Garante per la protezione dei dati personali (Italy) - 10065894
Garante per la protezione dei dati personali - 10065894 | |
---|---|
Authority: | Garante per la protezione dei dati personali (Italy) |
Jurisdiction: | Italy |
Relevant Law: | Article 2(2) GDPR Article 5(1)(a) GDPR Article 6 GDPR Article 57(1)(a) GDPR Article 58(2)(d) GDPR Article 157 Article 166 |
Type: | Complaint |
Outcome: | Upheld |
Started: | 13.07.2022 |
Decided: | |
Published: | 12.09.2024 |
Fine: | 400 EUR |
Parties: | n/a |
National Case Number/Name: | 10065894 |
European Case Law Identifier: | n/a |
Appeal: | n/a |
Original Language(s): | Italian |
Original Source: | Garante per a protezione dei dati personali (in IT) |
Initial Contributor: | ligialagev |
The DPA fined a controller €400 for unlawfully installing video surveillance cameras that captured neighbors' doors and windows in a disputed alley area.
English Summary
Facts
The controller installed five video surveillance cameras on their external wall, with three of them functioning and recording an alley area where property ownership was disputed.
The cameras were capable of capturing the secondary doors and windows of neighboring houses. While the controller claimed exclusive ownership of the alley and argued that neighbors had illegally built doors and windows on the perimeter wall, they failed to adjust the cameras' angle after being notified by the DPA to do so.
Holding
First, The DPA pointed out that video surveillance by natural persons can be exempt from GDPR when used for purely personal purposes under Article 2(2) GDPR. However, this exemption only applies when cameras are limited to the controller's own property and immediate surroundings.
In examining the footage, the DPA found that the controller's cameras captured areas beyond their immediate property, including neighbors' doors and windows. This meant the processing could not benefit from the household exemption under Article 2(2) GDPR.
Furthermore, since the controller lacked any valid legal basis for capturing these third-party areas, the DPA found a violation of Article 6 GDPR. The processing also violated the principle of lawfulness under Article 5(1)(a) GDPR, as filming neighbors' private areas without proper justification went against fundamental data protection principles.
Based on these violations, the DPA ordered the controller to adjust the cameras' viewing angle to exclude neighbors' private areas within 90 days and imposed a fine of €400.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[web doc. no. 10065894] Provision of 12 September 2024 Register of provisions no. 549 of 12 September 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer Guido Scorza, members and the councilor Fabio Mattei, secretary general; SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter "Regulation"); SEEN Legislative Decree no. 30 June 2003, no. 196 (Personal Data Protection Code, hereinafter “Code”) as amended by Legislative Decree no. 101 of 10 August 2018 containing “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679”; SEEN the report of 13 July 2022; EXAMINING the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Guarantor’s regulation no. 1/2000; REPORTER Prof. Ginevra Cerrina Feroni; WHEREAS 1. The preliminary investigation. With the report of 13 July 2022, Messrs. XX, XX, XX complained about the installation, on the external wall owned by Mr. XX, of five cameras aimed at the secondary doors and windows of the homes of the reporters overlooking the alley "XX", an area whose ownership is legally disputed. With the request for information of 28 September 2022, formulated pursuant to art. 157 of Legislative Decree no. 196 of 2003, containing the Code on the protection of personal data, the Office initiated the preliminary investigation, inviting the data controller to report on what was reported and at the same time delegated the Special Unit for the Protection of Privacy and Technological Fraud of the Guardia di Finanza to carry out the appropriate on-site checks. During the investigation, carried out on 22 and 23 November 2022, the military noted that the video surveillance system is composed of 5 cameras, of which two are not working and three are working, located externally, in the upper part of the wall of the building owned by the data controller. The party stated that the system, designed to protect the safety of people and property, was installed in 2018 with two cameras that were only for detection, then disconnected and left on the wall as a deterrent. Following the threats and beatings received from neighbors in July 2022 (Annex No. 15 of the report), three cameras were installed that record images in the event of movement of people or things within range. In relation to the viewing angle of the cameras, the party specified that the object of the filming is "the entire area of Vicolo XX, up to what was previously the wall that delimited my property and has now become the wall where my neighbors, illegally, have opened windows and doors. I reiterate that the space of the alley has always been my property... I would like to point out that my neighbors' homes have the main access on the opposite side and have no right of access or passage in the so-called Vicolo XX". Having noted that the images were suitable for framing areas, in fact, pertaining to the reporting parties, the Office, with the note of 10 February 2023, invited the data controller, pursuant to art. 157 of Legislative Decree no. 196 of 2003, the Personal Data Protection Code, to adopt suitable measures to limit the viewing angle of the cameras, excluding from the recording non-pertinent areas such as the secondary doors and windows of the private homes of the reporting parties that overlook the alley. With the feedback note of 7 April 2023, the data controller, in providing his observations, reiterated that the doors of the reporting parties were built illegally on the perimeter wall, that the area being filmed constitutes exclusive property and is not burdened by any right in favor of third parties. The same communication also highlighted the purpose of protecting property and specified that the images are used by the judicial authority for the purposes of ascertaining the crimes in relation to which criminal proceedings are underway against a whistleblower. Finally, it was declared that, for technical reasons, there are only two functioning cameras, to which the images certifying the object of the recording can be traced. 