[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8tKYeYNTJ1KfKbdiK3sqxIreuXtwSR-yhNS0hgdtz3A":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"0eb309e9-8719-4c0f-b60a-31fb2363af59","AEPD (Spain) - PS-00637-2025","aepd-spain-ps-00637-2025-f03f69","Removed faulty link ← Older revision Revision as of 07:48, 8 September 2026 Line 64: Line 64: |Party_Name_1=BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. |Party_Name_1=BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. |Party_Link_1=https:\u002F\u002Fwww.bodense.es |Party_Link_1=","Spain's data protection authority (AEPD) has fined BODENSE ESTRUCTURAS Y CALDELERÍA, S.L. €4,000 for continuously recording workplace audio through CCTV. The AEPD ruled that this measure was disproportionate and violated the GDPR's data minimization principle, as less intrusive methods could have been used to address security concerns and employee conduct.","Spain's AEPD fines employer €4,000 for continuous workplace audio recording via CCTV.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00637-2025&diff=52925&oldid=52876","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-08T07:48:44+00:00","2026-09-08T08:00:09.663536+00:00",7,[17,20,23],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"CCTV","product",{"name":24,"type":19},"BODENSE ESTRUCTURAS Y CALDELERÍA, S.L.","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,21],{"controls":51,"vendors":52},[],[],{"slug":54,"title":55,"body":56,"framework_refs":57,"framework_notes":67},"spanish-firm-fined-4000-for-disproportionate-workplace-audio-recording-via-cctv","Spanish Firm Fined €4,000 for Disproportionate Workplace Audio Recording via CCTV","BODENSE ESTRUCTURAS Y CALDELERÍA violated the GDPR's data minimization principle by continuously recording workplace audio through CCTV systems, a measure the AEPD deemed disproportionate to the stated security and conduct concerns. The root cause is a failure to assess whether less intrusive alternatives could achieve the same legitimate objectives before deploying surveillance technology. This matters because GDPR requires that personal data collection be limited to what is strictly necessary, and audio recording is significantly more privacy-invasive than video alone. Organizations must conduct proportionality assessments before implementing any monitoring solution, ensuring that the privacy impact is justified by a compelling and documented need.",[58,59,60,61,62,63,64,65,66],"GDPR Article 5(1)(c) – Data Minimisation Principle","GDPR Article 13 – Transparency and Information to Data Subjects","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the Context of Employment","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-3 (Personally Identifiable Information Processing Purposes)","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","ITIL – Service Design: Information Security Management",{}]