AEPD (Spain) - PS-00637-2025
Spain's AEPD fines employer €4,000 for continuous workplace audio recording via CCTV.
Spain's data protection authority (AEPD) has fined BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. €4,000 for continuously recording workplace audio through CCTV. The AEPD ruled that this measure was disproportionate and violated the GDPR's data minimization principle, as less intrusive methods could have been used to address security concerns and employee conduct.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBODENSE ESTRUCTURAS Y CALDELERÍA violated the GDPR's data minimization principle by continuously recording workplace audio through CCTV systems, a measure the AEPD deemed disproportionate to the stated security and conduct concerns. The root cause is a failure to assess whether less intrusive alternatives could achieve the same legitimate objectives before deploying surveillance technology. This matters because GDPR requires that personal data collection be limited to what is strictly necessary, and audio recording is significantly more privacy-invasive than video alone. Organizations must conduct proportionality assessments before implementing any monitoring solution, ensuring that the privacy impact is justified by a compelling and documented need.