2. The initiation of the sanctioning procedure. With the communication of 1 August 2023, the Office notified the party of the act of initiation of the procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the recording of areas not directly relevant, in particular, of the doors and windows owned by third parties that insist on the perimeter wall, and to the related processing of personal data carried out in the absence of a suitable basis for lawfulness, in violation of art. 5, paragraph 1, letter a) and 6, paragraph 1, of the Regulation. The party, informed by the Office of the possibility of producing defensive documents or documents in relation to the proceedings against him, sent several communications with which, in reiterating the exclusive ownership of the area in question, specified that: "the area of the cadastral map no. 772 does not consist and has never been in the last 50 years and previously in a "Municipal property alley", but in an urban area of my exclusive property. The area is therefore closed, accessible only through my home, adjacent to it and from the two gates closed by locks whose keys are in my possession; the area in question is still today my exclusive property whose possession is qualified as, from the attached documentation (Annex A) and well known to the neighbors. The plaintiffs have access to the documents relating to the Minutes of the case of October 24, 2019 and are aware of the non-restitution of the area to the Municipality and of the secular adverse possession as well as the related request for a declaratory judgment (Annex B)". 3. The outcome of the investigation. The processing of data carried out by means of a video surveillance system if carried out by natural persons for personal and domestic purposes is to be included in the causes for exclusion of the application of the data protection legislation pursuant to art. 2 par. 2 of EU Regulation 2016/679. In this regard, recital no. 18 of the Regulation specifies that an “exclusively personal or domestic activity” is considered to be one carried out without a connection to a commercial or professional activity. The use of video surveillance systems by natural persons in areas of direct interest (such as those relating to their home and its appurtenances) is therefore to be considered, in principle, excluded from the material scope of application of the provisions on data protection, because it falls within the processing carried out for the exercise of exclusively personal and domestic activities. This is provided that the scope of data communication does not exceed the owner's family sphere and the images are not communicated to third parties or disseminated and the processing does not extend beyond the areas of strict relevance of the owner by taking images in common areas (including condominium areas such as stairways, hallways, parking lots), places open to the public (streets or squares), or areas pertaining to third parties (gardens, terraces, doors or windows pertaining to third parties). It follows that it is possible to install video recording systems, without having to comply with the obligations set forth by the regulations on the protection of personal data, provided that the viewing angle of the cameras is limited to the areas of their own relevance only, possibly also through the activation of a function to darken the excess parts. Only in the presence of adequately documented situations of actual risk (for example, reports of threats, thefts or acts of vandalism), the data controller may, on the basis of a legitimate interest, extend the video camera recording to public areas or areas open to the public, immediately adjacent to those of relevance, provided, however, that the public space recorded is only that immediately facing the entrances to one's home and that such extension is necessary and proportionate, in relation to the context, to ensure effective protection. However, recordings of public or common spaces that do not have an immediate connection with the areas of relevance and recordings of areas of relevance to third parties are not permitted. In the case in question, the investigation shows that the recording also involved areas that are external and of relevance to third parties, in the absence of suitable conditions of lawfulness. The processing of the personal data subject to these proceedings is therefore carried out in violation of art. 5, par. 1, letter a) and art. 6 of the Regulation. 4. Conclusions The circumstances presented during the inspection, examined as a whole, although worthy of consideration, do not allow us to overcome the findings notified by the Office, with the act of initiation of the procedure, since it is not possible to detect the circumstance that the whistleblowers would have opened, according to the addressees of the complaint, doors and windows abusively and that they would not claim any right of access or passage in the aforementioned alley. Aside from the civil aspects regarding the legal ownership of the property of the area and the related remedies available, even in the event of non-compliance with the rules on views, the range of the cameras, as documented in the documents, also involving the facade where the doors and windows of the house used by the whistleblowers are located, actually involves an area belonging to third parties, giving rise to a processing of personal data which, therefore, not only does not fall within the scope of exclusion from the application of the data