Garante per la protezione dei dati personali (Italy) - 9838992

Garante per la protezione dei dati personali - 9838992
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 13 GDPR Article 58(2)(d) GDPR Article 114 Legislative Decree No. 196/2003 Article 157 Legislative Decree No. 196/2003
Type:	Investigation
Outcome:	Violation Found
Started:	11.11.2020
Decided:	01.12.2022
Published:	01.12.2022
Fine:	6,000 EUR
Parties:	Naija Market International
National Case Number/Name:	9838992
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	cmart

The Italian DPA fined a grocery store operator €6,000 for installing a video surveillance system which could allow the monitoring of its employees without providing the requisite information notice, in violation of Articles 5 and 13 GDPR and the special rules on collection of employee personal data in Italian Law.

English Summary

Facts

Following a report received from the police on 15 July 2020, the Italian DPA sent two requests for information to the owner of Naija Market International, the controller, a company engaged in the grocery business in Modena. These requests sought further information regarding the installation of a video surveillance system on store premises. After the controller did not comply with the requests, the Italian DPA carried out an inspection at the controller's two operating sites, which revealed the presence of video surveillance cameras filming interior spaces of the establishments and therefore potentially suitable for monitoring the work activities of the controller's employees. The cameras were operating in the absence of the appropriate information signs, an alleged violation the Article 5(1)(a) GDPR principle of lawfulness, fairness, and transparency, and the transparency obligations in Article 13 GDPR. Furthermore, the surveillance system was installed without first obtaining permission from the territorially competent Labour Department, in violation of Italian Law.

Responding to the allegations, the controller claimed to be unaware of the obligation to inform the Labour department and, because they are a foreign national, unable to understand the particularly technical data protection regulation. Moreover, the controller argued that the conduct involved only 3 employees, and therefore this was only a minor violation.

Holding

The Italian DPA did not accept the controller's submissions, and held that the use of the video surveillance system constituted a processing of personal data which had to be carried out in accordance with the general principles contained in Article 5 GDPR, in particular the principle of transparency. In this case, the processing had not been signalled in any way and the controller failed to provide any information notice to its employees. According to the Italian DPA, the controller therefore violated Article 5(1)(a) and 13 GDPR.

In addition, the Italian DPA held that the processing had also been carried out in violation of Article 114 of Legislative Decree No. 196/2003 (the Privacy Code). Article 114 Privacy Code introduces a special regime regarding the processing of employees' personal data, in line with the provisions of Article 88 GDPR; which allows for Member States to provide more specific rules to ensure the protection of data subject rights and freedoms in this context. Article 114 Privacy Code stipulates that in the case of processing that can result in remote monitoring of workers it is necessary to comply with Article 4, Law No. 300/1970 (Statute of Workers). Article 4 Statute of Workers stipulates that in such cases, video surveillance equipment can be used after entering into a collective agreement with the trade union representation or, where this is not possible, after obtaining prior authorisation from the competent work council. Given that the installation of the video surveillance system had not been previously authorised by the work council, the processing violated Article 114 Privacy Code.

Lastly, by failing to reply to the Italian DPA's request within the prescribed time limit, the controller also breached the obligation to provide the information requested by the DPA under Article 157 Privacy Code.

Therefore, the Italian DPA held that the controller had violated Articles 5(1)(a) and 13 GDPR, in addition to Articles 114 and 157 of the Privacy Code. Pursuant to Article 58(2)(i) GDPR and 83 GDPR, the DPA imposed an administrative fine of €6,000.00, and an order to affix the required information signs, to obtain to required permission from the Labour Department, and communicate the steps taken in this respect within 90 days from the date of notification of the order.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web no. 9838992]

Injunction order - 1 December 2022

Register of measures
no. 407 of 1 December 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation");

HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";

