Italian DPA: pool locker surveillance lawful but retention must be 12/24 hours

Introduction. The Authority has learned from press reports and several complaints that video surveillance cameras were allegedly found inside a locker room, intended for use by users, at a swimming pool managed by the Special Agency for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S. — hereinafter, the “Agency”).

The Preliminary Investigation. In response to two requests for information made pursuant to Article 157 of the Code (see letters dated October 29, 2025, Ref. No. 0143564, and January 13, 2026, Ref. No. 0003526), the Company, in notes Ref. Nos. 19111 dated November 5, 2025, and 1057 dated January 19, 2026, stated, in particular, that: - “[…] the incident pertains to the Trento Nord Sports Center—Gardolo district, managed [by the Company]. Video surveillance at this facility, indicated by appropriate signage at the entrance […], covers the lockers […] designated for users, where they store their personal belongings for the time necessary to engage in sports activities”; - “this is in no way a matter of monitoring employees […], who are incidentally ‘captured’ by this video system, but rather of Users […] of the outdoor pool”; - “The changing rooms, showers, and restrooms are not subject to video recording in any way”; - “near the lockers […] there are no benches or chairs that might encourage those undressing to sit there and thus be captured on video”; - there are “signs posted at the entrance to the facility [… and] the data is retained for 72 hours”; - “These recordings are not viewed in real time on a peripheral monitor, and […] the controller […] has designated two individuals responsible for processing personal data from the video surveillance system […]. These two officials may engage in data processing only at the request of judicial or public safety authorities”; - “The Trento Nord facility has, on several occasions in the recent past, been the site of thefts of users’ wallets and cell phones, due to the actions of criminals who forced open the lockers intended for storing users’ personal belongings at the pool. This negative conduct has certainly limited the practice of sports—swimming in particular—due to the lack of security and the resulting sense of unease among Users”; on September 13, 2007, in accordance with the provisions of Art. 4 of Law No. 300/1970, entered into an agreement with the company’s union representatives for the installation of video surveillance in the sports facilities under its management.” By letter dated May 16, 2026 (Ref. No. 0075624), the Office, based on the evidence gathered, the inspections conducted, and the facts that emerged following the preliminary investigation, notified the Company, pursuant to Article 166, paragraph 5, of the Code, the initiation of proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation, for having carried out the processing of personal data, through video devices, in a manner that does not comply with the principles of lawfulness, fairness, and transparency and in the absence of a legal basis, in violation of Articles 5(1)(a), 6(1)(c) and (e), and 2-ter of the Code; for failing to ensure the necessary transparency of the processing with respect to data subjects (users and employees), in violation of Articles 5(1)(a), 12(1), and 13 of the Regulation; for failing to ensure compliance with the principle of storage limitation, in violation of Article 5 of the Regulation. In the same notice, the aforementioned data controller was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). In a letter dated May 29, 2026 (Ref. No. 0009183), the Company submitted a defense brief, stating, in particular, that: by means of “Emergency Order No. 3 dated May 26, 2026 [… the Company] implemented certain technical and organizational measures […] consistently complying with the [Data Protection Authority’s] instructions following notification [of the administrative violation]”; in particular, “the following was immediately ordered and carried out as early as May 18, 2026 […] the cameras located in the locker rooms of the Sovecar Trento Nord (Gardolo) sports facility were turned off, thereby ceasing their recordings and planning their removal”; “as early as April […] the first-level privacy notice […] was posted at the entrance and inside every room where video surveillance is installed, indicating the processing purpose, the identity of the controller, the procedures for exercising the rights of data subjects, the contact information for the data protection officer, the link to the company website where the complete privacy notice regarding the processing of personal data through video surveillance systems (second-level privacy notice) is available, and the storage period for data collected by the video surveillance system”; “A.S.I.S. has complied with the requirements regarding the provision of specific information on the processing of personal data through the video surveillance system monitoring employees, in particular by notifying the employees of the policy and publishing it on the company’s official website.” During the hearing, requested pursuant to Article 166, paragraph 6, of the Code and held on July 7, 2026 (see minutes, ref. no. 0205336, dated July 8, 2026), the Company stated, in particular, that: “[the company] promptly took action to deactivate the video surveillance cameras and cease the processing in question; […] it revised the storage periods for video surveillance footage (12/24 hours); it updated the signage at the facilities”; “[it] acted in complete good faith, for the sole purpose of protecting Users, given the numerous incidents of theft that have occurred over time”; “in April–May 2026, the Company installed signs informing users about video surveillance at the entrance to each room in the facilities where video surveillance cameras are in operation”; “In June 2026, the Company provided employees with a privacy notice regarding the processing of personal data through video surveillance devices.”

applies Art. 5(1)(a), Art. 6(1)(c), Art. 6(1)(e), Art. 12(1), Art. 2, Art. 4, Art. 5, Art. 13, Art. 18, Art. 58

Outcome of the Preliminary Investigation.

