Community of owners fined 2,000 euros for parcel collection system agreed by residents

Until the Covid pandemic, when a parcel arrived at a residential area the staff at the access control post was in charge of the delivery, taking down in handwritten form the details of the person who collected it - name, surname, ID number and house number - who signed as proof of receipt. Then, as a result of the pandemic, in March 2020 the collection of parcels was moved to new premises with staff dedicated exclusively to this purpose, and the data was processed in the same way as it had been at the access control post.

However in 2021 the system changed and problems arose when two residents complained to the Spanish data protection agency (AEPD), which has now fined the owners' association 2,000 euros for a breach of its rules.

They reported that the new system was that whoever picked up the package had to take a photograph of it, thus proving that it had arrived. To do this, they used a camera on a tripod, connected to a computer, which took a photograph of the person taking the parcel each time. This system, which stored the images, was implemented without previously informing residents about the processing of the data. The complainants claimed that they had not obtained "adequate" information about the processing of their personal data and that this system "did not have a valid legal basis".

The AEPD started to investigate the claim a year ago, warning the community, which responded to the letter by justifying its peculiar parcel collection system on the grounds of legitimate interest, based on security, traceability and minimisation of neighbourhood conflicts. It argued that the owners were aware of the process and had given their consent to implement this system having assessed other alternatives.

"The analysis concluded that image processing is the most appropriate and proportional solution, considering operational needs and risk minimisation," it said. In addition, according to the residents' association, "it had a limited and occasional capture", with no continuous recording or massive image storage.

However, the data protection authority described the system as disproportionate and argued that there are other less intrusive options, including the original reception system and considered the justification based on legitimate interest to be insufficient, as it did not demonstrate the need to capture images for the purpose of receiving parcels.

"In this case there is a lack of proportionality (the capture and conservation of a person's image) that implies a serious intrusion into the private sphere of the individual as a means of managing the collection of parcels in the residential area," the resolution states.

It added that, having examined the arguments put forward by the community of owners, "there is no evidence to demonstrate the necessity or proportionality between the processing - taking into account the purposes for which it is intended and the context in which it is carried out - and the intrusion it represents on the individual's right to data protection to capture his or her image and keep it as a means of accrediting to whom the mail was delivered. This treatment is even more excessive if we take into account that the data controller collects and retains other personal data: name and surname, ID number, address, telephone number, and even a copy of the data subject's ID card", the ruling concluded.