On Tuesday 12 December 2006 the Spanish official gazette published Instruction 1/2006 of 8 November, issued by the Spanish Data Protection Agency in relation to images taken by video cameras. The main purpose of this Instruction is to establish a legal framework to protect the freedom and rights of individuals who are recorded by video cameras or other systems of cameras used for security and surveillance.
The Instruction states that these systems should be used in a manner that is proportionate to the purpose of using the cameras, which must be a lawful purpose The “proportionality test” should be applied, so that the measure taken is suitable (that is, adequate to achieve the aims pursued), necessary (that is, that there is no other less intrusive measure that would achieve the same aims) and justified and balanced.
The methods of processing covered by the Instruction are recording, collecting, transferring and storing images, including reproducing the images or displaying them in real time. The processing of images in a private or family setting is expressly excluded from the scope of the Instruction.
The Instruction, following the same principles as the Spanish Data Protection Law, states that processing of this kind of data requires the unambiguous consent of the data subject. The data processed may only be disclosed to a third party for the fulfilment of purposes directly related to the lawful activity of the transferor and transferee, with the prior consent of the data subject.
In addition, the Instruction puts an obligation on the controller to inform the data subject that data is being collected (article 5 of the Data Protection Law). To comply with this obligation, information about the controller and the reason why the data is being collected shall be displayed in a visible part of the area monitored by the cameras (the model given by the Agency is attached below). The controller must also have a printed version of the information required by article 5.1 of the Spanish Data Protection Law and make it available on request by the data subject.
The Instruction also follows the general principles of data protection outlined in article 4 of Data Protection Law. The collected images may only be processed if they are adequate, relevant and not excessive, given the scope of use and the specified, explicit and lawful purposes for which they have been obtained.
In line with articles 15 and 16 of Data Protection [Law], this Instruction gives data subjects the right to access information concerning their personal data and the right to deletion of data. To exercise these rights the data subject must send the controller a recent image of himself. To further protect the personal rights, the Instruction establishes the obligation to delete the data within a month of their collection.
The instruction also requires that the controller notify the Spanish Data Protection Agency that they have created a file containing data of video surveillance. The controller is under an obligation to implement the necessary technical and organisational measures to ensure the security of the personal data and prevent their alteration, loss, processing or unauthorised access.