Lawfulness of the Processing. Public entities may, as a general rule, process personal data if such processing is necessary to comply with a legal obligation or to perform a task carried out in the public interest or in the exercise of official authority (see Articles 5(1)(a) and 6, para. 1, letter a), paragraph 1, letters c) and e), and 2 and 3 of the Regulation, and 2-ter of the Code), provided that compliance with the data protection principles must be ensured in all cases (see Articles 5, 24, and 25 of the Regulation) must be guaranteed in all cases, including, in particular, the principles of “lawfulness, fairness, and transparency” and “data minimisation,” pursuant to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject” and “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Article 5, para 1, subparagraphs (a) and (c), of the Regulation). Following the preliminary investigation—initiated based on press reports and a complaint—it was determined that, since 2007, the Company has installed and activated, within the locker rooms of the swimming pool at the “Trento Nord” sports facility in Gardolo (Trento), several video surveillance cameras that record the lockers where users can store their personal belongings for the time necessary to engage in sports activities, in order to prevent or investigate any thefts. In this regard, it should be noted that, as the Data Protection Authority has long emphasized, “the need to ensure […] a high level of protection of fundamental rights and freedoms with regard to the processing of personal data permits the use of video surveillance systems, provided that this does not result in an unjustified interference with the fundamental rights and freedoms of the data subjects” and provided that “compliance is ensured not only with the regulations governing data protection, but also with other applicable legal provisions, such as the current civil and criminal laws regarding unlawful interference in private life [and] the remote monitoring of employees” (General Provision on Video Surveillance of April 8, 2010, at www.gpdp.it, web doc. no. 1712680, Sec 2, para 4; but see also the previous general provision of April 29, 2004, at www.gpdp.it, web doc. no. 003482, para. 2.1, which referred to “the applicable provisions of civil and criminal law regarding unlawful interference in private life, the protection of dignity, image, the home, and other places afforded similar protection (restrooms, hotel rooms, booths, locker rooms, etc.) […as well as] the provisions concerning the protection of workers, with particular reference to Law 300/1970 (Workers’ Statute).” With particular regard to the use of video surveillance systems within premises used as changing rooms, the Data Protection Authority has consistently reaffirmed that these are places which, by their very nature, are characterized by a particular expectation of confidentiality and the protection of personal privacy and dignity (see, in particular, decisionsNo. 357 of July 10, 2014, web doc. No. 3325380, and No. 1576125 of December 4, 2008). The processing of personal data through video surveillance systems located inside rooms used as changing rooms is therefore, as a general rule, excessively intrusive and constitutes a violation of confidentiality and dignity for the individuals using those rooms. It must also be noted that the installation of video surveillance cameras in the workplace must always comply with the regulations governing the indirect monitoring of work activities. As consistently reaffirmed in the Data Protection Authority’s rulings, data processing resulting from the use of technological tools in places where work is also carried out finds its legal basis in the sector-specific regulations set forth in Art. 4 of Law No. 300/1970, expressly referred to in Art. 114 of the Code. This provision, in fact, uniformly defines at the national level the scope of permitted processing in every workplace (public and private) and constitutes, within the domestic legal system, a more specific provision offering greater safeguards than that set forth in Art. 88 of the Regulation, compliance with which is a condition for the lawfulness of the processing (see Articles 5(1)(a) and 6(1)(c) of the Regulation). In this context, on September 13, 2007, the Company entered into a union agreement, pursuant to Art. 4 of Law No. 300/1970, also with regard to the “Trento Nord Sports Center” and the “surveillance cameras for the men’s locker room [installed there, which] exclusively film the lockers and pool access (6); surveillance cameras in the women’s locker room (which exclusively monitor the lockers and access to the shower stalls) (6 in number); a camera at the main entrance to the locker rooms (lobby area) […].” In this context, the Company’s purposes of protecting its property—which, although legitimate, fall within those strictly permitted by Article 4 of Law No. 300/1970—cannot, however, justify the processing of Users’ personal data, as there is a clear disproportion between that purpose and the fundamental rights and freedoms of the data subjects (see, albeit with reference to the different legal basis of legitimate interest, European Data Protection Board, “Guidelines 3/2019 on the processing of personal data through video devices,” adopted on January 29, 2020, para. 30). Given this disproportion in the use of video surveillance within premises used as locker rooms, not even the union agreement entered into pursuant to Art. 4 of Law 300/1970 could legitimize such processing of personal data, since the parties cannot enter into commitments or regulate the matter of indirect monitoring of work activities in a manner that conflicts with the basic principles of data protection, particularly with regard to the requirements of necessity and proportionality of processing (see Art. 5 of the Regulation; see Court of Justice of the European Union, Judgement C-65/23, K GmbH (Processing of Employees’ Personal Data), of December 19, 2024, para. 59; see, most recently, Order No. 42 of January 29, 2026, web doc. No. 10222864). Nor has the Company, for the purposes of complying with the principles of necessity and proportionality in processing, adequately demonstrated that it had previously assessed, before commencing the processing, the existence of any alternatives that would be equally effective in ensuring the protection of assets but less intrusive on the rights and freedoms of data subjects, such as, for example, the use by users of personal padlocks, which “can be just as effective as video surveillance systems against theft and vandalism.” The data controller, in fact, must “assess on a case-by-case basis whether such measures may be a reasonable solution,” including during the data protection impact assessment (see Article 35(7)(b) of the Regulation). In this regard, the data protection impact assessment conducted by the Company (on file) is, in fact, limited to stating, in an apodictic manner, that “the data are relevant and adequate for the purposes and limited to what is necessary.” In light of the foregoing considerations, it must be concluded that the Company’s processing of the personal data of swimming pool users within the locker rooms was carried out in a manner that did not comply with the principles of lawfulness, fairness, and transparency and in the absence of a legal basis, in violation of Articles 5, (1)(a), 6(1)(c) and (e), as well as Article 2-ter of the Code.

