Spanish DPA Rules City Councils Cannot Authorize Video Surveillance Cameras in Public Lagoons

Key Takeaways

• The Spanish Data Protection Agency (AEPD) concluded in a 2016 legal opinion that a city council cannot authorize a fishermen's society to install video surveillance cameras in public-domain lagoons.
• Capturing images in public places is reserved to the Security Forces and Corps under Organic Law 4/1997, with authorization granted by the Government Delegate.
• Compliance teams should note the strict limits on private video surveillance of public spaces and the broad treatment of images, voice, and license plates as personal data.

Deep Dive

The AEPD opinion (N/REF 307225/2016) applies the former Organic Law 15/1999 (LOPD) and Royal Decree 1720/2007. It confirms that images, voice, and vehicle license plates of identifiable persons are personal data, and that both live capture and recording constitute processing. Identifiability is judged by whether identification would require disproportionate effort. License plates qualify because the owner can be found through the Vehicle Registry upon showing a legitimate interest. The opinion also notes that, because consent cannot practically be obtained from passersby, legitimacy must rest on a statutory exception under Article 6 or on the legitimate-interest basis in Article 7(f) of Directive 95/46/EC, which the CJEU recognized as having direct effect in its November 24, 2011 judgment.

The decisive factor is the legal regime of the monitored space. Lagoons generally belong to the public hydraulic domain under the revised Water Law (Royal Legislative Decree 1/2001), unless they were registered in the Land Registry before Law 29/1985 took effect. The consultation did not address this exception. For public-domain assets open to common uses (drinking, bathing, domestic use, watering livestock), video surveillance is the exclusive competence of the Security Forces and Corps. It is governed by Organic Law 4/1997 and Royal Decree 596/1999, with the data protection rules applying where relevant. A city council has no authority to authorize private installation.

Key requirements include prior authorization from the Government Delegation, which requires a mandatory and binding report from the regional Video Surveillance Guarantees Commission. Authorization is valid for a maximum of one year and must be renewed. Viewing of images is also subject to strict requirements. The AEPD concluded that the council could not grant the authorization.

Recommended actions: (1) confirm the legal status of any monitored space (public versus private) before deploying or approving cameras; (2) do not rely on local or municipal approvals where Organic Law 4/1997 applies; (3) treat license plates, voice, and images as personal data in all CCTV risk assessments; (4) track authorization renewal cycles where cameras are lawfully operated; and (5) note that this opinion predates GDPR and Spain's Organic Law 3/2018, so the legal references must be re-validated against the current framework, though the public-space allocation of competence remains a useful precedent. The report is dated 2016 but carries a 2026 publication date, so confirm its currency.

Risk implications: unauthorized public-space surveillance exposes organizations and public bodies to administrative sanctions, invalid processing, and reputational harm. Institutions with Spanish branches, property, or outsourced security arrangements should review camera coverage that reaches public areas.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)