Landlord fined €3,000 security video camera in shared flat: ‘A rented room is a protected space’

According to the complaint seen by SUR, the device captured "access from the bedrooms to the bathroom and kitchen" and featured automatic tracking and two-way audio.

The AEPD resolution concluded with a €3,000 fine for the landlord for breaching Article 6 of the General Data Protection Regulation (GDPR). The amount was subsequently reduced to €1,800 following an admission of responsibility and voluntary payment.

The dispute arose when one of the residents filed a complaint with the data watchdog regarding the surveillance system in the rented property. Alongside the claim, she provided photographs of the camera, its location, and logs of conversations held with the owner.

In its ruling, the agency reminds landlords that images generated by camera systems constitute personal data. Therefore, any such recording is subject to data protection laws. Furthermore, it stresses that the processing of these images must have a valid legal basis and respect the principles of proportionality and data minimisation.

"It is a space reserved for the tenant’s privacy, free from furtive or invasive gazes."

The AEPD placed the case within the context of the rise in temporary rentals and shared rooms managed via digital platforms. However, it made clear that the fact a property is rented does not remove constitutional privacy protections. The resolution compared this type of rental to a hotel stay: "It becomes a space reserved for the tenant's privacy, free from furtive or invasive gazes."

A key point in the ruling was the reference to the fundamental right to a private life. The agency noted that constitutional protection of the home does not strictly require it to be a permanent residence. Citing Constitutional Court doctrine, it argued that a rented room also constitutes a protected space. "The home is the space where the individual lives while exercising their most intimate freedom," the resolution stated.

The Agency also emphasised that a breach of privacy does not require physical entry into the property. Citing constitutional case law, it noted that intrusion "also includes that which is carried out via visual or auditory devices."

During the proceedings, the owner responded by claiming the camera was never actually operational and was eventually removed because the tenants were unhappy. In a statement sent to the AEPD, he excused himself by saying that the camera was never fully installed, claiming it was a "pre-installation" and that once the residents objected, "it was taken down from the wall".

Despite this, the Agency found sufficient evidence of an infringement. The initial agreement classified the actions as negligent "given the impact on reserved areas that should be free of devices," and noted that data processing had occurred "without a justified legal basis".

The resolution highlighted the legal obligations for any CCTV system: providing adequate notice of the cameras, limiting image retention, justifying the purpose, and ensuring proportionality. It also insisted that landlords must evaluate whether their objective can be achieved "in another way that is less intrusive to the rights and freedoms of citizens".

Ultimately, the landlord accepted responsibility and paid the reduced fine. Additionally, the Agency ordered him to provide proof of the "uninstallation or deactivation of the image capture system inside the flat" within one month of the ruling becoming final.