applies Art. 5(1), Art. 5(1)(a), Art. 6(1)(c), Art. 35(7)(b), Art. 2, Art. 4, Art. 5, Art. 6, Art. 24, Art. 25, Art. 88 , Law 300/1970 Art. 4

Transparency toward data subjects. When video surveillance devices are used, the controller, in addition to providing first-level information by posting warning signs near the area under video surveillance, must also provide data subjects with “second-level information,” which must “contain all the mandatory elements required under Article 13 of the [Regulation]” and “be easily accessible to the data subject, for example through a comprehensive information page made available at a central location […] or posted in an easily accessible place” (“Guidelines 3/2019 on the Processing of Personal Data through Video Devices,” cit., specifically para. 7; but see also the Data Protection Authority’s “Provision on Video Surveillance” of April 8, 2010, cited above, in particular para. 3.1; most recently, see FAQ No. 4 of the Data Protection Authority on video surveillance dated December 3, 2020, web doc. No. 9496574). First-level information (warning sign) “should convey the most important details, such as the processing purpose, the identity of the controller, and the existence of the data subject rights, along with information on the most significant impacts of the processing” (Committee Guidelines, op. cit., para 114). Furthermore, the signage must also include information that might come as a surprise to the data subject. This could include, for example, the transfer of data to third parties—particularly if they are located outside the EU—and the data storage period. If such information is not provided, the data subject should be able to rely on the fact that only real-time surveillance is taking place, without any data recording or transfer to third parties (ibid., para. 115). The first-level warning signage must contain a clear reference to the second level of information, for example by indicating a website where the text of the extended privacy notice can be consulted. In the present case, the Company has submitted to the court a copy of the “signage posted at the entrance to the facility”. As highlighted by the European Data Protection Board, “the information should be positioned so as to allow the data subject to easily recognize the circumstances of the Surveillance before entering the monitored area (approximately at eye level). It is not necessary to disclose the location of the camera, provided that there is no doubt as to which areas are subject to Surveillance and the context of Surveillance is made unequivocally clear […]. The data subject must be able to assess which area is covered by a camera in order to avoid Surveillance or adjust their behavior, where necessary” (“Guidelines 3/2019 on the Processing of Personal Data through Video Devices,” op. cit., para. 113). Therefore, for the purpose of achieving the necessary level of transparency in the processing with respect to data subjects, it is insufficient to install an informational sign—containing the initial notice—only at the entrance to the facility, as this solution does not allow data subjects to be made aware of the presence of video surveillance cameras in specific areas of the facility—especially in those areas, such as changing rooms, where there is a greater legitimate expectation of confidentiality. In light of the foregoing considerations and given that the sign containing the general privacy notice was not also posted at the entrance to the changing rooms, the Company’s conduct is inconsistent with the principles of lawfulness, fairness, and transparency and constitutes a violation of Articles 5(1)(a), 12(1), and 13 of the Regulation. With regard to the processing of employees’ personal data through the same video surveillance system, implemented pursuant to Article 4 of Law No. 300/1970 and Article 114 of the Code, the Company stated that it provided employees with a specific privacy notice only in June 2026; it has therefore been established that, during the preceding period, the Company acted in violation of Articles 5(1)(a), para 1, 12(1), and 13 of the Regulation.

applies Art. 5(1)(a), Art. 12(1), Art. 4, Art. 13

Storage Limitation. Based on the principle of “storage limitation,” personal data must be “stored in a form that permits identification of data subjects for no longer than is necessary to fulfill the purposes for which the data are processed” (Article 5, para 1, subparagraph e), of the Regulation). When video surveillance is used for property protection purposes, “personal data should—in most cases […]—be deleted after a few days, preferably through automated mechanisms. The longer the intended storage period (especially if it exceeds 72 hours), the more thorough the analysis must be regarding the legitimacy of the purpose and the necessity of storage” (“Guidelines 3/2019 on the Processing of Personal Data via Video Devices,” op. cit., para. 121; see also the general provision on video surveillance dated April 8, 2010, para. 3.4, where, within the context of the previous legal framework on data protection, it was emphasized that “storage must be limited to a few hours or, at most, to the twenty-four hours following the recording, subject to special requirements for further storage […]”). In the present case, the preliminary investigation revealed that the Company retained video surveillance footage for seventy-two hours. However, there is no evidence that it had conducted any assessment, prior to commencing the processing, regarding the necessity of retaining said footage for that period of time. The data protection impact assessment, as included in the case file, is in fact limited to stating categorically that “the data storage period is limited (based on laws, Regulations, or organizational policies).” It must therefore be concluded that the Company acted in violation of Article 5(1)(e) of the Regulation.

