Following the full applicability of the GDPR, the Spanish Data Protection Agency (SDPA) has modified the way in which data controllers who process personal data through video surveillance systems must inform data subjects.
Due to its specific characteristics, this type of processing used to be specifically regulated by the SDPA through Instruction 1/2006 of 8 November on the processing of personal data for surveillance purposes by means of camera or video camera systems (Instruction). Article 3 of the Instruction allowed data controllers to comply with their obligation to provide information by: (i) placing an informative sign in a sufficiently visible place, with express reference to Organic Act 15/1999 of 13 December on the Protection of Personal Data (Data Protection Act), and (ii) making available to data subjects at their request forms containing the information in Article 5 of the Data Protection Act.
The GDPR now replaces the former information requirements. Consequently the SDPA has published a new format of the required sign on its website with slightly different content to the previous one. In addition, in several recent consultations on this subject, the SDPA has taken the opportunity to expressly remind that the new content of the forms available to data subjects should conform to Article 13 of the GDPR instead of Article 5 of the Data Protection Act.