protection legislation pursuant to art. 2 of the Regulation but is not even supported by an adequate legal basis (art. 6 of the Regulation). It is therefore considered necessary to order the data controller, pursuant to art. 58, par. 2, letter d), of the Regulation, to adopt adequate measures to limit the viewing angle of the cameras so as to exclude the doors and windows of the reporting persons' homes from the recording. The Guarantor, pursuant to art. 58, par. 2, letter i) of the Regulation and art. 166 of the Code, has the power to impose an administrative fine provided for by art. 83, par. 5, of the Regulation, by adopting an injunction order (art. 18. Law 24 November 1981 no. 689), in relation to the processing of personal data carried out by the party by means of the video surveillance system, in violation of art. 5, par. 1, letter a) and 6 of the Regulation. With reference to the elements listed in art. 83, par. 2, of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must be "effective, proportionate and dissuasive in each individual case" (art. 83, par. 1 of the Regulation), it is represented that for the purposes of assessing the conduct the following were taken into consideration: - the conduct of the data controller which consisted in extending the range of video surveillance also with reference to areas belonging to third parties; - the circumstance that the party did not deem it necessary, despite the findings, to modify the viewing angle of the cameras. On the basis of the aforementioned elements, assessed as a whole, it is believed that the amount of the pecuniary sanction should be determined in the amount of EUR 400.00 (four hundred) for the violation of art. 5, par. 1, letter a) and art. 6 of the Regulation. In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, it is necessary to proceed with the publication of this provision on the website of the Guarantor. Finally, it is believed that the conditions set out in art. 17 of regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met. GIVEN ALL THE ABOVE, THE GUARANTOR pursuant to art. 57, par. 1, letter a) and 83 of the Regulation, declares the unlawfulness of the processing carried out by Mr. XX (fiscal code: XX), in the terms set out in the reasons, for the violation of art. 5, par. 1, letter a) and 6 of the Regulation; ORDER the party: pursuant to art. 58, par. 2, letter d) of the Regulation, to conform the processing carried out through the video surveillance system by adopting the measures necessary to limit the viewing angle of the cameras, excluding the doors and windows of the reporting persons' homes from the recording and to provide adequately documented feedback pursuant to art. 157 of the Code, within 90 days from the date of notification of this provision; any failure to provide feedback may result in the application of the administrative sanction provided for by art. 83, par. 5, letter e) of the Regulation; to pay the sum of €400.00 (four hundred), according to the methods indicated in the attachment, within 30 days from notification of this provision, under penalty of the adoption of the consequent executive actions pursuant to art. 27 of Law no. 689/1981. It is hereby stated that pursuant to art. 166, paragraph 8 of the Code, the right of the offender to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the deadline referred to in art. 10, paragraph 3, of Legislative Decree no. 150 of 1 September 2011 provided for the filing of the appeal as indicated below remains intact; ORDERS pursuant to art. 58, paragraph 2, letter i) of the Regulation to pay the sum of €400.00 (four hundred) as an administrative pecuniary sanction for the violations indicated in this provision; ORDERS pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor regulation no. 1/2019, the publication of this provision on the website of the Guarantor and believes that the conditions set out in art. 17 of Regulation no. 1/2019 are met. Pursuant to art. 78 of Regulation (EU) 2016/679, as well as art. 152 of the Code and 10 of Legislative Decree no. 150 of 1 September 2011, an objection to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same art. 10, within thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad. Rome, 12 September 2024 THE PRESIDENT Stanzione THE REPORTER Cerrina Feroni THE GENERAL SECRETARY Mattei [web doc. no. 10065894] Provision of 12 September 2024 Register of provisions n. 549 of 12 September 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer Guido Scorza, members and the councilor Fabio Mattei, secretary general; SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation"); SEEN Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code, hereinafter the "Code") as amended by Legislative Decree no. 101 containing “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679”; SEEN the report of 13 July 2022; EXAMINING the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Guarantor’s regulation no. 1/2000; REPORTER Prof. Ginevra Cerrina Feroni; WHEREAS 1. The preliminary investigation. With the report of 13 July 2022, Messrs. XX, XX, XX complained about the installation, on the external wall owned by Mr. XX, of five cameras aimed at the secondary doors and windows of the homes of the reporters that overlook alley “XX”, an area whose ownership is legally disputed. With the request for information of 28 September 2022, formulated pursuant to art. 157 of Legislative Decree no. 196 of 2003, containing the Personal Data Protection Code, the Office initiated the preliminary investigation, inviting the data controller to report on what was reported and at the same time delegated the Special Unit for the Protection of Privacy and Technological Fraud of the Guardia di Finanza to carry out the appropriate on-site checks. During the investigation, carried out on 22 and 23 November 2022, the military noted that the video surveillance system is composed of 5 cameras, two of which are not working and three are working, located externally, in