applies Art. 5(1)(e), Art. 5

Conclusions. In light of the assessments outlined above, it is noted that the statements made by the controller during the preliminary investigation—for the accuracy of which the controller may be held accountable pursuant to Article 168 of the Code—while worthy of consideration, do not sufficiently address the findings notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings, especially since none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The Office’s preliminary assessments are therefore confirmed, and the processing of personal data by the Company is found to be unlawful, as it carried out the processing of personal data using video surveillance devices in violation of Articles 5(1)(a) and (e), Article 6(1)(c) and (e), Article 12(1), and Article 13 of the Regulation, as well as Article 2-ter of the Code. Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing or related processing operations), Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, all violations are subject to the penalty provided for in Article 83, para 5, of the Regulation, as also referred to in Article 166, para 2, of the Code, the total amount of the fine shall be set at up to 20,000,000 euros. In this context, and considering, in any case, that the conduct has ceased to have any effect—given that the Company, during the proceedings, stated that it had deactivated and removed the video devices located in the locker rooms, as well as having adopted measures to ensure, more generally, that its video surveillance systems comply with data protection regulations—the conditions for adopting further corrective measures under Art 58(2) of the Regulation do not apply.

applies Art. 5(1)(a), Art. 5(1)(e), Art. 6(1)(c), Art. 6(1)(e), Art. 12(1), Art. 2, Art. 11, Art. 13, Art. 83

Adoption of the injunction ordering the imposition of the administrative fine and ancillary sanctions (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative sanction of publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). In this regard, taking into account Article 83(3) of the Regulation, in the present case the violation of the aforementioned provisions is subject to the application of the administrative fine provided for in Article 83(5) of the Regulation. The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account that: although the cameras were activated for an extended period of time within areas where there is a high expectation of confidentiality, such as the changing rooms of a swimming pool, the Company has stated that the cameras only captured the lockers used for storing personal belongings and did not capture the changing rooms, shower facilities, or restrooms (see Art. 83(2)(a) of the Regulation); the violation was committed through negligence (see Article 83(2)(b) of the Regulation); the processing was not expressly carried out for the purpose of collecting and subsequently processing personal data belonging to the special categories referred to in Article 9 of the Regulation (see Article 83(2)(g) of the Regulation); it is considered that, in the present case, the severity of the infringement committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the Calculation of Administrative Fines under the GDPR” of May 24, 2023, paragraph 60). That said, considering that the controller is an agency of the Municipality of Trento, which has approximately 119,000 inhabitants, it is considered that, for the purposes of determining the amount of the fine, the following circumstances should be taken into account: the Company cooperated fully with the Authority during the investigation and, moreover, ordered the deactivation of the cameras installed in the locker rooms a few days after receiving the notice of the administrative violation (see Art. 83, para. 2, subpar. f), of the Regulation); there are no prior relevant violations committed by the Company (see Art. 83, para. 2, subpar. e), of the Regulation). In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the monetary penalty shall be set at 8,000 (eight thousand) euros for the violation of Articles 5, para 1, subparagraphs (a) and (e); 6, para 1, subparagraphs (c) and (e), 12(1), and 13 of the Regulation, as well as Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83(1) of the Regulation, to be effective, proportionate, and dissuasive. It is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the fact that the processing took place in locations—such as the changing rooms of a swimming pool—which, by their very nature, are characterized by a particular expectation of confidentiality and protection of personal privacy and dignity. Finally, it is noted that the conditions set forth in Art. 17 of Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY declares, pursuant to Art. 57(1)(f) of the Regulation, that the processing carried out by the Special Agency for the Management of Sports Facilities of the Municipality of Trento is illegal (A.S.I.S.) is unlawful due to a violation of Articles 5(1)(a) and (e), 6(1)(c) and (e), 12(1), and 13 of the Regulation, as well as Article 2-ter of the Code, as set forth in the reasoning; ORDERS that the Special Agency for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S.), represented by its pro tempore legal representative, with registered office at Via 4 Novembre, 23/4 - 38121 Trento (TN), Tax ID No. 01591870223, to pay the sum of 8,000 (eight thousand) euros as an administrative fine for the violations indicated in the grounds of this decision. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine; ORDERS the aforementioned Company, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, to pay the sum of 8,000 (eight thousand) in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; - Pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, this order shall be published on the Authority’s website; - Pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, on pain of inadmissibility, within thirty days from the date of notification of the decision itself, or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Ghiglia THE SECRETARY GENERAL Montuori SEE ALSO Newsletter of September 11, 2026 [Web Doc. No. 10294255] Decision of September 3, 2026 Register of Decisions No. 619 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter “the Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the duties and the exercise of the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Dr. Agostino Ghiglia; PREAMBLE 1 Introduction. The Authority has learned from press reports and several complaints that video surveillance cameras were allegedly found inside a locker room, intended for use by users, at a swimming pool managed by the Special Agency for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S. — hereinafter, the “Agency”). 