Garante per la protezione dei dati personali (Italy) - 10013356
From GDPRhub
| Garante per la protezione dei dati personali - 10013356 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6 GDPR Article 12 GDPR Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 21.05.2024 |
| Published: | |
| Fine: | 3,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 10013356 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | im |
The DPA fined a municipality €3,000 for using records from video-surveillance systems in disciplinary proceedings against employees in lack of trade union agreements or public authorisation.
English Summary
Facts
A data subject is a former employee of a Muncipality of Madignano (‘controller’ or ‘the municipality’). She complained about the installation of a video surveillance system next to attendance monitoring systems without a proper agreement with a trade union or a public authorisation.
The system recorded the data subject. The recording was then used as an evidence in a disciplinary procedure against the data subject for not adhering to working hours and violating official duties. She omitted to stamp her time-card when leaving the work premises and making them accessible to people outside the administration of the municipality.
The controller initially argued that the camera positioned inside the hall of the municipality was installed for the sole purpose of protecting municipal property and the safety of employees. However, later in another statement of defense the controller claimed that the purpose of video-surveillance system was public security and detection of offenses.
Additionally, the controller claimed that camera was directed at the public entrance hall, therefore, it is not capable of filming the employees in the offices and that it fulfilled its information obligations by publishing the municipal regulation regarding video-surveillance. However, from the DPA preliminary investigation it emerged that the document published does not contain all the essential information required by Article 13 GDPR such as purpose and the legal basis, among others.
Holding
Firstly, the DPA clarified that the controller is an employer that must comply with the national rules applicable to workplace monitoring system as per Article 6(1)(b) and Article 88(2) GDPR. Since the controller is also a public entity subject to national law provisions, it must ensure compliance with Law No. 14/2017. The DPA stressed that the video-surveillance cameras in question are capable of filming staff and individuals passing through the main entrance. The controller argued that the camera was installed to ensure public security ad detection of offenses. According to Article 5(2)(a), municipalities can install video-surveillance cameras on public streets to prevent and fight widespread and predatory crime, provided they have an urban security agreement with the local government representative.
However, the DPA found no evidence that the camera in question was installed for the pursuit of urban security purposes. This is mainly because of lack of the said agreement with the local government representative and the fact that camera in question also filmed inside the Municipality's premises which does not seem suitable for the objective of urban security monitoring.
In the present case, the controller put forward contradictory arguments regarding the purpose of this type of processing. In case of using the video-surveillance system to protect company assets, Article 4(1) of Law no. 300/1970 obligates the controller to receive an authorization from the Labour Inspectorate. However, it was ascertained that the controller also failed to demonstrate compliance with this provision.
Regarding the use of the video-surveillance in the disciplinary proceedings, the DPA emphasized once again that it must be carried out in strict compliance with the limits and conditions laid down by the relevant legislative framework as stated in Article 88(1) GDPR. The DPA discovered that the controller initiated the disciplinary proceedings against the data subject based on the evidence extracted from the video-surveillance camera. However, the processing of personal data through surveillance must meet the conditions of Article 4 of Law No. 300/1970, which requires union agreements or public authorization for such systems. Since the municipality did not have proper authorization or provide adequate employee information, the use of the surveillance data in disciplinary actions was unlawful.
Since the controller failed to meet the national specification regarding the processing of personal data in the context of employment, the DPA found violations of Article 5(1)(a), 6 and 88 GDPR. Additionally, considering that the data subjects exposed to the video-surveillance monitoring were not adequately informed about the processing of their data, the DPA found the controller in breach of Articles 12 and 13 GDPR containing all the elements required to fulfill its obligations
In the light of this the DPA fined the controller €3,000 for the aforementioned violations.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
SEE ALSO Newsletter of May 21, 2024
[doc. web no. 10013356]
Provision of 11 April 2024
Register of measures
n. 234 of 11 April 2024
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members and the councilor. Fabio Mattei, general secretary;
HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data and which repeals Directive 95/46/ EC, “General Data Protection Regulation” (hereinafter, “Regulation”);
HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 containing "Code regarding the protection of personal data, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46/EC (hereinafter the “Code”);
GIVEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved with resolution no. 98 of 4 April 2019, published in the Official Gazette. n. 106 of 8 May 2019 and in www.gpdp.it, doc. web no. 9107633 (hereinafter "Guarantor Regulation no. 1/2019");
Having seen the documentation in the documents;
Having seen the observations made by the general secretary pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, doc. web no. 1098801;
Speaker: the lawyer. Guido Scorza;
PREMISE
1. Introduction.
With a report submitted pursuant to art. 144 of the Code, Ms. absence of the agreement with the trade unions, as well as the use of this system to carry out specific disciplinary complaints against the employee regarding failure to respect service hours and violation of one's official duties.
2. The preliminary investigation activity.
In response to a request for information from the Authority (see note prot. n. XX of XX), the Municipality, with note of the XX (prot. n. XX, acquired in the protocol of the Guarantor n. XX of XX) , stated, in particular, that:
"following behavior that did not comply with the employment contract, a disciplinary complaint was issued to an employee of the Municipality [...], regarding failure to comply with service hours; the first reports regarding the employee's conduct had been reported to the Mayor by some citizens [...]";
"during the internal investigation, these reports were compared with the clockings reported in the monthly attendance records";
“the information acquired [was] collected from paper, produced by the time clock as the only tool used to record employees' working hours”;
“the camera positioned inside the municipal hall was installed for the sole purpose of protecting municipal assets and the safety of employees […]”;
“the video surveillance system currently in operation has been authorized by the Cremona Labor Inspectorate with Provision no. XX”;
"since its installation [...] the box at the top right has been voluntarily obscured, in order not to capture the area where the presence detectors are located, in compliance with current regulations".
