Garante per la protezione dei dati personali (Italy) - 10070348

Garante per la protezione dei dati personali - 10070348

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5 GDPR Article 5(1)(a) GDPR Article 6(1)(c) GDPR Article 9(2)(b) GDPR Article 12(7) GDPR Article 13 GDPR EDPB Guidelines 3/2019 Codice in materia di protezione dei dati personali Legge 300/1970 - Statuto dei Lavoratori Provvedimento in materia di videosorveglianza
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	17.07.2024
Fine:	5,000 EUR
Parties:	Mark s.r.l.s.
National Case Number/Name:	10070348
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	ligialagev

The DPA fined a company €5,000 for operating video surveillance cameras without required warning signs and prior workplace monitoring authorization.

English Summary

Facts

During an inspection carried out on 4th July, 2023, the Police and Labor Inspectorate (Ispettorato Territoriale del Lavoro) found that controller, a bar located in the city of Bologna, had installed 10 surveillance cameras (5 inside and 5 outside the premises) without any information notices informing individuals about the video surveillance.

On 12th March, 2024, the Labor Inspectorate informed the DPA that during their inspection, they found the video surveillance system had been installed without the required legal authorization, violating workers' rights laws.

The video surveillance system was operating without required warning signs informing people they were entering a monitored area. For workplace surveillance, Italian law requires prior Labor Inspectorate authorization or union agreement, which the company did not have at the time of inspection. While the company later obtained the authorization and claimed to have installed warning signs, it provided no evidence of setting up these warning signs.

Holding

First, the DPA found that recording individuals without informing them through appropriate signalling violated the transparency principle under Article 5(1)(a) GDPR and the information obligations under Article 13 GDPR, and therefore makes the data processing unlawful.

The DPA emphasised that transparency requires individuals to be informed before entering a video-surveilled area through clearly visible signs placed at eye level, in accordance with EDPB Guidelines 3/2019.

The DPA also found that operating workplace video surveillance without prior authorization from the Labor Inspectorate violated Article 114 of the Italian Data Protection Code, which requires compliance with Article 4, L. 300/1970 (Workers' Statute - Statuto dei Lavoratori) for processing employee data.

On these grounds, the DPA imposed a €5,000 fine and ordered the company to install proper warning signs.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10070348]

Provision of 17 July 2024

Register of provisions
no. 467 of 17 July 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “Regulation”);

HAVING SEEN Legislative Decree no. 30 June 2003 196 (Personal Data Protection Code, hereinafter “Code”) as amended by Legislative Decree no. 101 of 10 August 2018 containing “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679”;

SEEN the report of the Bologna Police Headquarters - Administrative and Security Police Division, transmitted with a note dated 7.7.2023, which reports an inspection carried out on 4.7.2023, together with the staff of the Bologna Labor Inspectorate, at the public establishment called “The Lull Bar”, managed by Mark s.r.l.s., located in Bologna, Via Marco Emilio Lepido 221/a, with which the presence of a video surveillance system consisting of 10 cameras was ascertained, 5 positioned inside and 5 outside the aforementioned commercial establishment without the relevant signage;

HAVING EXAMINED the documentation in the files;

SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Guarantor's regulation no. 1/2000;

REPORTER Prof. Ginevra Cerrina Feroni;

WHEREAS

1. The report received and the initiation of the procedure.

With a note received on 7.7.2023, the Bologna Police Headquarters - Administrative and Security Police Division, sent this Authority the report drawn up following an inspection carried out, on 4.7.2023, together with the staff of the Bologna Labor Inspectorate, at the public establishment called "The Lull Bar", managed by Mark s.r.l.s. (hereinafter, the “Company”), located in Bologna, Via Marco Emilio Lepido 221/a, which ascertained the presence of a video surveillance system consisting of 10 cameras, 5 positioned inside and 5 outside the aforementioned commercial establishment without the relevant signage.