2 The Preliminary Investigation. In response to two requests for information made pursuant to Article 157 of the Code (see letters dated October 29, 2025, Ref. No. 0143564, and January 13, 2026, Ref. No. 0003526), the Company, in notes Ref. Nos. 19111 dated November 5, 2025, and 1057 dated January 19, 2026, stated, in particular, that: - “[…] the incident pertains to the Trento Nord Sports Center—Gardolo district, managed [by the Company]. Video surveillance at this facility, indicated by specific signage at the entrance […], covers the lockers […] designated for users, where they store their personal belongings for the time necessary to participate in sports activities”; - “this is in no way a matter of monitoring employees […], who are incidentally ‘captured’ by this video system, but rather of Users […] of the outdoor pool”; - “The changing rooms, showers, and restrooms are not subject to video recording in any way”; - “near the lockers […] there are no benches or chairs that might encourage those undressing to sit there and thus be captured by the video system”; - “signs are posted at the entrance to the facility [… and] the data is retained for 72 hours”; - “These recordings are not viewed in real time on a peripheral monitor, and […] the controller […] has designated two individuals responsible for processing personal data from the video surveillance system […]. These two officials may engage in data processing only at the request of judicial or public safety authorities”; - “The Trento Nord facility has, on several occasions in the recent past, been the site of thefts of users’ wallets and cell phones, due to the actions of criminals who broke into the lockers intended for storing users’ personal belongings at the pool. This negative conduct has certainly limited the practice of sports—swimming in particular—due to the lack of security and the resulting sense of unease among users”; - “A.S.I.S. on September 13, 2007, in accordance with the provisions of Art. 4 of Law No. 300/1970, entered into an agreement with the company’s union representatives for the installation of video surveillance in the sports facilities under its management.” By letter dated May 16, 2026 (Ref. No. 0075624), the Office, based on the evidence gathered, the inspections conducted, and the facts that emerged following the preliminary investigation, notified the Company, pursuant to Article 166, paragraph 5, of the Code, the initiation of proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation, for having conducted personal data processing using video devices in a manner that did not comply with the principles of lawfulness, fairness, and transparency and in the absence of a legal basis, in violation of Articles 5(1)(a), 6(1)(c) and (e), and 2-ter of the Code; for failing to ensure the necessary transparency of the processing with respect to data subjects (users and employees), in violation of Articles 5(1)(a), 12(1), and 13 of the Regulation; for failing to ensure compliance with the principle of storage limitation, in violation of Article 5 of the Regulation. In the same notice, the aforementioned data controller was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). In a letter dated May 29, 2026 (Ref. No. 0009183), the Company submitted a defense brief, stating, in particular, that: by means of “Emergency Order No. 3 dated May 26, 2026 [… the Company] implemented certain technical and organizational measures […] consistently complying with the [Data Protection Authority’s] instructions following notification [of the allegation of an administrative violation]”; in particular, “the following was immediately ordered and carried out as early as May 18, 2026 […] the cameras located in the locker rooms of the Sovecar Trento Nord (Gardolo) sports facility were turned off, thereby ending their recordings and planning for their removal”; “as early as April […] the first-level privacy notice […] was posted at the entrance and inside every room where video surveillance is installed, indicating the processing purpose, the identity of the controller, the procedures for exercising the rights of data subjects, the contact information for the data protection officer, the link to the company website where the complete privacy notice regarding the processing of personal data through video surveillance systems (second-level privacy notice) is available, and the storage period for data collected by the video surveillance system”; “A.S.I.S. has complied with the requirements regarding the provision of specific information on the processing of personal data through the video surveillance system monitoring employees, in particular by notifying the employees of the privacy notice and publishing it on the company’s official website.” During the hearing, requested pursuant to Article 166, paragraph 6, of the Code and held on July 7, 2026 (see minutes, ref. no. 0205336, dated July 8, 2026), the Company stated, in particular, that: “[it] took prompt action to deactivate the video surveillance cameras and cease the processing in question; […] revised the storage periods for video surveillance footage (12/24 hours); and updated the signage at the facilities”; “[it] acted in complete good faith, for the sole purpose of protecting Users, given the numerous incidents of theft that have occurred over time”; “in April–May 2026, the Company installed signs informing users about video surveillance at the entrance to each facility where video surveillance cameras are in operation”; “in June 2026, the Company provided employees with a privacy notice regarding the processing of personal data through video surveillance devices.” 3 Outcome of the preliminary investigation. 