In response to a further request for information from the Authority (see note prot. XX of XX), the Municipality, with note of XX (prot. no. XX, acquired in the protocol of the Guarantor no. XX of XX), stated, in particular, that:
“as regards the date of installation of the surveillance system in the atrium of the Municipality, [it was] not possible to trace a precise date”;
“the camera was physically positioned between the months of XX and XX;
"the connection to the video surveillance system occurred in the month of XX, following an attack against the social worker and the then councilor which took place towards the end of the month of XX";
“since then, as there have been no further violent events, the camera in question has not been subject to specific checks”.
With note dated XX (prot. n. XX), the Office, on the basis of the elements acquired, the checks carried out and the facts that emerged following the preliminary investigation, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in the art. 58, par. 2, of the Regulation, to have:
- failed to provide interested parties (i.e. both workers and visitors to the Municipality's headquarters) with information on the processing of personal data through the aforementioned video surveillance system, in violation of articles. 5, par. 1, letter. a), 12 and 13 of the Regulation;
- processed personal data through the aforementioned video surveillance system in the absence of the conditions established by the regulations regarding remote controls, in violation of the articles. 5, par. 1, letter. a), 6, and 88 of the Regulation, as well as 114 of the Code, in reference to the art. 4, paragraph 1, of the law. n. 300 of 1970;
- used the data collected through the aforementioned video surveillance system as part of the disciplinary proceedings initiated against the interested party, in the absence of the conditions required by the sector regulations regarding remote controls, in violation of the articles. 5, par. 1, letter. a) and b), 6, and 88 of the Regulation, as well as 114 of the Code, in reference to art. 4, paragraph 3, of the law. n. 300 from 1970.
With the same note, the aforementioned owner was invited to produce defensive writings or documents to the Guarantor or to request to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code, as well as art. 18, paragraph 1, of the l. 24 November 1981, n. 689).
With note dated XX (prot. n. XX), the Municipality, which did not ask to be heard, presented a defense statement, declaring, in particular, that:
the purpose of the processing did not consist in "video surveillance in the workplace for the protection of company assets", but in "public safety and [...] detection of crimes", as provided for by the "regulation approved with resolution no. 26 of 06/29/2005”, pursuant to which the Municipality can “monitor, also with the use of video cameras, the territory, the interior and exterior of public buildings (art. 2, n. 5)” ;
“further proof of the pursuit of the sole purposes of Public Security and crime detection lies in the fact that the only monitor for viewing the images is positioned in the Local Police office adjacent to the entrance hall of the Town Hall where it is located the internal video camera, without the Mayor being able to constantly monitor the images";
"no video camera has ever been foreseen [by] the Municipality, installed or connected which is capable of filming, in any way, the workers employed by the Municipality, not only in the offices located, moreover, on the floor above the only internal camera [ ...], but not even in the immediate vicinity of them and, much less, in other environments where their dignity or privacy could be said to be violated. The only camera inside the building is aimed at the public entrance hall";
the Municipality "arranged [...] the connection of the video camera "following an attack suffered by the social worker"";
"it is clear that the only aim pursued [by the Municipality], as well as by the previous ones, is the protection of collective security, the prevention and detection of crimes and not video surveillance in the workplace for the protection of company assets. Those interested in the treatment, therefore, have never been the public employees of the Municipality as such but the entire community";
“it goes without saying, therefore, that […] Law no. is not applicable. 300/1970”;
“consistent with [these] real purposes of the processing […, the] Mayor, as Judicial Police Officer pursuant to art. 57, paragraph 1 letter. c c.p.p., as a result of the serious evidence against the reporting person consisting of the failure to comply with the "formalities required for the recording of attendance" [...] and the complaints "by the remaining staff", as well as, in the "reports regarding the conduct of the employee reported to the Mayor by some citizens, who, stationed daily near the Municipality, had noticed and reported in great detail the events reported in the procedure" [...] decided, for the time strictly necessary, to process the data collected in compliance with the purposes explained in the municipal regulation [on video surveillance]”;
“it is clear that the original collection and, consequently, the use of the expected data was fully legitimate during the investigation by P.G. the conduct does not fall within the scope of the [Regulation] but within Legislative Decree 51/2018 concerning the processing of data carried out by Public Authorities for the purposes of prevention, investigation, detection or prosecution of offences. [...] Investigation which, in this case, concerned conduct carried out by the reporting party and having criminal implications and, consequently, also brought to the attention of the investigators by means of an oral complaint filed on XX";
“in the denied hypothesis in which it is believed that in the processing of data […] [the Municipality] qualifies as an employer, the now constant jurisprudential dictate in this regard would still legitimize the conduct [of the Municipality] […]”;
"[the Mayor of the Municipality], in fact, on the basis of the emergence of concrete clues such as to signal the presence of ongoing crimes by the employee [...] dating back to a period prior to the connection of the internal video camera - "from the year XX ” […] - occurred in the 20th century, did not carry out a check aimed at constantly monitoring the employee in close proximity to him as required in the case of remote checks; also because it would have been impossible, given the positioning of the video camera located, it is reiterated, on the lower floor compared to where the work activity is carried out [...]";
