Italian DPA fines butcher €1,500 for unlawful video surveillance lacking information signs

27 April 2016 (hereinafter the "Regulation"); SEEN Legislative Decree No. 196 of June 30, 2003 (Personal Data Protection Code, hereinafter the "Code") as amended by Legislative Decree No. 196 of August 10, 2018; 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679"; SEEN Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, in gpdp.it, web doc. No. 9107633 (hereinafter "Regulation No. 1/2019"); SEEN the documentation in the file; SEEN the observations made by the Secretary General pursuant to Article 15 of Regulation No. 1/2000; REPORTER: Dr. Agostino Ghiglia; WHEREAS

In a letter dated March 10, 2023, the Local Police Command of the City of Rionero in Vulture forwarded to this Authority the report of the inspection carried out, at the request of the Potenza ATER, at the business called "Macelleria La Costata s.r.l.s." located in Rionero in Vulture (PZ), at Via Tommaso Fiore 8 The inspection revealed the non-compliant installation of a video surveillance system consisting of three cameras (one of which was non-functional) positioned in two external areas of the business. Specifically, the report states that: • the two cameras positioned in front of the business, one of which was non-functional, framed "the entrance to the butcher's shop, the parking area in front, and part of the public road called Via Amendola of the Municipality of Rionero in Vulture (PZ)"; • The third camera, positioned on the perimeter wall of the commercial business, was capable of filming "the lateral parking area and part of the public road called Via Amendola in the Municipality of Rionero in Vulture (PZ)". The Local Police Headquarters also noted the absence of signs informing about the presence of the aforementioned cameras. The inspection report also states that the condominium's authorization for the video surveillance system had not been obtained.

In light of the documents submitted by the Local Police, with a note dated July 10, 2023 (ref. no. 106027), the Office notified the data controller of the initiation of the sanctioning procedure pursuant to Article 166, paragraph 5, of the Code, which is hereby referred to, in relation to the violation of Articles 5, paragraph 1, letter a), 6, and 13 of the Regulation.

Despite being invited to submit written defenses in relation to the sanctioning proceedings against him, the data controller has not responded to the Authority.

Given that the use of video surveillance systems entails the processing of personal data pursuant to Article 4, paragraph 1, point 2, of the Regulation, this processing must be carried out in compliance with the personal data protection regulations and, where directly relevant here, the principles set forth in Article 5, paragraph 1, point (a) of the Regulation, in particular the principle of lawfulness and transparency. The latter principle translates into the data controller's duty to provide information regarding the processing carried out through the video surveillance system pursuant to Article 13 of the Regulation. To this end, therefore, with particular reference to processing carried out using video surveillance systems, "data subjects must always be informed that they are about to enter a video-monitored area"; hence the need for the data controller to provide suitable information signs so that data subjects are made "aware of the fact that a video surveillance system is in operation." In this regard, the Garante has long provided its own guidance (see point 3.1. of the provision of 8 April 2010, web doc. no. 1712680; see also the FAQs on video surveillance, published on the Authority's website; for a similar individual case, see provision of 6 July 2023, no. 293, web doc. no. 9920881). Similarly, the European Data Protection Board, with Guidelines no. 3/2019 on the processing of personal data through video devices, specified that "the most important information must be indicated [by the controller] on the warning sign (see [the first level]), while further mandatory details may be provided by other means (second level)" (see [point 7]). The same guidelines also state that "such information may be provided in combination with an icon to provide, in a clearly visible, intelligible, and legible manner, an overview of the intended processing (Article 12, paragraph 7, of the GDPR). The format of the information should be adapted to the various locations." This information should also be positioned in such a way as to allow the data subject to easily recognize the circumstances of the surveillance before entering the monitored area (approximately at eye level), to allow them "to estimate which area is covered by a camera so as to avoid surveillance or adjust their behavior, if necessary." Finally, according to the guidelines contained in the general provision on video surveillance of April 8, 2010, when filming areas outside buildings and properties, the processing must be carried out "in such a way as to limit the viewing angle to the area actually to be protected, avoiding filming surrounding areas and irrelevant details (streets, buildings, commercial establishments, institutions, etc.)" (see, in particular, point 6.2.2.1 of the provision). Similarly, the aforementioned Guidelines No. 3/2019 state that, "in general, the need to use video surveillance to protect the Data Controller's premises ends at the property boundaries. However, for effective protection, in some cases it may be necessary to extend video surveillance to the immediate vicinity of the premises. In this context, the Data Controller should consider physical and technical means, such as blocking or pixelating irrelevant areas" (3.1.2 par. 27).