3.1 Lawfulness of the processing. Public entities may, as a general rule, process personal data if the processing is necessary to comply with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority (see Articles 5(1)(a) and 6, para 1), paragraph 1, subparagraphs c) and e), and paragraphs 2 and 3 of the Regulation, and Article 2-ter of the Code), provided that compliance with data protection principles must be ensured in all cases (see Articles 5, 24, and 25 of the Regulation) must be ensured in all cases, including, in particular, the principles of “lawfulness, fairness, and transparency” and “data minimisation,” pursuant to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject” and “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Article 5, para 1, subparagraphs (a) and (c), of the Regulation). Following the preliminary investigation—initiated based on press reports and a complaint—it was determined that, since 2007, the Company has installed and activated, inside the locker rooms of the swimming pool at the “Trento Nord” sports facility in Gardolo (Trento), several video surveillance cameras that record the lockers where users can store their personal belongings for the time necessary to participate in sports activities, in order to prevent or investigate any thefts. In this regard, it should be noted that, as the Data Protection Authority has long emphasized, “the need to ensure […] a high level of protection of fundamental rights and freedoms with regard to the processing of personal data allows for the use of video surveillance systems, provided that this does not result in an unjustified interference with the fundamental rights and freedoms of the data subjects” and provided that “compliance is ensured not only with data protection regulations but also with other applicable legal provisions, such as, for example, the current civil and criminal laws regarding unlawful interference in private life [and] the remote monitoring of employees” (General Provision on Video Surveillance of April 8, 2010, at www.gpdp.it, web doc. no. 1712680, sect. 2, para 4; but see also the previous general provision of April 29, 2004, at www.gpdp.it, web doc. no. 003482, para. 2.1, which referred to “the applicable provisions of civil and criminal law regarding unlawful interference in private life, the protection of dignity, image, the home, and other places afforded similar protection (restrooms, hotel rooms, booths, changing rooms, etc.) […as well as] the provisions concerning the protection of workers, with particular reference to Law 300/1970 (Workers’ Statute).” With particular regard to the use of video surveillance systems within premises used as changing rooms, the Data Protection Authority has consistently reaffirmed that these are places which, by their very nature, are characterized by a particular expectation of confidentiality and protection of personal privacy and dignity (see, in particular, decisionsNo. 357 of July 10, 2014, web doc. No. 3325380, and No. 1576125 of December 4, 2008). The processing of personal data through video surveillance systems installed inside rooms used as changing rooms is therefore, as a general rule, excessively intrusive and constitutes a violation of confidentiality and dignity of the individuals who use those rooms. It must also be noted that the installation of video surveillance cameras in the workplace must always comply with the regulations governing indirect monitoring of work activities. As consistently reiterated in the Data Protection Authority’s rulings, data processing resulting from the use of technological tools in places where work activities also take place finds its legal basis in the sector-specific regulations set forth in Art. 4 of Law No. 300/1970, expressly referenced in Art. 114 of the Code. This provision, in fact, uniformly defines at the national level the scope of permitted processing in every workplace context (public and private) and constitutes, within the domestic legal system, a more specific provision offering greater safeguards than those set forth in Art. 88 of the Regulation, compliance with which is a condition for the lawfulness of the processing (see Articles 5(1)(a) and 6(1)(c) of the Regulation). In this context, on September 13, 2007, the Company entered into a union agreement, pursuant to Art. 4 of Law No. 300/1970, also with regard to the “Trento Nord Sports Center” and the “surveillance cameras in the men’s locker room [installed there, which] exclusively capture the lockers and access to the pools (6 cameras); surveillance cameras in the women’s locker room (which exclusively monitor the lockers and access to the showers) (6 in number); a camera at the main entrance to the locker rooms (lobby area) […].” In this context, the Company’s legitimate purposes of protecting its property—which fall within the scope of those strictly permitted under Article 4 of Law No. 300/1970—cannot, however, justify the processing of Users’ personal data, as there is a clear disproportion between that purpose and the fundamental rights and freedoms of the data subjects (see, albeit with reference to the different legal basis of legitimate interest, European Data Protection Board, “Guidelines 3/2019 on the processing of personal data through video devices,” adopted on January 29, 2020, para. 30). Given this disproportion in the use of video surveillance within the premises used as locker rooms, not even the union agreement entered into pursuant to Art. 4 of Law 300/1970 could legitimize such processing of personal data, since the parties cannot enter into commitments or regulate the matter of indirect monitoring of work activities in a manner that conflicts with the basic principles of data protection, particularly with regard to the requirements of necessity and proportionality of processing (see Art. 5 of the Regulation; see Court of Justice of the European Union, Judgement C‑65/23, K GmbH (Processing of Employees’ Personal Data), of December 19, 2024, para. 59; see, most recently, Order No. 42 of January 29, 2026, web doc. No. 10222864). Nor has the Company, for the purposes of complying with the principles of necessity and proportionality of processing, adequately demonstrated that it had previously assessed, before commencing processing, the existence of any alternatives that would be equally effective in ensuring the protection of assets but less invasive of the rights and freedoms of data subjects, such as, for example, the use by users of personal padlocks, which “can be just as effective as video surveillance systems against theft and vandalism.” The data controller, in