"in reality, the conduct in question was, instead, aimed at ascertaining specific illicit conduct detrimental to the image of the Institution [...]";
"therefore, the data were processed as a consequence of those "defensive checks in the strict sense" which the majority jurisprudence has already established as being outside the scope of the art. 4 of the Workers' Statute [...] ([see] among others, Labor Section of Cassation no. 25732/2021; Penal Cassation 3255/2021, in line with what was decided by the ECHR in the ruling of 17/10/2019 case Lopez Ribalda and others V Spain on the subject of hidden video surveillance)”;
as regards the transparency of the processing, the aforementioned municipal regulation "reports [...] all the information referred to in the art. 13 of the [Regulation]”;
this regulation is "since its approval accessible to anyone (art. 22) [...] by making it available to the public, should it request it";
“therefore, together with the signs present in the immediate vicinity of the video cameras located (art. 2, n.5 of the municipal regulation), interested parties are able to receive all the information required by the art. 13, paragraph 1 of the [...] Regulation [...], through information represented precisely by said municipal regulation which is also available on the Municipality's website";
as "mitigating factors applicable to the circumstances of the case [...] the low threshold inherent to [the] degree of protection of employee privacy can be taken into consideration (ruling of 17/10/2019 case Lopez Ribalda and others V Spain), completely comparable to that of the public who accesses the Municipality on a daily basis";
"secondly, consider that the Administration acted promptly by deactivating the camera during the inspection access of the Labor Inspectorate and reactivating it only after obtaining Measure no. XX of authorization to use the system".
3. Outcome of the preliminary investigation.
3.1. Data protection legislation.
The regulations on the processing of personal data provide that public entities can, as a rule, process personal data if the processing is necessary "to fulfill a legal obligation to which the data controller is subject" or "for the execution of a task of public interest or connected to the exercise of public powers vested in the data controller" (art. 6, par. 1, letters c) and e) of the Regulation and art. 2-ter of the Code).
With specific reference to the use of video surveillance systems by public entities, already in the "Provision on video surveillance" (provision of 8 April 2010, web doc. no. 1712680) the Guarantor had clarified that such entities, " as data controllers [...], they may process personal data in compliance with the principle of finality, pursuing specific, explicit and legitimate purposes [...] for the performance of their institutional functions" (par. 5) (see section 3.2 of the “Guidelines 3/2019 on the processing of personal data through video devices” of the European Data Protection Board of 29 January 2020).
Given this, when, as in the present case, the video surveillance cameras are also suitable for recording personnel transiting or stopping in the workplace, the processing of workers' personal data can be carried out by the owner in his capacity as employer. , if it is necessary, in general, for the management of the employment relationship and within the applicable legal framework defined by laws, community legislation, regulations or collective agreements (art. 6, par. 1, letter c) , and 88 of the Regulation). In this framework, the employer must, therefore, respect the national rules which "include appropriate and specific measures to safeguard the human dignity [...] of the interested parties in particular with regard to the transparency of the processing [...] and the monitoring systems on the workplace" (art. 6, par. 2, and 88, par. 2, of the Regulation).
As a result of the reference contained in the Code to the pre-existing national provisions of the sector which protect the dignity of people in the workplace, with particular reference to possible controls by the employer (art. 114 "Guarantees regarding remote control") , compliance with the art. 4 of the law. 20 May 1970, n. 300 constitutes a condition of lawfulness of the processing (see par. 4.1 of the aforementioned "Provision on video surveillance" of 8 April 2010; see, lastly, the recent FAQ of the Guarantor no. 9 on video surveillance, of December 2020, web doc. 9496574 and the numerous decisions of the Guarantor referring to concrete cases).
The art. 4, paragraph 1, of the law. 20 May 1970, n. 300 establishes, in fact, that "audiovisual systems and other tools from which the possibility of remote control of workers' activities also derives can be used exclusively for organizational and production needs, for workplace safety and for the protection of assets company and can be installed following a collective agreement stipulated by the unitary trade union representation or by the company trade union representatives [...]. In the absence of an agreement, the systems and tools referred to in the first period may be installed subject to authorization from the territorial headquarters of the National Labor Inspectorate or, alternatively, [...] from the central headquarters of the National Labor Inspectorate".
The third paragraph of the same article then specifies that "the information collected pursuant to paragraphs 1 and 2 can be used for all purposes related to the employment relationship provided that the worker is given adequate information on the methods of use of the tools and the implementation controls and in compliance with the provisions of the [Code]".
European legislation provides that personal data must be processed "in a lawful, correct and transparent manner towards the interested party" and "collected for specific, explicit and legitimate purposes" (principles of "lawfulness, correctness and transparency" and "limitation of purposes"), admitting the possibility of subsequent processing but only "in a way that is not incompatible with [the] initial purposes" of the processing (art. 5, par. 1, letters a) and b), of the Regulation).