HAVING REGARD TO the report of the Guardia di Finanza - Special unit for the protection of privacy and technological fraud, sent with a note dated 12.17.2021, which refers to an inspection carried out on 16 and 17 November 2021, in the two operating offices of the sole proprietorship Naija Market International by Isidahomhen Joy, operating the business of "Minimarkets and other non-specialized food outlets" with two offices in Modena, Viale Francesco Crispi 6 and Via Antonio Gramsci 11, with which the presence of functioning video surveillance cameras missing the affixes was ascertained information signs and the guarantees provided for by art. 4 of Law 300/1970 referred to in art. 114 of the Code;

HAVING EXAMINED the documentation in the deeds;

HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER prof. Pasquale Stanzione;

WHEREAS

1. The report received and the start of the procedure.

With a note received on 15.7.2020, the local police of the Municipality of Modena transmitted the service report of a check carried out, on 30.5.2020, at the commercial establishment called "Joy Unique Collection" located in Modena, Via Francesco Crispi 6 , reporting the presence, inside the premises, of 3 video surveillance cameras functioning in the absence of the prescribed information signs.

Having not received a response to either the request for information of 11.11.2020 or the subsequent request made pursuant to art. 157 of the Code, the Office proceeded to notify the deed of initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of art. 157 of the Code (prot. n. 28851 of 25.5.2021) and to delegate control to the Guardia di Finanza - Special Unit for the protection of privacy and technological fraud.

With a note dated 12.17.2021, the report of the operations carried out on 16 and 17 November 2021 was sent to the two operating offices of the sole proprietorship "Naija Market International di Isidahomhen Joy", located in Modena, Viale Francesco Crispi 6 and Via Antonio Gramsci 11.

The aforementioned report reported the presence, at the headquarters in Via Crispi 6, of 3 functioning video cameras positioned inside the premises and, at the shop located in via Gramsci 11, of 8 functioning video cameras always located inside the premises.

Furthermore, the report reported that, although employees (identified in the report) operated at the aforesaid offices and filmed the video cameras of the internal spaces of the commercial establishments, it did not appear that the required authorization from the Inspectorate had been requested before the installation of the aforesaid systems territorially competent Labor Department.

With a note dated 12.19.2021, the lawyer Ivan Trubbas, on behalf of Ms Isidahomhen Joy, owner of the individual company Naija Market International of Isidahomhen, sent written defense declaring that "the violations in question were carried out unknowingly and in the most absolute good faith as Ms Isidahomhen Joy was not aware of the obligation (…) to seek authorization from the Labor Inspectorate. The owner of the company is in fact of foreign nationality and full knowledge of the privacy legislation, already particularly technical in itself, appears even more difficult. The violation can be considered not serious as it involved a limited number of employees, i.e. one employee in the shop in Via Crispi and two employees in the shop in Via Gramsci".

The party also declared that "as soon as he became aware of the legislation, the sign was immediately posted and the necessary authorization was requested from the Labor Inspectorate".

2. The legal framework of the treatment carried out

The use of video surveillance systems can determine, in relation to the positioning of the cameras and the quality of the images captured, the processing of personal data. This treatment must be carried out in compliance with the general principles contained in the art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-monitored area".

For this purpose, therefore, the data controller must affix suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - 8 April 2010 [1712680] (in this sense also the FAQs on video surveillance, published on the Authority's website).

Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "As regards video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while the further mandatory details can be provided by other means (second level). In the guidelines it is also foreseen that “Such information may be provided in combination with an icon to give, in a conspicuous, intelligible and clearly legible way, an overview of the intended treatment (article 12, paragraph 7, of the RGPD) . The format of the information will have to adapt to the various locations”. The information should be positioned in a way that allows the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) “to allow the data subject to estimate which area is covered by a camera in way to avoid surveillance or adjust their behavior, if necessary”.