fact, must “assess on a case-by-case basis whether such measures could be a reasonable solution,” including during the data protection impact assessment (see Article 35(7)(b) of the Regulation). In this regard, the data protection impact assessment conducted by the Company (on file) is, in fact, limited to stating, in an apodictic manner, that “the data are relevant and adequate for the purposes and limited to what is necessary.” In light of the foregoing considerations, it must be concluded that the processing of the personal data of pool users within the locker rooms was carried out by the Company in a manner inconsistent with the principles of lawfulness, fairness, and transparency and in the absence of a legal basis, in violation of Articles 5, (1)(a), (6)(1)(c) and (e), as well as Article 2-ter of the Code. 3.2 Transparency toward data subjects. When video surveillance devices are used, the controller, in addition to providing first-level information by posting warning signs near the area under video surveillance, must also provide data subjects with “second-level information,” which must “contain all the mandatory elements required under Article 13 of the [Regulation]” and “be easily accessible to the data subject, for example through a comprehensive information page made available at a central location […] or posted in an easily accessible place” (“Guidelines 3/2019 on the Processing of Personal Data through Video Devices,” op. cit., specifically para. 7; but see also the Data Protection Authority’s “Provision on Video Surveillance” of April 8, 2010, cited above, in particular para. 3.1; most recently, see the Data Protection Authority’s FAQ No. 4 on video surveillance dated December 3, 2020, web doc. No. 9496574). First-level information (warning sign) “should convey the most important details, such as the processing purpose, the identity of the controller, and the existence of the data subject rights, along with information on the most significant impacts of the processing” (Committee Guidelines, op. cit., para 114). Furthermore, the signage must also include information that might come as a surprise to the data subject. This could include, for example, the transfer of data to third parties—particularly if they are located outside the EU—and the data storage period. If such information is not provided, the data subject should be able to rely on the fact that there is only real-time surveillance, without any data recording or transfer to third parties (ibid., para. 115). The first-level warning signage must contain a clear reference to the second level of information, for example by indicating a website where the text of the extended privacy notice can be consulted. In the present case, the Company submitted to the court a copy of the “sign posted at the entrance to the facility”. As highlighted by the European Data Protection Board, “the information should be positioned so as to allow the data subject to easily recognize the circumstances of the Surveillance before entering the monitored area (approximately at eye level).” It is not necessary to disclose the camera’s location, provided there is no doubt as to which areas are subject to Surveillance and the context of the Surveillance is made unequivocally clear […]. The data subject must be able to assess which area is covered by a camera in order to avoid Surveillance or adjust their behavior, if necessary” (“Guidelines 3/2019 on the Processing of Personal Data through Video Devices,” op. cit., para. 113). Therefore, for the purposes of achieving the necessary level of transparency in processing with respect to data subjects, it is insufficient to install an informational sign—containing the first-level privacy notice—only at the entrance to the facility, as this solution does not make data subjects aware of the presence of video surveillance cameras in specific areas of the facility—especially in those areas, such as changing rooms, where the legitimate expectation of confidentiality is greatest. In light of the foregoing considerations and given that the sign containing the general notice was not also posted at the entrance to the changing rooms, the Company’s conduct is contrary to the principles of lawfulness, fairness, and transparency and violates Articles 5(1)(a), 12(1), and 13 of the Regulation. With regard to the processing of employees’ personal data through the same video surveillance system, implemented pursuant to Art. 4 of Law No. 300/1970 and Art. 114 of the Code, the Company stated that it provided employees with a specific privacy notice only in June 2026; it has therefore been established that, during the preceding period, the Company acted in violation of Articles 5(1)(a), para 1, 12, para 1, and 13 of the Regulation. 3.3 Storage Limitation. Based on the principle of “storage limitation,” personal data must be “stored in a form that permits identification of data subjects for no longer than is necessary to fulfill the purposes for which the personal data are processed” (Article 5(1)(e) of the Regulation). When video surveillance is used for property protection purposes, “personal data should—in most cases […]—be deleted after a few days, preferably through automated mechanisms. The longer the intended storage period (especially if it exceeds 72 hours), the more thoroughly the analysis regarding the legitimacy of the purpose and the necessity of storage must be substantiated” (“Guidelines 3/2019 on the Processing of Personal Data via Video Devices,” op. cit., para. 121; see also the general provision on video surveillance dated April 8, 2010, para. 3.4, where, within the context of the previous legal framework on data protection, it was emphasized that “storage must be limited to a few hours or, at most, to the twenty-four hours following the recording, subject to special requirements for further storage […]”). In the present case, the preliminary investigation revealed that the Company retained video surveillance footage for seventy-two hours. However, there is no evidence that it had conducted any assessment, prior to commencing the processing, regarding the necessity of retaining said footage for that period of time. The data protection impact assessment, included in the case file, is in fact limited to stating categorically that “the data storage period is limited (based on laws, Regulations, or organizational policies).” It must therefore be concluded that the Company acted in violation of Article 5(1)(e) of the Regulation. 