Agency for Access to Public Information Fines HoA

A complaint was filed before the Argentine Directorate for the Protection of Personal Data because a building’s Home Owner Association (HoA) had installed video surveillance cameras in the common areas of the building without notifying all HoA members or requesting their authorization.

The complainant argued that:

1. no signs were posted informing data subjects about the existence of the video surveillance cameras,
2. the database was not registered in the Argentine Registry of Databases,
3. the complainant homeowner did not receive a response after requesting access and deletion of her personal data.

Consequently, the Directorate ordered the HoA to respond to the complainant's request within 10 days, to register the corresponding database within five days, and to post the signs informing data subjects about the existence of video surveillance cameras, in accordance with applicable regulations.

The HoA responded that the arguments were false, since the cameras did not record images: they had been installed in common areas of the building and the images were stored on a server for 24 hours, without being transferred to anyone.

However, after an inspection of the building, it was concluded that the video surveillance equipment had the capacity to record and store video, even if there was no hard drive.

Given the HoA's non-compliance, and in accordance with the Directorate's decision, the Agency for Access to Public Information determined that:

• the consortium's conduct in not registering the database is one severe infringement,
• collecting personal data without respecting the data subjects’ right to information is one severe infringement,
• failure to respond on time to the complainant's request to access and deletion is one severe infringement,
• not proving the HoA implements sufficient technical and organizational measures to guarantee confidentiality and security is one severe infringement,
• creating files, databanks, or registers that store information that directly or indirectly reveals sensitive data implies is one very severe infringement.

The HoA was imposed a fee for AR$ 410,005, for committing four severe infringements and one very severe infringement.