the upper part of the wall of the building owned by the data controller. The party declared that the system, designed to protect the safety of people and property, was installed in 2018 with two cameras that were only for detection, then disconnected and left on the wall as a deterrent. Following the threats and beatings received from neighbors in July 2022 (Annex No. 15 of the report), three cameras were installed that record images in the event of movement of people or things within range. In relation to the viewing angle of the cameras, the party specified that the object of the filming is "the entire area of Vicolo XX, up to what was previously the wall that delimited my property and has now become the wall where my neighbors, illegally, have opened windows and doors. I reiterate that the space of the alley has always been my property... I would like to point out that the homes of my neighbors have the main access on the opposite side and have no right of access or passage in the so-called Vicolo XX". Having noted that the images were suitable for framing areas, in fact, pertaining to the reporting parties, the Office, with the note of 10 February 2023, invited the data controller, pursuant to art. 157 of Legislative Decree no. 196 of 2003, the Personal Data Protection Code, to adopt suitable measures to limit the viewing angle of the cameras, excluding from the recording non-pertinent areas such as the secondary doors and windows of the private homes of the whistleblowers that overlook the alley. With the feedback note of 7 April 2023, the data controller, in providing his observations, reiterated that the doors of the whistleblowers were built illegally on the perimeter wall, that the area being filmed constitutes exclusive property and is not burdened by any right in favour of third parties. The same communication also highlighted the purpose of protecting property and specified that the images are used by the judicial authority for the purposes of ascertaining the crimes in relation to which criminal proceedings are underway against a whistleblower. Finally, it was stated that, for technical reasons, there are only two functioning cameras, to which the images certifying the object of the recording can be traced. 2. The initiation of the sanctioning procedure. With the communication of 1 August 2023, the Office notified the party of the act of initiation of the procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the recording of areas not of direct relevance, in particular, of the doors and windows owned by third parties that insist on the perimeter wall, and to the related processing of personal data carried out in the absence of a suitable basis of lawfulness, in violation of art. 5, paragraph 1, letter a) and 6, paragraph 1, of the Regulation. The party, informed by the Office of the possibility of producing written defenses or documents in relation to the proceedings against him, sent several communications in which, in reiterating the exclusive ownership of the area in question, he specified that: "the area of the cadastral map no. 772 does not consist and has never been in the last 50 years and previously in a "Municipal property alley", but in an urban area of my exclusive property. The area is therefore closed, accessible only through my home, adjacent to it and from the two gates closed by locks whose keys are in my possession; the area in question is still today my exclusive property whose possession is qualified as, by the attached documentation (Annex A) and well known to the neighbors. The plaintiffs have access to the documents relating to the Minutes of the Case of 24 October 2019 and are aware of the non-restitution of the area to the Municipality and of the secular adverse possession as well as the related request for a declaratory judgment (Annex B)”. 3. The outcome of the investigation. The processing of data carried out through a video surveillance system if carried out by natural persons for personal and domestic purposes is to be included in the causes for exclusion of the application of the data protection legislation pursuant to art. 2 par. 2 of EU Regulation 2016/679. In this regard, recital no. 18 of the Regulation specifies that an “activity of an exclusively personal or domestic nature” is considered to be one carried out without a connection to a commercial or professional activity. The use of video surveillance systems by natural persons in areas of direct interest (such as those relating to their home and its appurtenances) is therefore to be considered, in principle, excluded from the material scope of application of the provisions on data protection, because it falls within the processing carried out for the exercise of activities of an exclusively personal and domestic nature. This is provided that the scope of communication of the data does not exceed the family sphere of the owner and the images are not subject to communication to third parties or dissemination and the processing does not extend beyond the areas of strict relevance of the owner by taking images in common areas (including condominium-type areas such as stairways, hallways, parking lots), places open to the public (streets or squares), or areas pertaining to third parties (gardens, terraces, doors or windows pertaining to third parties). It follows that it is possible to install video recording systems, without having to comply with the obligations set forth by the regulations on the protection of personal data, provided that the viewing angle of the cameras is limited to the areas of their own relevance, also possibly through the activation of a function to black out the excess parts. Only in the presence of adequately documented situations of actual risk (for example by reports of threats, thefts or acts of vandalism), the data controller may, on the basis of a legitimate interest, extend the recording of the video cameras also to public areas or areas open to the public, immediately close to those of relevance, provided however that the public space recorded is only that immediately facing the entrances to one's home and that such extension is necessary and proportionate, in relation to the context, to ensure effective protection. However, recordings of public or common spaces that do not have an immediate connection with the areas of relevance and recordings of areas of relevance to third parties are not permitted. In the case in question, the investigation shows that the recovery also involved areas that were external and pertinent to third parties, in the absence of suitable conditions of lawfulness. The processing of personal data that are the subject of these proceedings is therefore carried out in violation of art. 5, par. 1, letter a) and art. 6 of the Regulation. 