aware that this was in breach of current data protection regulations, the employee refused to participate, which resulted in his dismissal. "Right now, this is the only way we have of doing business and I am very sorry that we cannot reach any other agreement (...) I wanted to let you know that we have to let you go," a company representative told him over the phone.

Although the worker tried to argue with them about the illegality of the action, the company simply apologised for the inconvenience. "We have no other way of working and I know that you obviously don't agree, believing that this is not legal. You have found information and we think it's great, but we can't do anything else."

Initially, the Spanish data protection agency brought this complaint to the company's attention. However, the latter denied having proposed to or forced the employee to perform such actions. In its response, it denied having received complaints or claims and that it had an internal application containing the databases of property owners, whose consent had been lawfully obtained and which was used when promoting and selling properties.

The AEPD proceeded to carry out preliminary investigative actions to clarify the facts. Officials went to the company's office and requested to connect to the database. AEPD found a customer registry that only included names, surnames, addresses and the date of last contact, without phone numbers or email addresses. For some of those clients, the 'Privacy' field stated: "Awaiting written privacy consent."

The real estate agency claimed that the information had been obtained from a publicly accessible source. They explained that their usual procedure when collecting personal data from a potential client was to provide the person with the information required by Article 14 of the general data protection regulation, in order to comply with the duty to inform and the principles of fairness and transparency.

However, "in this case, since there were no additional contact details, that first communication didn’t take place, as it wasn’t possible to get in touch with the potential client. That’s why the information about how their personal data is handled hasn’t been provided yet," the real estate agency told the AEPD.

The ruling states that Article 14 of the GDPR requires data controllers to provide clear and accessible information to individuals when personal data has not been obtained directly from them. This obligation aims to ensure transparency in data processing, allowing individuals to understand the origin of their data, the purpose of the processing, the legal basis for it, the recipients of the information, retention periods, and their rights, especially important when the data wasn't collected directly from them, as the risk of losing control over their personal information is greater.

The body also stated that the facts constituted a procedural infringement arising from the collection and storage of data from the mailboxes of residential communities without there being any legitimisation to do so.

For both infringements, the agency has imposed an administrative fine of 20,000 euros.