Following a specific request to the aforementioned Labour Inspectorate in relation to the ascertainment of irregularities relating to compliance with the guarantees provided for in art. 4 of Law no. 300/1970 (so-called Workers' Statute), the Inspectorate, with a note dated 12.3.24, provided feedback to the Guarantor declaring that during the inspections “the presence of a video surveillance system installed in the absence of the legal authorisation provision, in violation of art. 4 of the Workers' Statute" and that "within the terms provided for in the concurrent prescription report pursuant to Legislative Decree 758/94, the offender submitted a specific request and obtained the authorization to install the system in question, thus eliminating the irregularity ascertained with subsequent payment of the expected sum".

Therefore, the Office, with a note dated 20.3.2024 (prot. no. 34675), notified Mark s.r.l.s. of the act of initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of arts. 5 par. 1, letter a), 13 of the Regulation and 114 of the Code.

In a note received on 16.4.2024, the Company sent written defenses stating that it had installed “video surveillance area reporting folders (…) in several points of the premises” without, however, providing photographic documentation proving what was declared.

Attached to the aforementioned note, the Company produced a copy of the authorization act for the installation of the video surveillance system at the premises of the same located in Bologna Via Marco Emilio Lepido 221/a, by the Territorial Labor Inspectorate of Bologna (provision no. 21030 of 20.7.2023).

2. The legal framework of the processing carried out

The use of video surveillance systems may determine, in relation to the positioning of the cameras and the quality of the images recorded, the processing of personal data. Such processing must be carried out in compliance with the general principles contained in art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "the interested parties must always be informed that they are about to access a video-surveillance area".

To this end, therefore, the data controller must affix suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - 8 April 2010 [1712680] (in this sense also the FAQs on video surveillance, published on the Authority's website).

Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "With regard to video surveillance, the most important information must be indicated [by the controller] on the warning sign itself (first level), while the additional mandatory details may be provided by other means (second level). The guidelines also provide that “Such information may be provided in combination with an icon to give, in a highly visible, intelligible and clearly legible manner, an overall picture of the intended processing (Article 12, paragraph 7, of the GDPR). The format of the information should be adapted to the different locations”. The information should be positioned in a way that allows the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) “to allow the data subject to estimate which area is covered by a camera in order to avoid surveillance or to adapt his or her behavior, where necessary”.

The processing of personal data carried out in the context of the employment relationship, if necessary for the purpose of managing the relationship itself (see Articles 6, paragraph 1, letter c); 9, paragraph 2, letter b) of the Regulation), must be carried out in compliance with the general principles indicated in Article 12, paragraph 1, letter c); 5 of the Regulation, and in particular the principle of lawfulness, according to which the processing is lawful if it complies with the applicable sector regulations (art. 5, par. 1, letter a) of the Regulation). In line with this approach, art. 88 of the Regulation has saved the national provisions of greater protection (“more specific provisions”) aimed at ensuring the protection of the rights and freedoms with regard to the processing of workers’ personal data. The national legislator has approved, as a more specific provision, art. 114 of the Code which, among the conditions of lawfulness of the processing, has established compliance with the provisions of art. 4, Law 20 May 1970, no. 300. The violation of art. 88 of the Regulation is subject, if the requirements are met, to the application of an administrative pecuniary sanction pursuant to art. 83, par. 5, letter d) of the Regulation.

Based on the aforementioned art. 4, Law no. 300 of 1970, video surveillance devices, if they also provide “the possibility of remote control” of employee activity, “can be used exclusively for organizational and production needs, for workplace safety and for the protection of company assets” and the related installation must, in any case, be carried out following the stipulation of a collective agreement with the unitary trade union representation or with the company trade union representatives or, where it has not been possible to reach such an agreement or in the absence of the representatives, only if preceded by the release of a specific authorization by the Labor Inspectorate.

The activation and conclusion of this guarantee procedure is therefore an essential condition for the installation of video surveillance systems. Violation of this provision is criminally sanctioned (see art. 171 of the Code). The processing of personal data carried out by the company through the video surveillance system is therefore unlawful, in the terms set out above, in relation to the arts. 5, par. 1, letter a), 13 and 114 of the Code.

