More security, but with rules attached
Break-ins in the storerooms, scratched cars in the garage, bikes that disappear, doors left open by somebody. When that happens, the first suggestion at the residents’ meeting is nearly always the same: let us put cameras in.
It is an effective measure, but in an apartment block you cannot simply buy some cameras and hang them up. You are recording images of people, and that means complying with data protection law as well as taking the decision properly at a meeting. This guide sets out the main requirements for fitting CCTV in a block of flats in Spain. It is general information: for your own case, lean on your property manager. If the decision is already made, you can see how we work under CCTV security cameras.
The rules that apply
Three sets of rules frame all of this:
- The Horizontal Property Act (LPH): governs how a residents’ association decides on installations and services in communal areas.
- The General Data Protection Regulation (GDPR): images of identifiable people are personal data.
- Organic Law 3/2018 on data protection (LOPDGDD): article 22 deals specifically with processing for video surveillance purposes.
The Spanish data protection agency (AEPD) publishes guidance and decisions on video surveillance that are worth using as a reference.
Requirement 1: a decision by the owners’ meeting
Fitting cameras in communal areas has to be approved at a meeting and recorded in the minutes. The decision should ideally cover:
- The purpose: the safety of people, property and installations.
- The areas to be filmed and the number of cameras.
- Who will be allowed to view the footage.
- How long it will be kept.
The majority needed and the way the cost is shared are best confirmed with your property manager, because they depend on how the installation falls under the LPH and on the association’s own statutes.
Requirement 2: the association is the data controller
For data protection purposes, the residents’ association is the controller of the images, normally represented by the chair. That means meeting the GDPR obligations: using the footage only for the agreed purpose, protecting it and dealing with the rights of the people filmed.
If an outside company has access to the recordings, for maintenance or remote viewing for example, a data processor agreement has to be signed with them.
Requirement 3: a warning sign
You must tell people the area is under surveillance. The LOPDGDD allows this to be done with an information notice placed somewhere sufficiently visible, identifying at least:
- That the processing exists.
- Who the controller is (the residents’ association).
- That data protection rights can be exercised, and how.
The usual approach is a sign at every entrance to a filmed area: the front door, the garage entrance, the storerooms. The AEPD publishes a model sign on its website.
Requirement 4: keep the footage for no more than a month
Images must be deleted within one month of being captured. The exception is footage that has to be kept to evidence acts against the safety of people, property or installations; in that case it must be handed to the competent authority within 72 hours of the recording coming to light.
In practice the recorder, NVR or DVR, is configured to overwrite automatically before that month is up.
Requirement 5: film only what you need
Cameras should be limited to communal areas and to what is strictly necessary for the security purpose.
| Area | General rule |
|---|---|
| Entrance hall and access doors | Normal, with a warning sign |
| Garage and storerooms | Normal; this is where most incidents happen |
| Stairs and landings | Possible if proportionate; avoid pointing at flat doors |
| Public street | Only the bare minimum next to the entrance |
| Inside flats or private terraces | No |
| Toilets and changing rooms, at the pool for instance | No |
Recording audio is not advised either: as a general rule it is treated as a disproportionate intrusion.
Who is allowed to view the footage
Access should be restricted to the people named in the decision, normally the chair, the property manager or the company in charge. Some sensible habits:
- Keep the recorder in a locked, protected place.
- Use strong passwords, changed from the factory defaults.
- Keep monitors out of sight of anyone walking through the entrance hall.
- If there is access from a phone, only for authorised users.
- Never circulate footage in neighbours’ chat groups or on social media.
If a resident needs a recording after an incident, the right route is through the association and, where appropriate, handing it to the police.
What if a resident wants their own camera?
An owner can have cameras inside their own flat, but they should not capture communal areas or other people’s space without the association’s agreement. Digital door viewers and video entry systems that only show a picture when somebody calls are a different situation. If in doubt, ask the property manager.
Technical points worth weighing up
- IP cameras with an NVR: the usual choice today, with good picture quality.
- Night vision in garages and poorly lit areas.
- Cameras rated for outdoor use and able to cope with salt air in seafront buildings, as in Salou or Cambrils.
- A link to a monitoring centre: if the association wants alarms handled by a central station, that involves a licensed private security company.
- Integration with the alarms and access control on the front door and the garage.
A summary to take to the meeting
- A decision covering purpose, areas filmed and who sees the images.
- A warning sign at every filmed area.
- Storage for a month at most, incidents aside.
- Communal areas only, and the bare minimum of public street.
- Restricted access and protected equipment.
- A data processor agreement with any company that sees the footage.
If your residents’ association is weighing up cameras, ask us for a quote with no obligation. We survey the building, propose where each camera should go with the rules in mind, and leave the recorder configured with the right retention period.