In this framework, the owner can use for further processing only the personal data lawfully collected in the presence of a suitable legal basis, having previously "satisfied all the requirements for the lawfulness of the original processing" (see cons. n. 50 of the Regulation ), and therefore within the limits in which the original collection was lawfully carried out, having regard to the main purpose and in compliance with the general principles of data protection, including that of "lawfulness, correctness and transparency", in implementation of which the data controller must take appropriate measures to provide the interested party with all the information referred to in the articles. 13 and 14 of the Regulation in a concise, transparent, intelligible and easily accessible form, with simple and clear language (see art. 12, paragraph 1, of the Regulation).
3.2. The lawfulness and transparency of the processing of workers' personal data through the video surveillance system.
On the basis of the elements acquired and the facts that emerged following the preliminary investigation, it is ascertained that, between the months of XX and XX, the Municipality installed a video surveillance camera in the atrium of its headquarters, connecting it to the video surveillance in the month of XX, following an attack suffered by a social worker and a councillor.
The installation of this camera was, however, authorized by the Territorial Labor Inspectorate of Cremona with provision no. XX only on the date XX (see annex 1 to the note prot. n. XX of the XX).
Having said this, it must be noted that, as regards the purposes of processing pursued through this video surveillance camera, the Municipality, during the investigation and in its defense briefs, supported theses that were heterogeneous and mutually contradictory.
At first, the Municipality, in fact, stated that the camera in question would have been installed "for the sole purpose of protecting municipal assets and the safety of employees" (see XX, prot. n. XX).
Subsequently, in the defense brief, the Municipality supported the thesis that the only purpose of the processing pursued was, in reality, "public safety and [...] detection of crimes".
In this regard, it must be noted that there is no evidence in the documents that the camera in question had been installed by the Municipality for the pursuit of urban security purposes. Pursuant to art. 5, co. 2, letter. a), of the legislative decree 20 February 2017, n. 14, the Municipalities can, in fact, install video surveillance cameras on public streets for the pursuit of the objectives of "prevention and combating the phenomena of widespread and predatory crime", subject to the stipulation of an agreement for the implementation of urban security with the Prefecture territorially qualified. In the present case - given that the aforementioned camera was also suitable for filming the internal environments of the Municipality headquarters, it could not ontologically fulfill the task of preventing and combating the specific phenomena of widespread and predatory crime, to which the aforementioned sector regulation refers , which typically occur in public streets - the Municipality has not, however, demonstrated that it has stipulated a territorial pact with the Prefecture for the implementation of urban security which expressly provides for the installation of the camera in question inside the atrium of the headquarters of the Municipality for the pursuit of purposes related to urban safety.
Nor can the use of the camera in question be traced back to the broader scope of public security, given that the local police have no general competences in this matter. The art. 5, paragraph 1, letter. c), of the law. 7 March 1986, n. 65 ("Framework law on the organization of the municipal police"), provides, in fact, that "the personnel who carry out municipal police services, within the territorial scope of the institution to which they belong and within the limits of their duties, also exercise [... ] auxiliary public security functions”; this will "collaborate, within the scope of their duties, with the State Police Force, subject to the mayor's disposition, when a reasoned request is made by the competent authorities for specific operations" (art. 3). To this end, the Prefect confers on local police personnel, upon communication from the Mayor, the status of public security agent, after having verified that they possess the requirements established by law (art. 5, paragraph 2). In the exercise of the functions of public security agent, such personnel, made available by the Mayor, operationally depends on the competent public security authority in compliance with any agreements between the said authorities and the Mayor (art. 5, paragraph 4). Consequently, since there is no indication in the documents coming from the competent public security authorities regarding "specific operations" and since the local police of the Municipality cannot carry out public security activities of a general and preventive nature on their own initiative, it must be excluded that the use of the camera being reported can be traced back to the field of public security (see, in this regard, the recent provision dated 11 January 2024, n. 5, web doc. n. 9977020, par. 4).
The Municipality then claimed that this camera would have been used in the different sphere of judicial police activity, at the instigation of the Mayor, "as a Judicial Police Officer pursuant to art. 57, paragraph 1 letter. c c.p.p.", on the assumption of the existence of "serious evidence against the reporting party consisting in the failure to comply with the "formalities required for recording attendance"" (see defense brief). In noting that there is no evidence in documents that the Municipality - in the person of the Mayor (see art. 55, paragraph 3, c.p.p. and art. 57, paragraph 1, letter c), c.p.p.) or through local police officers ( see art. 55, paragraph 3, c.p.p. and art. 5, par. 1, letter a), and 4 of the law. 7 March 1986, n. 65) - has carried out, in the present case, judicial police activities on the impulse, dependent and under the direction of the judicial authority (see articles 55, paragraph 2, and 56 c.p.p.), it is observed that, differently from what proposed by the data controller, it appears instead in documents that the Mayor filed a specific complaint against the worker concerned, without however making any reference to evidence acquired through video surveillance devices or to an alleged activity delegated by the judicial authority (see annex. 9 to the defense brief; regarding the conditions that justify the judicial police activities by the Municipalities, see provision 16 November 2023, n.