The processing of personal data carried out in this case by the data controller through the video surveillance system did not comply with the above-mentioned regulatory framework. In fact, based on the aforementioned inspection report and related photographic documentation, it emerged that the video surveillance system in question, active and functioning as described above, was not equipped with appropriate information signs. This conduct violates the principle of transparency of processing pursuant to Article 5, paragraph 1, letter a) of the Regulation, as well as the disclosure obligations, even in simplified form, specifically provided for by Article 13 of the Regulation, pursuant to which the data controller is required to provide data subjects with all information relating to the essential characteristics of the processing performed.

Furthermore, the local police report confirmed that the cameras were capable of recording areas other than those under the exclusive ownership (specifically, the public parking area in front of and to the side of the business entrance and part of the public road). Consequently, the related processing was unlawful, as it violated Article 6 of the Regulation, as it lacked any legal basis. The data controller did not refer to any of the circumstances indicated in Article 6, either during the investigation or subsequently in responding to the notification issued by the Office pursuant to Article 166 of the Code.

In light of these considerations, the Authority finds the processing carried out by the data controller to be unlawful, as it violated Articles 5, paragraph 1, letter a), 6, and 13 of the Regulation. The violation established in the terms set out in the reasons cannot be considered "minor," given its nature, the degree of responsibility, and the manner in which the supervisory authority became aware of the violation (see recital 148 of the Regulation). Therefore, once the unlawfulness of the conduct described above has been established, an injunction order must be issued pursuant to Article 58, paragraph 2, letter i) of the Regulation for the application of an administrative pecuniary sanction.

Injunction Order The Garante, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83, paragraph 1, letter i). 5 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of 24 November 1981) in relation to the processing of personal data carried out by the data controller using the aforementioned video surveillance system, in the absence of the information required by Article 13 of the Regulation and capable of filming public roads, in violation of Articles 5(1)(a) and 6 of the Regulation. With reference to the elements listed in Article 83(2) of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must be "effective, proportionate and dissuasive in each individual case" (Article 83(1) of the Regulation), in this case the following circumstances were taken into consideration: a. with regard to the nature, severity and duration of the violation, consideration was given to the conduct of the data controller, the liability associated with the failure to comply with the obligation to provide information to the data subjects – which has, moreover, been the subject of numerous provisions by the Guarantor over time (both of an individual nature and containing general indications: see, in particular, the aforementioned provisions of 29 April 2004 and 8 April 2010) and to a consolidated case law (see Cass. civ., Sect. II, 2 September 2015, no. 17440; Cass. civ., Sect. II, 5 July 2016, no. 13633) – as well as the fact that the unlawful conduct could have affected a large number of data subjects due to the nature of the public establishments of the places subject to video surveillance and the proven suitability of the video surveillance system to film public areas or areas open to the public; b. As a mitigating factor, the data controller's lack of specific prior history of violations of personal data protection legislation. Based on the above factors, assessed as a whole, and the principles of effectiveness, proportionality, and dissuasiveness set forth in Article 83, paragraph 1, of the Regulation, it is deemed appropriate to set a fine of €1,500.00 (one thousand five hundred) for violation of Articles 5, paragraph 1, letter a), 6, and 13 of the Regulation. NOW CONSIDERING ALL THE ABOVE, THE AUTHORITY declares, pursuant to Articles 57, paragraph 1, letter f), and 83 of the Regulation, the unlawfulness of the processing described above, carried out by the data controller identified in the preamble (point 1), in violation of Articles 5, paragraph 1, letter a), 6, and 13 of the Regulation; ORDER the data controller to pay the sum of €1,500.00 (one thousand five hundred) as an administrative fine for the violations indicated in the grounds; ORDERS the same data controller: to pay the sum of €1,500.00 (one thousand five hundred), according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. In this regard, it is noted that, pursuant to Article 166, paragraph 8, of the Code, the violator retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half the fine imposed within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 689/1981 of 1 September 2011. 150, provided for the filing of an appeal as indicated below; pursuant to Articles 58, paragraph 2, letter d), of the Regulation, to bring the processing of personal data into conformity with the Regulation within thirty days of notification of this provision, by: providing information to data subjects through appropriate signage; orienting the cameras that comprise the video surveillance system so as not to film public spaces or condominium areas; ORDERS pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Guarantor Regulation No. 1/2019, the publication of this provision on the Guarantor's website, omitting the VAT number; pursuant to Article 17 of the Guarantor Regulation No. 1/2019, the recording of violations and the measures adopted in accordance with Article 58, paragraph 2 of the Regulations, in the Authority's internal register provided for by Article 57, paragraph 1, letter u), of the Regulations. Pursuant to Article 78 of the Regulations, Articles 152 of the Code, and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the decision itself, or within sixty days if the appellant resides abroad. Rome, January 16, 2026 THE PRESIDENT Stanzione THE REPORTER Ghiglia THE SECRETARY GENERAL Montuori