3. The outcome of the investigation and the sanctioning procedure.

On the basis of the investigation carried out, it emerged that, at the time of the check, the video surveillance system, installed at the operational headquarters of Mark s.r.l.s. located in Bologna, Via Marco Emilio Lepido 221/a, was active and functioning, that no sign containing the information referred to in art. 13 of the Regulation had been affixed and that the guarantee measures provided for by art. 4 of Law no. 300/1970, referred to in art. 114 of the Code, in relation to the presence of employees in the video-monitored premises, had not been adopted.

In this case, it is therefore proven that personal data was processed, by means of a video surveillance system, in the absence of the required information. This conduct conflicts with the provisions of art. 13 of the Regulation, according to which the data controller is required to provide the data subject with all information relating to the essential characteristics of the processing.

Furthermore, given that the installation of the video surveillance system had not been previously authorised by the Labour Inspectorate (the authorisation provision of the Labour Inspectorate of Bologna is dated 27.7.2023 while the inspection was carried out on 7.7.2023), the processing was also carried out in violation of art. 114 of the Personal Data Protection Code.

4. Conclusions: declaration of unlawfulness of the processing. Corrective measures pursuant to art. 58, par. 2, Regulation.

The processing of personal data carried out by the Company is therefore unlawful, in the terms set out above, in relation to Articles 5, paragraph 1, letter a) (principle of transparency), 13 (information) of the Regulation and 114 of the Personal Data Protection Code.

The violation ascertained in the terms set out in the reasons cannot be considered “minor”, taking into account the nature, gravity and duration of the violation, the degree of responsibility and the manner in which the supervisory authority became aware of the violation (see recital 148 of the Regulation).

Although the party, in its defence briefs, declared that it had posted the information sign, it did not send any documentation proving what was declared.

Therefore, having ascertained the unlawfulness of the conduct as described above, it must:

- order the data controller, pursuant to Article 58, paragraph 2, letter a), to: d) of the Regulation, to proceed with the application of suitable signs containing information on the processing as indicated in point 2 of this provision where the same has not already done so;

- adopt an injunction order pursuant to art. 58, par. 2, letter i) of the Regulation for the application of a pecuniary administrative sanction.

5. Injunction order.

The Guarantor, pursuant to art. 58, par. 2, letter i) of the Regulation and art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, by adopting an injunction order (art. 18. law 24 November 1981 n. 689), in relation to the processing of personal data carried out by the company by means of the video surveillance system, which was found to be unlawful, in the terms set out above, in relation to art. 5, par. 1, letter a), 13 of the Regulation and art. 114 of the Code.

With reference to the elements listed in art. 83, par. 2, of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must be "in each individual case effective, proportionate and dissuasive" (art. 83, par. 1 of the Regulation), it is represented that, in the case in question, the circumstances reported below were taken into account:

with regard to the nature, seriousness and duration of the violation, the conduct of the data controller was taken into account, as well as the liability connected to the failure to comply with the obligation to provide information to the interested parties;

the absence of specific precedents against the company relating to violations of the regulations on the protection of personal data;

the circumstance that the Company, the data controller, despite having sent written defenses to the Guarantor, attaching documentation certifying the authorization to install the system by the Territorial Labor Inspectorate of Bologna, has not demonstrated that it has fulfilled the legal obligation relating to the affixing of suitable information signs.

It is also believed that, in this case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness to which the Authority must adhere in determining the amount of the sanction (Article 83, paragraph 1 of the Regulation), the economic conditions of the offender, determined with reference to the financial statements for the year 2023, are relevant.

In light of the aforementioned elements, assessed as a whole, it is believed that the amount of the pecuniary sanction should be determined in the amount of €5,000.00 (five thousand) for the violation of Articles 5, 13 of the Regulation and 114 of the Code.

In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Guarantor no. 1/2019, this provision should be published on the website of the Guarantor.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met.