However, paragraph 1 of the art. applies to the actual processing carried out using the video surveillance camera in question. 4, of the law. 300/1970 as, on the other hand, proven by the circumstance that the Territorial Labor Inspectorate of Cremona had carried out an inspection activity at the Municipality, following which it had deactivated the camera in question and which, subsequently, with “application received on XX and finalized on XX”, had asked the aforementioned Inspectorate for authorization pursuant to the aforementioned art. 4, paragraph 1, of the law. 300/1970 to install "a remote control system [of] the headquarters, based on the needs [of] protection of company assets" (see provision of the aforementioned Inspectorate no. XX of XX, in documents). The same data controller, during the investigation, also invoked needs attributable to paragraph 1 of the art. 4, of the law. 300/1970, in particular, in addition to those of protecting one's assets, also those of protecting the safety of workers, on the assumption that in the month of XX an attack had occurred against a social worker and a councillor.
Having clarified the reference context, it should be remembered that the Guarantor, also recalling the jurisprudence of the European Court of Human Rights, in the case Antovic and Mirković v. Montenegro (Application no. 70838/13 of 28 November 2017), has highlighted on several occasions that video surveillance in working contexts, both private and public, can only be justified in compliance with the guarantees provided by the applicable national law, in the absence of which it constitutes an illicit interference in the employee's private life, pursuant to art. 8, par. 2 of the European Convention on Human Rights.
Therefore, compliance with the aforementioned art. 4, paragraph 1, also as a result of the reference to it contained in the art. 114 of the Code, constitutes a condition of lawfulness of the processing of personal data (see, lastly, with regard to the use of video surveillance in public workplaces, lastly, provision 16 November 2023, n. 578, web doc. n. 9963486, but also, issued March 11, 2021, web document no. 9582791, as well as the precedents referred to therein; at European level, see the “Guidelines 3/2019 on the processing of personal data through video devices”, cit. 48, as well as the previous indications of the Article 29 Working Group in the “Opinion 2/2017 on the processing of data in the workplace”, WP 249, of 8 June 2017; in case law, section 3, 17 December 2019, n.
In the present case, it is established that, in the period between the month of XX and XX, the Municipality processed personal data relating to its workers, i.e. the images acquired using the video surveillance camera in question, in the absence of an agreement with the trade union organizations or an authorization granted by the Labor Inspectorate, which appears to have been obtained on date XX and, therefore, up to that date not respecting the conditions and guarantees provided for by the aforementioned sector regulations regarding distance, in violation of articles. 5, par. 1, letter. a), 6 and 88 of the Regulation, as well as 114 of the Code, in reference to the art. 4, paragraph 1, of the law. n. 300 from 1970.
As regards the related profile of the correctness and transparency of the processing, it must be noted that, when video surveillance systems are used, the data controller, in addition to providing first level information by affixing warning signs near the area subjected to video surveillance, must also provide interested parties with "second level information", which must "contain all the mandatory elements pursuant to Article 13 of the [Regulation]" and "be easily accessible to the interested party, for example through an information page completely made available in a central hub (information desk, reception, cash desk, etc.) or posted in an easily accessible place" ("Guidelines 3/2019 on the processing of personal data through video devices", cit., in particular , par. 7; see already the aforementioned "Provision on video surveillance" of the Guarantor of 8 April 2010, in particular par. 3.1; see, lastly, the recent FAQs of the Guarantor on video surveillance, cit., n. 4). The first level information (warning sign) “should communicate the most important data, for example the purposes of the processing, the identity of the data controller and the existence of the data subject's rights, together with information on the most significant impacts of the processing” (“Guidelines 3/2019 on the processing of personal data through video devices”, cit., par. 114). Furthermore, the signs must also contain information that may be unexpected for the interested party. This could, for example, concern the transmission of data to third parties, in particular if located outside the European Union, and the retention period. If such information is not indicated, the data subject should be able to trust that there is only real-time surveillance (without any data recording or transmission to third parties (ibidem, para. 115). The warning sign bearing the first level information must contain a clear reference to the second level of information, for example, indicating a website on which it is possible to consult the text of the extended information (see, with specific regard to the use of video surveillance cameras in places of public works, issued 16 November 2023, no. 578, web doc. no. 9963486 and 11 March 2021, no. 9582791; part of Municipalities, see, most recently, provisions of 11 January 2024, n. 5, 11 January 2024, and the precedents referred to therein).
Having said this, in taking note of what was declared by the Municipality in the defense brief regarding the circumstance that "signage [...] had been installed in the immediate vicinity of the video cameras located", it must be noted that the Municipality has, however, failed to provide interested parties with appropriate extended second-level information on the processing of personal data. The Municipality, in fact, limited itself to claiming that it had fulfilled its information obligations with the publication of the municipal regulation on video surveillance, approved with resolution no. 26 of 29 June 2005. In this regard, it is noted that this document does not contain all the essential information elements required by the art. 13 of the Regulation (for example, the purpose and legal basis of the processing carried out using cameras placed inside the Municipality headquarters, as a workplace; the contact details of the data protection officer), having, moreover, been approved well before its effective date. In fact, the same "regulates the methods of collection, processing and storage of personal data activated in the urban territory of the Municipality of Madignano and connected to the control and video recording station" (art. 4) and does not, however, have the purpose of fulfilling to information obligations towards interested parties. The same art. 5 ("Information") of the same regulation provides, on the other hand, that "interested parties must be informed that they are about to access or that they are in a video-surveillance area, and of any registration, through a simplified "minimum" information form. ””, while “in places other than external areas the model must be integrated with at least a detailed notice that contains the elements indicated by the art. 13 of the Code [in the text currently in force], with particular regard to the purposes and possible conservation".