The processing of personal data carried out in the context of the employment relationship, if necessary for the purpose of managing the relationship itself (see articles 6, paragraph 1, letter c); 9, par. 2, lit. b) of the Regulation), must take place in compliance with the general principles indicated by art. 5 of the Regulation, and in particular of the principle of lawfulness, on the basis of which the processing is lawful if it complies with the applicable sector regulations (Article 5, paragraph 1, letter a) of the Regulation). Consistent with this approach, the art. 88 of the Regulation is without prejudice to the national rules of greater protection ("more specific rules") aimed at ensuring the protection of rights and freedoms with regard to the processing of workers' personal data. The national legislator has approved, as a more specific provision, art. 114 of the Code which among the conditions of lawfulness of the treatment established the observance of the provisions of art. 4, law 20 May 1970, n. 300. The violation of the art. 88 of the Regulation is subject, if the requisites are met, to the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, letter. d) of the Regulation.

Based on the aforementioned art. 4, the. no. 300 of 1970, video surveillance equipment, if from the same derives "also the possibility of remote control" of employee activity, "may be used exclusively for organizational and production needs, for workplace safety and for the protection of company assets ” and the relative installation must, in any case, be carried out following the stipulation of a collective agreement with the unitary trade union representatives or with the company union representatives or, where it has not been possible to reach such an agreement or in the absence of the representatives, only in preceded by the issue of a specific authorization by the Labor Inspectorate.

The activation and conclusion of this guarantee procedure is therefore an indefectible condition for the installation of video surveillance systems. Violation of this provision is punishable by law (see article 171 of the Code). The processing of personal data carried out by the company through the video surveillance system is therefore illegal, in the terms set out above, in relation to articles 5, par. 1, lit. a), 13 and 114 of the Code.

3. The outcome of the investigation and the sanctioning procedure.

On the basis of the investigation carried out by the Guardia di Finanza, it emerged that the video surveillance systems, installed at the two offices of the individual company Naija Market International of Isidahomhen Joy, carrying out the activity of "Minimarkets and other non-specialised food establishments", in Modena, Viale Francesco Crispi e 6 and Via Antonio Gramsci 11, are active and functioning, that the signs bearing the information pursuant to art. 13 of the Regulation and adopted the guarantee measures, provided for by art. 4 of Law no. 300/1970, referred to by art. 114 of the Code, in relation to the presence of employees in video-monitored premises.

In the present case, it is therefore proven that the party has processed personal data, by means of a video surveillance system, in the absence of the required information. This conduct is in contrast with the provisions of art. 13 of the Regulation, according to which the data controller is required to provide the interested party with all the information relating to the essential characteristics of the treatment.

Furthermore, considering that the installation of the video surveillance system had not previously been authorized by the Labor Inspectorate, the processing was also carried out in violation of art. 114 of the Code regarding the protection of personal data.

Finally, not having provided a reply to the Guarantor's request within the set deadlines, the party also violated the obligation to provide the information requested by the Guarantor during the preliminary investigation set out in art. 157 of the Code regarding the protection of personal data.

4. Conclusions: declaration of illegality of the treatment. Corrective measures pursuant to art. 58, par. 2, Regulation.

The processing of personal data carried out by the sole proprietorship is therefore unlawful, in the terms set out above, in relation to articles 5, par. 1, lit. a) (principle of transparency) and 13 (information) of the Regulation and articles 114 and 157 of the Personal Data Protection Code.

The violation ascertained in the terms set out in the reasoning cannot be considered "minor", taking into account the nature, gravity and duration of the violation, the degree of responsibility and the manner in which the supervisory authority became aware of the violation ( see recital 148 of the Regulation).

Although the party, in the defense briefs, declared that it had posted the information sign and proceeded to request the necessary authorization from the Labor Inspectorate, the same did not send any documentation proving what was declared.

5. Injunction order.

The Guarantor, pursuant to art. 58, par. 2, lit. i) of the Regulation and of the art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. law 24 November 1981 n. 689), in relation to the processing of personal data carried out by the company by means of the video surveillance system, of which it was ascertained the unlawfulness, in the terms set out above, in relation to articles 5, par. 1, lit. a), 13 of the Regulation and in art. 114 of the Code.