4. Conclusions The circumstances reported during the inspection, examined as a whole, although worthy of consideration, do not allow us to overcome the findings notified by the Office, with the act of initiation of the proceeding, not being able to detect the circumstance that the whistleblowers had opened, according to the addressees of the complaint, doors and windows illegally and that they did not claim any right of access or passage in the aforementioned alley. Aside from the civil aspects regarding the legal ownership of the area and the related remedies available, even in the event of non-compliance with the rules on views, the range of the cameras, as documented in the documents, also involving the facade where the doors and windows of the house used by the whistleblowers are located, actually involves an area belonging to third parties, giving rise to the processing of personal data which, therefore, not only does not fall within the scope of exclusion from the application of the data protection legislation pursuant to art. 2 of the Regulation but is not even supported by an adequate legal basis (art. 6 of the Regulation). It is therefore considered necessary to order the data controller, pursuant to art. 58, par. 2, letter d), of the Regulation, to adopt adequate measures aimed at limiting the viewing angle of the cameras so as to exclude the doors and windows of the house of the whistleblowers from the shooting. The Guarantor, pursuant to art. 58, par. 2, letter i) of the Regulation and art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, by adopting an injunction order (art. 18, law 24 November 1981 n. 689), in relation to the processing of personal data carried out by the party by means of the video surveillance system, in violation of art. 5, par. 1, letter a) and 6 of the Regulation. With reference to the elements listed in art. 83, par. 2, of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must be "in each individual case effective, proportionate and dissuasive" (art. 83, par. 1 of the Regulation), it is represented that for the purposes of assessing the conduct the following were taken into consideration: - the conduct of the data controller which consisted in extending the range of video surveillance also with reference to areas pertaining to third parties; - the circumstance that the party did not deem it necessary, despite the findings, to modify the viewing angle of the cameras. In light of the aforementioned elements, assessed as a whole, it is believed that the amount of the pecuniary sanction should be determined in the amount of EUR 400.00 (four hundred) for the violation of art. 5, par. 1, letter a) and art. 6 of the Regulation. In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, this provision should be published on the website of the Guarantor. Finally, it is believed that the conditions set out in art. 17 of regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, exist. CONSIDERING ALL THE ABOVE, THE GUARANTOR pursuant to art. 57, par. 1, letter a) and 83 of the Regulation, declares the unlawfulness of the processing carried out by Mr. XX (fiscal code: XX), in the terms set out in the reasons, for the violation of art. 5, par. 1, letter a) and 6 of the Regulation; ORDERS the party: pursuant to art. 58, par. 2, letter d) of the Regulation, to conform the processing carried out through the video surveillance system by adopting the measures necessary to limit the viewing angle of the cameras, excluding the doors and windows of the reporting persons' homes from the recording and to provide adequately documented feedback pursuant to art. 157 of the Code, within 90 days from the date of notification of this provision; any failure to provide feedback may result in the application of the administrative sanction provided for by art. 83, paragraph 5, letter e) of the Regulation; to pay the sum of €400.00 (four hundred), according to the methods indicated in the attachment, within 30 days from notification of this provision, under penalty of adopting the consequent executive actions pursuant to art. 27 of Law no. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, the right of the offender to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the deadline referred to in art. 10, paragraph 3, of Legislative Decree no. 150 of 1 September 2011 provided for the filing of the appeal as indicated below; ORDERS pursuant to art. 58, paragraph 2, letter i) of the Regulation to pay the sum of €400.00 (four hundred) as an administrative pecuniary sanction for the violations indicated in this provision; ORDERS pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor regulation no. 1/2019, the publication of this provision on the website of the Guarantor and believes that the conditions set out in art. 17 of Regulation no. 1/2019 are met. Pursuant to art. 78 of Regulation (EU) 2016/679, as well as art. 152 of the Code and 10 of Legislative Decree no. 150 of 1 September 2011, an objection to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same art. 10, within thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad. Rome, 12 September 2024 THE PRESIDENT Stanzione THE REPORTER Cerrina Feroni THE GENERAL SECRETARY Mattei