As regards more specifically the workers employed by the Municipality, it must be noted that, as already highlighted by the Guarantor in previous decisions, deeds and documents which, as in the present case, are drawn up by the employer to fulfill obligations other than those deriving from the data protection regulations cannot replace the information that the owner must provide, before starting the processing, to the interested parties regarding the essential characteristics of the same; this with the aim of allowing the interested party to be fully aware of the type of processing operations that may also be carried out by drawing, within a lawful framework, on the data collected during the work activity (see, in particular, provision 13 May 2021, 190, web doc. no. 9669974, which recalls the Judgments of the European Court of Human Rights of 5 September 2017 - Appeal no. 61496/08 - Case Barbulescu v. Romania, e.g 140 and of 9 January 2018 - appeal no. 1874/13 - Case López Ribalda and others v. Spain, see Working Group pursuant to regulation 2016/679” of 11 April 2018, par. 17).
On the other hand, the municipal regulation on video surveillance was approved in the 20th century, i.e. well before the adoption of the authorization provision of the Territorial Labor Inspectorate of Cremona in the 20th century, therefore this regulation cannot take account of the specific legal basis ( see art. 13, par. 1, letter c), on which, in the specific case, the processing of workers' personal data could be based (art. 6, par. 1, letter c), and 88 of the Regulation; art. 4, paragraph 1, of the law. 300/1970; art. 114 of the Code).
In light of the foregoing considerations, it must be concluded that the Municipality has not provided the interested parties (i.e. both workers, users or visitors to its premises) with adequate information on data processing, complete with all the elements required by the Regulation, in violation of the articles 5, par. 1, letter. a), 12 and 13 of the Regulation.
3.3. The use of data collected through the video surveillance system for disciplinary purposes.
During the investigation, it was also ascertained that, with note one of the XX, the municipal secretary sent to the Disciplinary Procedures Office of the Province of Cremona a report of facts having disciplinary relevance against the worker concerned. In this note, in particular, the incorrect representation of the presence on duty was contested, on the assumption that the employee had failed to clock in on exit on days XX and XX. The interested party was also accused of introducing people outside the administration into the premises of the Municipality on XX.
In the aforementioned note sent to the competent office, the Municipal Secretary, in reporting that the administration had learned of the conduct carried out by the employee, having received reports from third parties, and that "the Municipality is equipped with a video surveillance system concerning , among other things, the entrance to the municipal headquarters and the atrium leading to the offices" (see introduction to letter b)), reported a specific declaration from the Mayor, namely that he had "personally [... ] viewed the municipal cameras to verify the veracity of the reports, promptly verifying their validity: just after having stamped the employee she left the municipality to return shortly after" (see appendix 1 to the aforementioned note of the XX), thereby confirming that the disciplinary charges in question were advanced against the interested party also on the basis of the actual examination of the video surveillance images.
This circumstance is also confirmed by the documentation in the documents relating to the disciplinary proceedings, since, in the provision of the Office for Disciplinary Procedures of the Province of Cremona prot. n. XX of XX (with which the disciplinary sanction was imposed on the interested party in relation to the aforementioned conduct) in replying to what was put forward by the interested party's lawyer regarding the "violation of the art. 4 of the law. 300/1970", it is specified that "with regard to the alleged violation of the art. 4 of the Workers' Statute [...] [are] outside the scope of application of the rule the control for the protection of assets as well as the controls aimed at ascertaining illicit conduct of the worker, especially ex post, i.e. after the implementation of the behavior in charge, so as to ignore the mere supervision of the execution of the work performance (in this sense Cass. 3255/2021)".
It must, however, be highlighted once again that the processing of personal data connected to the use of tools from which the possibility of remote control of workers' activities can also arise must be carried out in strict compliance with the limits and conditions established by the legislative framework of reference, which constitutes, as mentioned, the legal basis (articles 5, par. 1, letter a), 6, 88, par. 1, of the Regulation, as well as 114 of the Code, in reference to the art. 4 of the law. n. 300/1970).
As recently reiterated by the Guarantor, following the changes made to the art. 4 of the law. n. 300/1970 from Legislative Decree 14 September 2015, n. 151, the needs of protecting the employer's assets have also been expressly included among the only legitimate purposes that can be pursued through systems that can involve indirect control over all employees, making their installation and use subject to the union agreement or, alternatively, to public authorization, with the consequence that, if these conditions for the lawful use of the aforementioned systems are not respected, any processing, even further, of such data, including their "extraction, consultation and use" (art. 4, par . 1, n. 1), of the Regulation), must be considered as lacking a suitable legal basis and therefore unlawful (see provision dated 1 December 2022, n. 409, web doc. n. 9833530). Consequently, the forms of control over workers' activities, implemented in the absence of the aforementioned guarantees, fall outside the framework of lawfulness outlined by the sector provisions and the data protection regulations.