With reference to the elements listed by art. 83, par. 2 of the Regulation for the purposes of applying the administrative fine and the related quantification, taking into account that the fine must be "in each individual case effective, proportionate and dissuasive" (art. 83, paragraph 1 of the Regulation), it is represented that, in the present case, the following circumstances were taken into consideration:

with regard to the nature, gravity and duration of the violation, the conduct of the data controller was taken into consideration, as well as the liability connected with the non-fulfillment of the obligation to provide information to the interested parties, the obligation to provide the information requested by the Guarantor pursuant to art. 157 of the Code and to implement the guarantee procedure provided for by art. 114 of the Code;

the absence of specific precedents against the company relating to violations of the regulations on the protection of personal data;

the circumstance that the sole proprietorship owner of the treatment, despite having sent written defences, has not in any case substantiated what was declared with suitable documentation;

It is also believed that they assume relevance, in the present case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness with which the Authority must comply in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the economic conditions of the offender, determined with reference to the financial statements for the year 2020.

Based on the aforementioned elements, evaluated as a whole, it is decided to determine the amount of the pecuniary sanction in the amount of 6,000.00 (six thousand) euros for the violation of articles 5, 13 of the Regulation and 114 and 157 of the Code.

In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, this provision must be published on the Guarantor's website.

Finally, it should be noted that the conditions pursuant to art. 17 of regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

ALL THAT BEING CONSIDERED, THE GUARANTOR

declares, pursuant to articles 57, par. 1, lit. f) and 83 of the Regulation, the unlawfulness of the processing carried out by Ms Isidahomhen Joy through the use of the video surveillance system installed at the premises of the individual company Naija Market International of Isidahomhen, carrying out the activity of "Minimarkets and other non-specialised food outlets" of which it is the owner, in the terms set out in the justification, for the violation of articles 5, 13 of the Regulation and 114 and 157 of the Code;

ORDER

to Ms Isidahomhen Joy, owner of the sole proprietorship Naija Market International of Isidahomhen, P.I. 02848451205, with tax domicile in XX, XX and places of business in Modena, Viale Francesco Crispi 6 and Via Antonio Gramsci 11, to pay the sum of 6,000.00 (six thousand) euros as an administrative fine for the violations indicated herein measure;

ENJOYS

then to Ms. Isidahomhen Joy, owner of the individual company Naija Market International of Isidahomhen:

1) to conform the treatment to the aforementioned provisions, pursuant to art. 58, par. 2, lit. d) of the Regulation, within 60 days of receipt of this provision, where it has not already done so, with reference to:

affixing suitable information signs of the presence of the cameras;

the fulfillment of the provisions of art. 4, paragraph 1, law 20.5.1970, no. 300;

2) to pay the sum of Euro 6,000.00 (six thousand), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the law n. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, without prejudice to the offender's right to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the term referred to in art. 10, paragraph 3, of Legislative Decree lgs. no. 150 of 1 September 2011 envisaged for the filing of the appeal as indicated below.

HAS

pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, the publication of this provision on the Guarantor's website and believes that the conditions set forth in art. 17 of regulation no. 1/2019.

Requests Ms Isidahomhen Joy to communicate what initiatives have been undertaken in order to implement the provisions of this provision and in any case to provide adequately documented feedback pursuant to art. 157 of the Code, within 90 days from the date of notification of this provision; any failure to reply may result in the application of the administrative sanction provided for by art. 83, par. 5, letter. e) of the Regulation

Pursuant to art. 78 of the Regulation, of the articles 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, against this provision it is possible to lodge an appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 1st December 2022

PRESIDENT
station

THE SPEAKER
station

THE SECRETARY GENERAL
Matthew

[doc. web no. 9838992]

Injunction order - 1 December 2022

Register of measures
no. 407 of 1 December 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation");

HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";

