The Spanish Agency for Data Protection has fined 150,000 euros to the company Cecosa Hipermercados SL, which in 2011 operated the Eroski hypermarket, for not having adopted technical and organizational measures to prevent the circulation of the theft video of the former President of the Community of Madrid, Cristina Cifuentes.
On May 4 of 2011 Cristina Cifuentes was held in the manager’s office of a hypermarket Eroski in Madrid after being captured by the surveillance cameras subtracting without paying some cosmetic creams. This video was the trigger for her resignation in April 2018.
This resulted in an investigation conducted by the Spanish Agency for Data Protection (AEPD) which has finished in a resolution (R/00423/2019) that states that Eroski breached the data protection regulations in relation to the processing of the images of Cristina Cifuentes.
Specifically, the AEPD fines the hypermarket with 100,000 euros for violating the article 9.1 of the National Law on Data Protection for not having adopted the necessary technical and organizational measures to guarantee the security of personal data and avoid its alteration, loss, processing or unauthorized access.
Indeed, as it was verified in the inspection, access to the security control space where the recorders and monitors are located is accessible to anyone by pressing a bell and the doors are open, the recorder management software allows the extraction of the selected images to an external support and, even, there was a written document with the keys for access.
In addition, the company acknowledged having any document that records and deals with the processing of video surveillance tasks.
On the other hand, the AEPD imposes another fine of 50,000 euros on Eroski for a violation of the article 4.1 of the same Law. According to it, personal data can only be processed when they are adequate, relevant and not excessive in relation to the scope and to the determined, explicit and legitimate purposes for which they were obtained.
In this case, the hypermarket retained very old photographs of people suspected of theft.
Eroski has issued a statement announcing that it will appeal against this fine as it scrupulously complied with the security protocol in accordance with the existing legislative framework in 2011.