It should also be considered that the aforementioned sector regulations allow the use, for further purposes in the management of the relationship, only of the information already lawfully collected in compliance with the conditions and limits established by the art. 4 of the law. n. 300/1970 and, therefore, within the limits in which the original collection was lawfully carried out. This framework therefore presupposes an autonomous determination by the owner regarding the use of the information, where already lawfully collected in compliance with the conditions and limits established by the art. 4, paragraphs 1 or 2 of the law. n. 300/70, also for further treatments necessary for the management of the employment relationship (art. 4, paragraph 3 of law 300/1970). These subsequent and possible processing operations presuppose compliance with the reference regulatory framework both in terms of remote monitoring of workers (pursuant to paragraphs 1 and 2) and in terms of data protection. This also with regard to the need to provide interested parties with all necessary information to ensure employees are fully aware of the further processing that the employer reserves the right to carry out (on this point, see provisions dated 1 December 2022, no. 409, cit. .; 28 October 2021, web doc. no. 9722661; 6495708, spec. point 5.3 and letter e) device).
In this case, without prejudice to the assessments expressed in the previous paragraph. 3.2 regarding the use of the aforementioned video surveillance system in the absence of the guarantees referred to in the art. 4, paragraph 1, of the law. 300/1970, it appears that the disciplinary measure in question was adopted on the XX, or on a date prior to the date on which the authorization from the Territorial Labor Inspectorate for the installation of said camera was obtained, without having provided the employees with a adequate information regarding the methods with which he reserved the right to use the aforementioned data in the context of the employment relationship pursuant to paragraph 3 of the aforementioned art. 4.
Lastly, also in light of what was proposed by the Municipality, it is remembered that in this framework the Guarantor has clarified that "the so-called theory on defensive controls, of pure jurisprudential creation, is the subject of non-univocal applications" (see, on this point, provisions of 1 December 2022, n. 409, cit., and 15 April 2021, n. 137, doc. web no. 9670738) and is based on factual circumstances which in any case do not apply in the present case (having the Municipality installed the video surveillance camera prior to the facts subsequently alleged against the employee and in such a way as to record all the workers and visitors passing through the building's atrium); in fact, as already highlighted, the needs of protecting the employer's assets have been expressly included among the legitimate purposes that can be pursued through video surveillance systems, making their installation and use subject to a trade union agreement or, alternatively, to public authorization (art. 4, paragraph 1, law 300/1970).
For these reasons, it must be concluded that the use by the Municipality of data collected through the aforementioned video surveillance system, as part of the disciplinary proceedings initiated against the reporting party, occurred in violation of both the sector regulations on the matter of remote controls as well as that relating to data protection, in violation of the articles. 5, par. 1, letter. a) and b), 6, and 88 of the Regulation, as well as 114 of the Code, in reference to art. 4, paragraph 3, of the law. n. 300 from 1970.
4. Conclusions.
In light of the assessments mentioned above, it is noted that the declarations made by the data controller during the investigation are the truthfulness of which one may be called upon to respond to pursuant to art. 168 of the Code ˗, although worthy of consideration, do not allow us to overcome the findings notified by the Office with the act of initiating the proceeding and are insufficient to allow the dismissal of this proceeding, as, moreover, none of the cases envisaged by the 'art. 11 of the Guarantor Regulation n. 1/2019.
The preliminary assessments of the Office are therefore confirmed and the illegality of the processing of personal data carried out by the Municipality is noted, for having processed personal data using a video device, also for disciplinary purposes against an employee, and in the absence of transparency towards the interested parties, in violation of the articles. 5, par. 1, letter. a) and b), 6, 12, 13 and 88 of the Regulation, as well as 114 of the Code (in reference to art. 4, paragraphs 1 and 3, of law no. 300 of 1970).
Taking into account that the violation of the aforementioned provisions took place as a consequence of a single conduct, the art. applies. 83, par. 3 of the Regulation, pursuant to which the total amount of the administrative fine does not exceed the amount specified for the most serious violation. Considering that, in this case, all violations are subject to the sanction provided for by the art. 83, par. 5 of the Regulation, the total amount of the fine is to be quantified up to 20,000,000 euros.
5. Corrective measures (art. 58, par. 2, letter d), of the Regulation).
The art. 58, par. 2 of the Regulation gives the Guarantor the power to "order the data controller or data processor to conform the processing to the provisions of this regulation, if appropriate, in a specific manner and within a specific deadline" (letter d) .
Based on what emerged from the outcome of the investigation in relation to transparency obligations, it is necessary, pursuant to art. 58, par. 2, letter. d), of the Regulation, order the Municipality to provide all interested parties (i.e. both workers and visitors to the Municipality's headquarters), pursuant to articles. 5, par. 1, letter. a), 12 and 13 of the Regulation, appropriate information on the processing of personal data, collected and processed through the video surveillance camera in question, containing all the essential information elements referred to in the art. 13 of the Regulation.
Pursuant to the articles. 58, par. 1, letter. a), of the Regulation and 157 of the Code, the Municipality must also communicate to the Authority, providing adequately documented feedback, within thirty days of notification of this provision, the initiatives undertaken in order to implement the above ordered pursuant to the aforementioned art. 58, par. 2, letter. d), as well as any measures implemented to ensure compliance of the processing with the legislation on the protection of personal data.
6. Adoption of the injunction order for the application of the pecuniary administrative sanction and accessory sanctions (articles 58, paragraph 2, letters i and 83 of the Regulation; article 166, paragraph 7, of the Code).