HAVING REGARD TO the report of the Guardia di Finanza - Special unit for the protection of privacy and technological fraud, sent with a note dated 12.17.2021, which refers to an inspection carried out on 16 and 17 November 2021, in the two operating offices of the sole proprietorship Naija Market International by Isidahomhen Joy, operating the business of "Minimarkets and other non-specialized food outlets" with two offices in Modena, Viale Francesco Crispi 6 and Via Antonio Gramsci 11, with which the presence of functioning video surveillance cameras missing the affixes was ascertained information signs and the guarantees provided for by art. 4 of Law 300/1970 referred to in art. 114 of the Code;

HAVING EXAMINED the documentation in the deeds;

HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER prof. Pasquale Stanzione;

WHEREAS

1. The report received and the start of the procedure.

With a note received on 15.7.2020, the local police of the Municipality of Modena transmitted the service report of a check carried out, on 30.5.2020, at the commercial establishment called "Joy Unique Collection" located in Modena, Via Francesco Crispi 6 , reporting the presence, inside the premises, of 3 video surveillance cameras functioning in the absence of the prescribed information signs.

Having not received a response to either the request for information of 11.11.2020 or the subsequent request made pursuant to art. 157 of the Code, the Office proceeded to notify the deed of initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of art. 157 of the Code (prot. n. 28851 of 25.5.2021) and to delegate control to the Guardia di Finanza - Special Unit for the protection of privacy and technological fraud.

With a note dated 12.17.2021, the report of the operations carried out on 16 and 17 November 2021 was sent to the two operating offices of the sole proprietorship "Naija Market International di Isidahomhen Joy", located in Modena, Viale Francesco Crispi 6 and Via Antonio Gramsci 11.

The aforementioned report reported the presence, at the headquarters in Via Crispi 6, of 3 functioning video cameras positioned inside the premises and, at the shop located in via Gramsci 11, of 8 functioning video cameras always located inside the premises.

Furthermore, the report reported that, although employees (identified in the report) operated at the aforesaid offices and filmed the video cameras of the internal spaces of the commercial establishments, it did not appear that the required authorization from the Inspectorate had been requested before the installation of the aforesaid systems territorially competent Labor Department.

With a note dated 12.19.2021, the lawyer Ivan Trubbas, on behalf of Ms Isidahomhen Joy, owner of the individual company Naija Market International of Isidahomhen, sent written defense declaring that "the violations in question were carried out unknowingly and in the most absolute good faith as Ms Isidahomhen Joy was not aware of the obligation (…) to seek authorization from the Labor Inspectorate. The owner of the company is in fact of foreign nationality and full knowledge of the privacy legislation, already particularly technical in itself, appears even more difficult. The violation can be considered not serious as it involved a limited number of employees, i.e. one employee in the shop in Via Crispi and two employees in the shop in Via Gramsci".

The party also declared that "as soon as he became aware of the legislation, the sign was immediately posted and the necessary authorization was requested from the Labor Inspectorate".

2. The legal framework of the treatment carried out

The use of video surveillance systems can determine, in relation to the positioning of the cameras and the quality of the images captured, the processing of personal data. This treatment must be carried out in compliance with the general principles contained in the art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-monitored area".

For this purpose, therefore, the data controller must affix suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - 8 April 2010 [1712680] (in this sense also the FAQs on video surveillance, published on the Authority's website).

Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "As regards video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while the further mandatory details can be provided by other means (second level). In the guidelines it is also foreseen that “Such information may be provided in combination with an icon to give, in a conspicuous, intelligible and clearly legible way, an overview of the intended treatment (article 12, paragraph 7, of the RGPD) . The format of the information will have to adapt to the various locations”. The information should be positioned in a way that allows the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) “to allow the data subject to estimate which area is covered by a camera in way to avoid surveillance or adjust their behavior, if necessary”.

