Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Cat s.r.l.: Insufficient legal basis for data processing
The Italian DPA has fined Cat s.r.l.
Full text
The Italian DPA has fined Cat s.r.l. EUR 10,000. Cat s.rl. had installed CCTV systems near waste garbage cans on behalf of the municipality of Modica in order to combat illegal waste disposal. During its investigation, the DPA found that Cat processed personal data collected by the cameras without a valid legal basis.
Industry: Industry and Commerce
How it connects
Related across sources
42 K 51.25 VG Berlin: DPA correctly found residential video surveillance for property protection The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was… Administrative Court Berlin Apr 20, 2026 Legitimate Interest Supervisory Authorities Retention Period
703/2026 Sibiu Tribunal: rail company liable for refusal of CCTV access request On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the… Jul 3, 2026 Right of Access Personal Data Legitimate Interest
7890/2026 BAC (Bulgaria) - 7890/2026 A data subject lodged a complaint with the Bulgarian DPA (CPDP), alleging that her neighbour (the controller) was unlawfully monitoring her property through CCTV. She claimed that… Jul 13, 2026 Integrity and Confidentiality Principle Personal Data Controllers
CJEU: Camera image of identifiable person constitutes personal data Personal data: The image of a person recorded by a camera constitutes personal data because it makes it possible to identify the person concerned. (¶ 22) Dec 11, 2014 Personal Data Legitimate Interest Identification
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) CJEU Jun 5, 2018 IP Address Controllers Processors