The Guarantor, pursuant to articles. 58, par. 2, letter. i) and 83 of the Regulation as well as art. 166 of the Code, has the power to "impose a pecuniary administrative sanction pursuant to article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each single case" and, in this framework, "the Board [of the Guarantor] adopts the injunction order, with which it also provides for the application of the additional administrative sanction of its publication, in full or in extract, on the website of the Guarantor pursuant to article 166, paragraph 7, of the Code” (art. 16, paragraph 1, of the Guarantor Regulation no. 1/2019).
In this regard, taking into account the art. 83, par. 3 of the Regulation, in this case the violation of the aforementioned provisions is subject to the application of the pecuniary administrative sanction provided for by the art. 83, par. 5, of the Regulation.
The aforementioned pecuniary administrative sanction imposed, depending on the circumstances of each individual case, must be determined in the amount taking into due account the elements provided for by the art. 83, par. 2, of the Regulation.
In relation to the aforementioned elements, the specific nature of the processing was considered, initiated in a manner that does not comply with the sector regulations regarding the use of tools that may involve monitoring of the work activity and with the indications provided over time by the Guarantor, for the competence profiles (see art. 83, par. 1, letter a), of the Regulation).
Furthermore, consideration was given to the fact that the Municipality, despite the start of the investigation by the Authority, did not demonstrate that it had provided the interested parties (citizens, visitors and employees) with specific information on the processing of personal data via the video surveillance camera in question (see art. 83, par. 1, letter a), of the Regulation).
For the aforementioned reasons, it is believed that, in the present case, the level of severity of the violation committed by the data controller is high (see European Data Protection Committee, “Guidelines 04/2022 on the calculation of administrative fines under the GDPR” of 23 May 2023, point 60).
Having said this, it must be considered, in favor of the owner, that the latter is a municipality of modest size (approximately 2,700 inhabitants) and that, for the purposes of 83, par. 2, letter. e), of the Regulation, there are no previous relevant violations committed by the data controller or previous measures referred to in the art. 58 of the Regulation.
Finally, for the purposes of art. 83, par. 2, letter. k), of the Regulation, it is considered necessary to consider that the violation concerned a specific internal structure of the data controller and not the overall organization of the same.
On the basis of the aforementioned elements, evaluated as a whole, it is decided to determine the amount of the pecuniary sanction in the amount of 3,000 (three thousand) euros for the violation of the articles. 5, par. 1, letter. a) and b), 6, 12, 13 and 88 of the Regulation, as well as 114 of the Code (in reference to art. 4, paragraphs 1 and 3, of law no. 300/1970), as a pecuniary administrative sanction deemed, pursuant to art. 83, par. 1 of the Regulation, effective, proportionate and dissuasive.
Taking into account that the processing carried out involved personal data also relating to vulnerable data subjects in the work context (see paragraph 75 and art. 88 of the Regulation and "Guidelines concerning the impact assessment on data protection as well as the criteria to establish whether a treatment "may present a high risk" pursuant to Regulation 2016/679”, WP 248 of 4 April 2017), it is also believed that the additional sanction of publication of this provision on the Guarantor's website should be applied, provided for by the art. 166, paragraph 7 of the Code and art. 16 of the Guarantor Regulation n. 1/2019.
Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019.
ALL THIS CONSIDERING THE GUARANTOR
declares, pursuant to art. 57, par. 1, letter. f), of the Regulation, the illegality of the processing carried out by the Municipality of Madignano due to violation of the articles. 5, par. 1, letter. a) and b), 6, 12, 13 and 88 of the Regulation, as well as 114 of the Code (in reference to art. 4, paragraphs 1 and 3, of law no. 300/1970), within the terms set out in the motivation;
ORDER
to the Municipality of Madignano, in the person of the legal representative pro tempore, with registered office in Via Libertà, 22 - 26020 Madignano (CR), C.F. 00302860192, to pay the sum of 3,000 (three thousand) euros as a pecuniary administrative sanction for the violations indicated in the justification. It is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the fine imposed;
ORDERS
- to the aforementioned Municipality, in case of failure to resolve the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of 3,000 (three thousand) according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the law. n. 689/1981;
- pursuant to art. 58, par. 2, letter. d), of the Regulation, to provide all interested parties (i.e. both workers and visitors to the Municipality's headquarters), pursuant to articles. 5, par. 1, letter. a), 12 and 13 of the Regulation, appropriate information on the processing of personal data, containing all the essential information elements referred to in the art. 13 of the Regulation;
- pursuant to art. 157 of the Code, to communicate to the Authority, within 30 days of notification of this provision, the initiatives undertaken in order to implement the measures imposed; any failure to comply with the provisions of this point may result in the application of the pecuniary administrative sanction provided for by the art. 83, par. 5, of the Regulation;
HAS
- the publication of this provision on the Guarantor's website pursuant to art. 166, paragraph 7, of the Code (see art. 16 of the Guarantor's Regulation no. 1/2019);
- the annotation of this provision in the internal register of the Authority, provided for by the art. 57, par. 1, letter. u), of the Regulation, of violations and measures adopted in compliance with the art. 58, par. 2 of the Regulation (see art. 17 of the Guarantor's Regulation no. 1/2019).
Pursuant to the articles. 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, it is possible to appeal against this provision before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.
Messina, 11 April 2024
PRESIDENT
Stanzione
THE SPEAKER
Zest
THE GENERAL SECRETARY
Mattei