The processing of personal data carried out in the context of the employment relationship, if necessary for the purpose of managing the relationship itself (see articles 6, paragraph 1, letter c); 9, par. 2, lit. b) of the Regulation), must take place in compliance with the general principles indicated by art. 5 of the Regulation, and in particular of the principle of lawfulness, on the basis of which the processing is lawful if it complies with the applicable sector regulations (Article 5, paragraph 1, letter a) of the Regulation). Consistent with this approach, the art. 88 of the Regulation is without prejudice to the national rules of greater protection ("more specific rules") aimed at ensuring the protection of rights and freedoms with regard to the processing of workers' personal data. The national legislator has approved, as a more specific provision, art. 114 of the Code which among the conditions of lawfulness of the treatment established the observance of the provisions of art. 4, law 20 May 1970, n. 300. The violation of the art. 88 of the Regulation is subject, if the requisites are met, to the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, letter. d) of the Regulation.

Based on the aforementioned art. 4, the. no. 300 of 1970, video surveillance equipment, if from the same derives "also the possibility of remote control" of employee activity, "may be used exclusively for organizational and production needs, for workplace safety and for the protection of company assets ” and the relative installation must, in any case, be carried out following the stipulation of a collective agreement with the unitary trade union representatives or with the company union representatives or, where it has not been possible to reach such an agreement or in the absence of the representatives, only in preceded by the issue of a specific authorization by the Labor Inspectorate.

The activation and conclusion of this guarantee procedure is therefore an indefectible condition for the installation of video surveillance systems. Violation of this provision is punishable by law (see article 171 of the Code). The processing of personal data carried out by the company through the video surveillance system is therefore illegal, in the terms set out above, in relation to articles 5, par. 1, lit. a), 13 and 114 of the Code.

3. The outcome of the investigation and the sanctioning procedure.

On the basis of the investigation carried out by the Guardia di Finanza, it emerged that the video surveillance systems, installed at the two offices of the individual company Naija Market International of Isidahomhen Joy, carrying out the activity of "Minimarkets and other non-specialised food establishments", in Modena, Viale Francesco Crispi e 6 and Via Antonio Gramsci 11, are active and functioning, that the signs bearing the information pursuant to art. 13 of the Regulation and adopted the guarantee measures, provided for by art. 4 of Law no. 300/1970, referred to by art. 114 of the Code, in relation to the presence of employees in video-monitored premises.

In the present case, it is therefore proven that the party has processed personal data, by means of a video surveillance system, in the absence of the required information. This conduct is in contrast with the provisions of art. 13 of the Regulation, according to which the data controller is required to provide the interested party with all the information relating to the essential characteristics of the treatment.

Furthermore, considering that the installation of the video surveillance system had not previously been authorized by the Labor Inspectorate, the processing was also carried out in violation of art. 114 of the Code regarding the protection of personal data.

Finally, not having provided a reply to the Guarantor's request within the set deadlines, the party also violated the obligation to provide the information requested by the Guarantor during the preliminary investigation set out in art. 157 of the Code regarding the protection of personal data.

4. Conclusions: declaration of illegality of the treatment. Corrective measures pursuant to art. 58, par. 2, Regulation.

The processing of personal data carried out by the sole proprietorship is therefore unlawful, in the terms set out above, in relation to articles 5, par. 1, lit. a) (principle of transparency) and 13 (information) of the Regulation and articles 114 and 157 of the Personal Data Protection Code.

The violation ascertained in the terms set out in the reasoning cannot be considered "minor", taking into account the nature, gravity and duration of the violation, the degree of responsibility and the manner in which the supervisory authority became aware of the violation ( see recital 148 of the Regulation).

Although the party, in the defense briefs, declared that it had posted the information sign and proceeded to request the necessary authorization from the Labor Inspectorate, the same did not send any documentation proving what was declared.

