Comune di Curtarolo: Insufficient legal basis for data processing

The Italian DPA has imposed a fine of EUR 15,000 on the Comune di Curtarolo. The controller used surveillance footage in disciplinary proceedings against an employee, and also ordered other employees to spy on the employee in question and take pictures and videos of them.

GDPR Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1), c), e), (2), (3) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 88 GDPR
Industry: Employment