4 Conclusions. In light of the assessments outlined above, it is noted that the statements made by the controller during the preliminary investigation—for the veracity of which the controller may be held accountable pursuant to Article 168 of the Code—although worthy of consideration, do not suffice to rebut the findings notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings, as none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The Office’s preliminary assessments are therefore confirmed, and the processing of personal data by the Company is found to be unlawful, as it carried out the processing of personal data using video devices in violation of Articles 5(1)(a) and (e), Article 6(1)(c) and (e), Article 12(1), and Article 13 of the Regulation, as well as Article 2-ter of the Code. Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing or related processing operations), Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, all violations are subject to the penalty provided for in Article 83, para 5, of the Regulation, as also referred to in Article 166, para 2, of the Code, the total amount of the fine is to be set at up to 20,000,000 euros. In this context, and considering, in any case, that the conduct has ceased to have any effect—given that the Company, during the proceedings, stated that it had deactivated and removed the video devices located in the locker rooms, as well as having adopted measures to ensure, more generally, that its video surveillance systems comply with data protection regulations—the conditions for adopting further corrective measures under Art 58, para 2, of the Regulation do not apply. 5 Adoption of the injunction order imposing the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction order, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). In this regard, taking into account Article 83(3) of the Regulation, in the present case, the violation of the aforementioned provisions is subject to the imposition of the administrative fine provided for in Article 83(5) of the Regulation. The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by giving due consideration to the factors set forth in Article 83(2) of the Regulation. Taking into account that: although the cameras were activated for an extended period of time within areas where there is a high expectation of confidentiality, such as the locker rooms of a swimming pool, the Company stated that the cameras only filmed the lockers used to store personal belongings and not the changing booths, shower facilities, or restrooms (see Art. 83(2)(a) of the Regulation); the violation was committed through negligence (see Article 83(2)(b) of the Regulation); the processing was not expressly carried out for the purpose of collecting and subsequently processing personal data belonging to the special categories referred to in Article 9 of the Regulation (see Article 83(2)(g) of the Regulation); it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, considering that the controller is an agency of the Municipality of Trento, which has approximately 119,000 inhabitants, it is considered that, for the purposes of determining the amount of the fine, the following circumstances should be taken into account: the Company cooperated fully with the Authority during the investigation and, moreover, ordered the deactivation of the cameras installed in the locker rooms a few days after receiving the notice of the administrative violation (see Art. 83, para. 2, subpar. f), of the Regulations); there are no prior relevant violations committed by the Company (see Art. 83, para. 2, subpar. e), of the Regulations). In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the monetary penalty shall be 8,000 (eight thousand) euros for the violation of Articles 5, para 1, subparagraphs (a) and (e), 6, para 1, subparagraphs (c) and (e), 12, para 1, and 13 of the Regulation, as well as Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. It is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the fact that the processing took place in locations—such as the changing rooms of a swimming pool—that, by their very nature, are characterized by a particular expectation of confidentiality and protection of personal privacy and dignity. Finally, it is noted that the conditions set forth in Art. 17 of Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY declares, pursuant to Art. 57(1)(f) of the Regulation, that the processing carried out by the Special Agency for the Management of Sports Facilities of the Municipality of Trento is illegal (A.S.I.S.) to be unlawful due to a violation of Articles 5(1)(a) and (e), 6(1)(c) and (e), 12(para 1), and 13 of the Regulation, as well as Article 2-ter of the Code, as set forth in the reasoning; ORDERS that the Special Agency for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S.), represented by its pro tempore legal representative, with registered office at Via 4 Novembre, 23/4 - 38121 Trento (TN), Tax ID No. 01591870223, to pay the sum of 8,000 (eight thousand) euros as an administrative fine for the violations indicated in the grounds. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine; ORDERS the aforementioned Company, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, to pay the sum of 8,000 (eight thousand) in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Authority’s website; - Pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2 of the Regulation, in the Authority’s internal register provided for by Article 57, para 1, letter u) of the Regulation. Pursuant to Articles 78 of the General Data Protection Regulation, 152 of the Code, and 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, on pain of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Ghiglia THE SECRETARY GENERAL Montuori

applies Art. 5(1), Art. 5(1)(a), Art. 5(1)(e), Art. 6(1)(c), Art. 6(1)(e), Art. 12(1), Art. 35(7)(b), Art. 57(1)(f), Art. 57(1)(u), Art. 58(2), Art. 58(2)(i), Art. 83(1), Art. 83(2), Art. 83(2)(a), Art. 83(2)(b), Art. 83(2)(g), Art. 83(3), Art. 83(5), Art. 2, Art. 4, Art. 5, Art. 6, Art. 9, Art. 10, Art. 11, Art. 12, Art. 13, Art. 15, Art. 16, Art. 17, Art. 18, Art. 24, Art. 25, Art. 27, Art. 37, Art. 57, Art. 58, Art. 78, Art. 83, Art. 88 , Law 300/1970 Art. 4