When private cameras may capture public spaces, AEPD limits and a checklist to reduce GDPR sanction risk.