5. Injunction order.

The Guarantor, pursuant to art. 58, par. 2, lit. i) of the Regulation and of the art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. law 24 November 1981 n. 689), in relation to the processing of personal data carried out by the company by means of the video surveillance system, of which it was ascertained the unlawfulness, in the terms set out above, in relation to articles 5, par. 1, lit. a), 13 of the Regulation and in art. 114 of the Code.

With reference to the elements listed by art. 83, par. 2 of the Regulation for the purposes of applying the administrative fine and the related quantification, taking into account that the fine must be "in each individual case effective, proportionate and dissuasive" (art. 83, paragraph 1 of the Regulation), it is represented that, in the present case, the following circumstances were taken into consideration:

with regard to the nature, gravity and duration of the violation, the conduct of the data controller was taken into consideration, as well as the liability connected with the non-fulfillment of the obligation to provide information to the interested parties, the obligation to provide the information requested by the Guarantor pursuant to art. 157 of the Code and to implement the guarantee procedure provided for by art. 114 of the Code;

the absence of specific precedents against the company relating to violations of the regulations on the protection of personal data;

the circumstance that the sole proprietorship owner of the treatment, despite having sent written defences, has not in any case substantiated what was declared with suitable documentation;

It is also believed that they assume relevance, in the present case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness with which the Authority must comply in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the economic conditions of the offender, determined with reference to the financial statements for the year 2020.

Based on the aforementioned elements, evaluated as a whole, it is decided to determine the amount of the pecuniary sanction in the amount of 6,000.00 (six thousand) euros for the violation of articles 5, 13 of the Regulation and 114 and 157 of the Code.

In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, this provision must be published on the Guarantor's website.

Finally, it should be noted that the conditions pursuant to art. 17 of regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

ALL THAT BEING CONSIDERED, THE GUARANTOR

declares, pursuant to articles 57, par. 1, lit. f) and 83 of the Regulation, the unlawfulness of the processing carried out by Ms Isidahomhen Joy through the use of the video surveillance system installed at the premises of the individual company Naija Market International of Isidahomhen, carrying out the activity of "Minimarkets and other non-specialised food outlets" of which it is the owner, in the terms set out in the justification, for the violation of articles 5, 13 of the Regulation and 114 and 157 of the Code;

ORDER

to Ms Isidahomhen Joy, owner of the sole proprietorship Naija Market International of Isidahomhen, P.I. 02848451205, with tax domicile in XX, XX and places of business in Modena, Viale Francesco Crispi 6 and Via Antonio Gramsci 11, to pay the sum of 6,000.00 (six thousand) euros as an administrative fine for the violations indicated herein measure;

ENJOYS

then to Ms. Isidahomhen Joy, owner of the individual company Naija Market International of Isidahomhen:

1) to conform the treatment to the aforementioned provisions, pursuant to art. 58, par. 2, lit. d) of the Regulation, within 60 days of receipt of this provision, where it has not already done so, with reference to:

affixing suitable information signs of the presence of the cameras;

the fulfillment of the provisions of art. 4, paragraph 1, law 20.5.1970, no. 300;

2) to pay the sum of Euro 6,000.00 (six thousand), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the law n. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, without prejudice to the offender's right to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the term referred to in art. 10, paragraph 3, of Legislative Decree lgs. no. 150 of 1 September 2011 envisaged for the filing of the appeal as indicated below.

HAS

pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, the publication of this provision on the Guarantor's website and believes that the conditions set forth in art. 17 of regulation no. 1/2019.

Requests Ms Isidahomhen Joy to communicate what initiatives have been undertaken in order to implement the provisions of this provision and in any case to provide adequately documented feedback pursuant to art. 157 of the Code, within 90 days from the date of notification of this provision; any failure to reply may result in the application of the administrative sanction provided for by art. 83, par. 5, letter. e) of the Regulation

Pursuant to art. 78 of the Regulation, of the articles 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, against this provision it is possible to lodge an appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 1st December 2022

PRESIDENT
Station

THE SPEAKER
station

THE SECRETARY GENERAL
Matthew