Regulation and data
Video surveillance
Video surveillance means capturing images with cameras to protect people, property and premises. In Spain it is governed by art. 22 of the LOPDGDD: only what is essential of the public street, a visible information sign, and deletion of the footage within one month at most.
Also known asCCTV · security cameras · videovigilancia
The rules of article 22
The LOPDGDD, Spain's data protection act, allows any natural or legal person, public or private, to process camera images to preserve the security of people, property and premises (art. 22.1). In a residence that covers the entrance, the car park or reception. What it requires:
- Of the street, only what is essential (22.2): a camera on the front of the building may take in the minimum strip of pavement needed to watch the entrance, not the whole street.
- One month at most (22.3): footage is deleted within that period from when it is captured, unless it is needed to prove an act against people, property or premises; it is then made available to the competent authority within seventy-two hours of learning that the recording exists. The blocking rule of art. 32 does not apply.
- A visible sign (22.4) stating, at least, that there is recording, who the controller is and how to exercise data rights; it may add a code or a web address with the rest.
- Staff, under a rule of their own (art. 89): if the cameras are also used to monitor work, staff must be told beforehand, and there is never recording in their rest or leisure areas, such as changing rooms, toilets or staff canteens.
Worth knowing
What people take for granted: that a sign is all it takes. The act does not mention residences or the corridors outside residents' rooms, and there a camera is decided as anywhere else, under the data minimisation principle. The guide on video cameras published by the AEPD, the Spanish data protection authority, in February 2025 asks whether the camera is needed or the purpose can be met another way, to limit the number and type of cameras, to use privacy masks and to put the sign at every entrance to the monitored area. The other duties, such as the record of processing, are those of the GDPR, and compliance is overseen by the AEPD.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- AEPD (Spanish Data Protection Agency)The AEPD, the Spanish Data Protection Agency, is the independent administrative authority that enforces the GDPR and the LOPDGDD in Spain: it handles complaints, inspects and sanctions, receives breach notifications and the appointment of data protection officers, and publishes guides and tools.