GIVEN ALL THE ABOVE, THE GUARANTOR

declares, pursuant to art. 57, par. 1, letter f) and 83 of the Regulation, the unlawfulness of the processing carried out by Mark s.r.l.s. through the use of the video surveillance system installed at its premises located in Bologna, Via Marco Emilio Lepido 221/a, in the terms set out in the reasons, for the violation of art. 5, 13 of the Regulation and 114 of the Code;

ORDERS

to Mark s.r.l.s. P.I. 03643011202, with registered office in Bologna, Via Dei Mille 24, to pay the sum of €5,000.00 (five thousand) as an administrative fine for the violations indicated in this provision;

ORDERS

the same Mark s.r.l.s. to conform, pursuant to art. 58, par. 2, letter d) of the Regulation, the data processing carried out to the provisions of the Regulation, with reference to the affixing, where it has not already done so, of suitable information signs of the presence of cameras;

therefore to the same Mark s.r.l.s. to pay the sum of €5,000.00 (five thousand), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive actions pursuant to art. 27 of Law no. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, the right of the offender to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the deadline referred to in art. 10, paragraph 3, of Legislative Decree no. 150 of 1 September 2011 provided for the filing of the appeal as indicated below remains intact.

ORDERS

pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor no. 1/2019, the publication of this provision on the website of the Guarantor and believes that the conditions referred to in art. 17 of regulation no. 1/2019 are met.

Pursuant to art. 78 of the Regulation, of arts. 152 of the Code and 10 of Legislative Decree no. 150 of 1 September 2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 17 July 2024

THE PRESIDENT
Stanzione

THE REPORTER
Cerrina Feroni

THE GENERAL SECRETARY
Mattei

[web doc. no. 10070348]

Provision of 17 July 2024

Register of provisions
no. 467 of 17 July 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN TODAY’S meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, Members, and Council Member Fabio Mattei, Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “Regulation”);

SEEN Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code, hereinafter “Code”) as amended by Legislative Decree no. 101 of 10 August 2018 containing “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679”;

SEEN the report of the Bologna Police Headquarters - Administrative and Security Police Division, transmitted with a note dated 7.7.2023, which reports an inspection carried out on 4.7.2023, together with the staff of the Bologna Labor Inspectorate, at the public establishment called “The Lull Bar”, managed by Mark s.r.l.s., located in Bologna, Via Marco Emilio Lepido 221/a, with which the presence of a video surveillance system consisting of 10 cameras was ascertained, 5 positioned inside and 5 outside the aforementioned commercial establishment without the relevant signage;

EXAMINING the documentation in the files;

SEEN the observations formulated by the general secretary pursuant to art. 15 of the regulation of the Guarantor no. 1/2000;

REPORTER Prof. Ginevra Cerrina Feroni;

WHEREAS

1. The report received and the initiation of the procedure.

With a note received on 7.7.2023, the Bologna Police Headquarters - Administrative and Security Police Division, sent this Authority the report drawn up following an inspection carried out on 4.7.2023, together with the staff of the Bologna Labor Inspectorate, at the public establishment called “The Lull Bar”, managed by Mark s.r.l.s. (hereinafter, the “Company”), located in Bologna, Via Marco Emilio Lepido 221/a, with which the presence of a video surveillance system consisting of 10 cameras was ascertained, 5 positioned inside and 5 outside the aforementioned commercial establishment without the relevant signage.

Following a specific request to the aforementioned Labor Inspectorate in relation to the ascertainment of irregularities relating to compliance with the guarantees provided for in art. 4 of Law no. 300/1970 (so-called Workers' Statute), the Inspectorate, with a note dated 12.3.24, provided feedback to the Guarantor declaring that during the inspections "the presence of a video surveillance system installed in the absence of the legal authorization measure, in violation of art. 4 of the Workers' Statute was detected" and that "within the terms set out in the concurrent prescription report pursuant to Legislative Decree 758/94, the offender submitted a specific request and obtained the authorization measure for the installation of the system in question, thus eliminating the irregularity ascertained with subsequent payment of the expected sum".

Therefore, the Office, with a note dated 20.3.2024 (prot. no. 34675), notified Mark s.r.l.s. of the act of initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of articles 5 par. 1, letter a), 13 of the Regulation and 114 of the Code.

With a note received on 16.4.2024, the Company sent written defenses stating that it had installed “video surveillance area reporting folders (…) in several points of the premises” without, however, providing photographic documentation proving what was declared.