Cameras in the building
and in the car park

It depends on where the building is, because in Catalonia property held under horizontal division isn't governed by Spain's national Horizontal Property Act (LPH) but by Book Five of the Civil Code of Catalonia (Codi civil de Catalunya). Neither law mentions cameras explicitly. In Catalonia, a resolution with no different majority set for it is passed by a simple majority of the owners taking part in the vote, which must also represent a simple majority of their shares (article 553-25); if the installation required works affecting the building's structure or external appearance, a different, higher majority would come into play. Outside Catalonia, the relevant provision is article 17.3 of the LPH, which requires three fifths of all owners and of the shares to establish security services. Either way, the exact figure for your building is confirmed by the property administrator when preparing the agenda, because the item has to appear on it to be voted on.

They can, but not on their own initiative. Spain's data protection authority (AEPD) puts it like this: the camera may only capture the space owned by whoever installs it and a minimal strip of common area that can't be avoided, and it needs the prior authorisation of the owners' meeting, recorded in the minutes. In other words, the resident can't decide alone which part of the shared garage gets recorded, even if the camera is bolted to their pillar and they pay for it. In practice, that means thinking about the framing before asking for permission: a camera pointed at their own space from the right angle captures very little of the aisle, while one put up any old how sweeps half the basement, the neighbour's car and the lift door. If a resident already has a camera installed without that agreement, the sensible thing is to take it to the next meeting rather than let it slide, because the situation won't sort itself out over time.

Only the people the community appoints, and nobody else simply because they're an owner. Usually that's the president, the property administrator or both, but what matters is that it has been decided and that each of them logs in with their own username and password. The AEPD is categorical on a point that surprises some communities: the footage must not be accessible to residents via the building's shared TV channel, however convenient it may seem to watch the entrance from the sofa. Nor does it make sense for the recorder's password to circulate in the building's WhatsApp group. The recorder must also be in a supervised or restricted-access location, not in a landing cupboard anyone can open. And although the law doesn't require a formal log of every viewing, it's worth noting who reviewed what and why: the day a resident asks who has seen some footage, the community will be able to answer with more than a guess.

Not as a general rule. Access to the footage is restricted to the people the community appoints, and if that access is over the internet, it must also be protected by a username and password that only those people know. An app on every owner's phone using the recorder's account turns the building's CCTV into something anyone can watch at any time, including their neighbours' comings and goings, which is exactly what the rules are trying to prevent. If the community wants the president or administrator to be able to check something remotely, a user is created for each of them, with just the permissions they need, and removed the day they leave the post. That last step is the one most often forgotten: the president changes every few years and their access often stays active long afterwards. It's worth reviewing at every change of office, just as you change the signatories at the bank.

A maximum of one month from when it's captured, as with any other CCTV installation; being a community doesn't change the time limit. After that month the footage is deleted, and the right way is for the recorder itself to do it by overwriting the oldest recordings, without anyone having to remember. The exception is a recording that evidences a crime or an offence: in that case you don't keep the whole of the following month, but that specific clip, which goes with the police report and is made available to the police or the court. What isn't acceptable is a resident asking for a copy of the video to settle a scratched car on their own: if there's something to report, the footage goes through the reporting process. And if the police request it, they do so as part of a police or judicial action, and that request is what covers the community in handing it over.

It can, but you need to be clear that it isn't a neutral technical feature: the AEPD considers a vehicle's number plate to be personal data, just like a person's image, because it can identify someone indirectly. Capturing and storing it is therefore data processing, with the same obligations as the rest of the CCTV: a specific and justified purpose, information for anyone entering and restricted access to the data. In a pay car park or a garage with many spaces, opening the barrier for authorised vehicles can be a reasonable purpose; in a small community, switching on plate recognition because the equipment comes with it isn't. Before turning it on, decide what it's for, who will see that log and how long it's kept, and set that out in the documentation of the community or the company that owns the car park, rather than leaving it to the device's default settings.

Yes. If the cameras capture people who work in the building (the caretaker, cleaning staff, garage maintenance staff), the community's CCTV takes on the obligations of any business that records employees, and the first is to inform them beforehand, expressly, that there are cameras, where they are and what they're for. The AEPD's own factsheet on communities refers to the workplace monitoring rules on this point. The same limits apply too: no cameras in the room where the caretaker changes or takes a break, even if it's a community space. If an outside cleaning or maintenance company works in the building, it should also know there are cameras so that it can pass this on to its staff. We go into this in detail in the article on recording employees, which applies just as much to a community that employs someone as to any business.

No. The data controller is the community of owners, and the AEPD makes this clear: hiring an external CCTV service or having a third party do the installation doesn't exempt the community from complying with data protection law. The installer fits and configures, but it's the community that decides what gets recorded, who sees it and how long it's kept, and any complaint is addressed to the community. That's why the sign carries the community's name, not that of the company that put the cameras up. Before the system goes live, the community must also draw up the record of processing activities for this CCTV, an internal document that isn't filed anywhere; the AEPD offers its Facilita RGPD tool and a template in its guide. A good installation puts all of this on track, but the signature and the responsibility remain the community's.