Tourist apartment owner fined 3,000 euros for installing cameras inside property

Spain's national data protection agency (AEPD) has imposed a 3,000-euro fine on the owner of a tourist apartment for installing two interior surveillance cameras, one placed in the living room-kitchen, where there was a sofa bed and the other at the entrance to the master bedroom. "Both collect images for viewing by the security company," as stated in the complaint consulted by SUR, in which guests said they do not know if they had been filmed inside the accommodation.

On 3 October, the AEPD received a letter of complaint in which the owner of the accommodation acknowledged having installed an interior camera system in the tourist apartment, citing as the main reason for the installation "the high rate of illegal occupation" of properties in Spain.

In his statement, the owner defended themself by arguing that the system was not intended for surveillance of the occupants, nor was it used to monitor their behaviour, but exclusively to ensure the security of the property when there is a risk of intrusion. "A technical mechanism (manual locking of the viewfinder) has been implemented that allows tenants to maintain their privacy throughout their stay, thus ensuring that image capture is neither permanent nor invasive. In addition, the obligations of transparency and duty of information are fulfilled through: prior communication on the booking platform about the existence of cameras and the possibility of deactivating them; direct information on arrival, with an explanation of how to deactivate the devices and the presence of informative signs in the property about the existence of the alarm system with cameras. We therefore consider that the system implemented complies with the principle of proportionality, guarantees the guests' right to privacy by allowing the physical deactivation of the cameras and responds to a legitimate interest in protecting against intrusions and illegal occupations".

However, these arguments did not convince the AEPD: "When a hotel room is rented, a certain price is paid for the temporary stay in a room, this figure being assimilable to the rental (either of a complete property or of an individual room in the same), which becomes a space reserved for the tenant, free therefore from furtive or invasive monitoring of spaces reserved for this purpose, as would occur in any hotel room", stated the AEPD.

The AEPD highlighted that as the law has repeatedly stated, the right to personal privacy implies the existence of a private sphere reserved from the action and knowledge of others, "necessary, according to our culture, to maintain a minimum quality of human life. This implies the legal power to impose on third parties, whether private individuals or public authorities, the duty to refrain from any intrusion into the intimate sphere and the prohibition to make use of what is thus known".

For the High Court, the domicile is the space where the individual lives exercising his or her most intimate freedom, outside social conventions, as well as any space suitable for this to occur, temporarily or permanently. "Specifically, the following are considered domiciles for constitutional purposes: second homes, vehicles or caravans, hotel rooms or the business domicile of legal persons, although in some of these cases with certain restrictions derived from the characteristics of the accommodation itself".

As for the justifications put forward by the tourist accommodation, the AEPD analyses each argument in detail. As for the signs, they only inform about the installation company, as hypothetical and the client of the tourist apartment cannot exercise any right effectively, as the one who must be identified at all times is the client, in this case the owner of the property being rented.

With regard to the fact that the clients are informed of the manual disconnection of the alarm system, "there is no record of any document informing them of this possibility, by means of a legible and understandable clause, which could accredit this, duly signed in order to communicate it to the clients of the flat".

Finally, with regard to the presence of cameras and the fact that they have been duly reported on the contracting platform (...), "no documentation to that effect is provided". "According to the above, there is firstly a clear lack of information on the presence and purpose of the system inside the flat, which is consistent with what the complainant stated in their complaint, considering the information provided insufficient for the client to be aware not only of the presence of cameras, but also of the purpose of the system and the processing of its images".

The AEPD argues that in matters of video-surveillance, the provisions of Article 6(e) of the GDPR must be taken into account when defining the legitimate basis. "The processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority vested in the controller. And here, the presence of cameras inside the home implies an invasion of a space that is no longer the exclusive property of the owner, but the object of enjoyment of a third party whose rights must be respected, both the right to privacy and the right to the protection of personal data". Another rule should also be taken into account: "Consent must be given by a clear affirmative act reflecting a freely given, specific, informed, and unambiguous expression of will by the data subject to accept the processing of personal data concerning him or her..."

The AEPD concluded that the aforementioned regulations have been infringed and the owner of the property has been fined 3,000 euros, for the infringement of article six of the GDPR, as it considers the conduct to have been negligent because it affected private areas, which must remain free from the presence of devices and because there is data processing without a justified legal basis.