Garante per la protezione dei dati personali (Italy) - 9746047
From GDPRhub
| Garante per la protezione dei dati personali (Italy) - 9746047 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 27.01.2022 |
| Fine: | 2000 EUR |
| Parties: | Circolo Ruian |
| National Case Number/Name: | 9746047 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | n/a |
The Italian DPA fined a private club €2000 for having security cameras pointing towards the public sidewalk without an appropriate information sign, violating Articles 5(1)(a), 5(1)(c) and 13 GDPR.
English Summary
Facts
The Municipal Police of the Municipality of Florence informed the Italian DPA that Private club Ruian had video surveillance system in place with two external cameras oriented towards the sidewalk and street in front of the club, lacking an appropriate information sign.
Holding
The Italian DPA noted that the use of video surveillance systems may result in the processing of personal data depending on the positioning of the cameras and the quality of the images captured. Furthermore, the Italian DPA stated that processing of personal data by video surveillance cameras must be carried out in compliance with the general principles contained in Article 5 GDPR, in particular with the principle of transparency. In the case of video surveillance cameras, this presupposes that "the interested parties must always be informed that they are about to enter a video surveillance area", and therefore the data controller must place appropriate information signs which convey this information to data subjects.
The Italian DPA held that the processing of personal data carried out by the club in this case was unlawful since it was not carried out in accordance with the principles of "lawfulness, fairness and transparency" and "data minimisation", in violation of Articles 5(1)(a) and (c) GDPR, as well as in breach of the adequate information requirements under Article 13 GDPR. Based on these infringements, the Italian DPA imposed a €2000 fine on Ruian club.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[doc. web n. 9746047] Injunction order against the “Ruian” cultural club - January 27, 2022 Record of measures n. 20 of January 27, 2022 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei general secretary; GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation"); GIVEN the legislative decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 on "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679"; GIVEN the note of 10 July 2020 from the Municipality of Florence; EXAMINED the documentation in deeds; HAVING REGARD to the observations made by the Secretary General pursuant to art. 15 of the regulation of the Guarantor n. 1/2000; RAPPORTEUR prof. Pasquale Stanzione; WHEREAS 1. The assessment by the municipal police. 1.1. With the note of 10 July 2020, the Municipal Police of the Municipality of Florence communicated to this Authority that on 22 June 2020, it had carried out an inspection at the "Ruian" private club (hereinafter the "Club"), located in Florence, via San Biagio a Petriolo n. 34, following a report from the Florence Peretola Carabinieri Station. From the inspections carried out by the Urban Security and Heritage Department, it was ascertained that, at the Club, a video surveillance system that did not comply with the rules on the protection of personal data was functioning. In particular, the agents ascertained that the cameras, six placed inside the room and three outside and connected to an IT system inside the building, were not signaled by any sign containing the information and that two of the external cameras had a angle of view oriented towards the sidewalk and the carriageway in front of the Club, with the shot also turned, in one case, towards the facade of the Barracks of the Carabinieri Station next to the headquarters of the club. 1.2. The Office, on the basis of the findings of the investigations carried out, notified the Club (prot. No. 52501/21) the act of initiating the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of art. 5, par. 1, lett. a) and c) of the Regulations (angle of view not limited to the Club area) and art. 13 of the Regulations (absence of information). The party did not send briefs or defensive writings (Article 18 of Law no. 689/1981). 2. The legal framework of the processing carried out 2.1. The use of video surveillance systems may result in the processing of personal data in relation to the positioning of the cameras and the quality of the images recorded. This treatment must be carried out in compliance with the general principles contained in art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "interested parties must always be informed that they are about to enter a video surveillance area". For this purpose, therefore, the data controller must affix suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - April 8, 2010 [1712680] (in this sense also the Faq on video surveillance, published on the Authority's website). Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "With regard to video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while the additional mandatory details can be provided by other means (second level). The guidelines also provide that "This information may be provided in combination with an icon to give, in a clearly visible, intelligible and clearly legible way, an overview of the treatment envisaged (Article 12, paragraph 7, of the GDPR) . The format of the information will have to adapt to the various locations ". The information should be positioned in such a way as to allow the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) "to allow the data subject to estimate which area is covered by a camera in so as to avoid surveillance or adapt one's behavior, where necessary ". 2.2. It is also necessary to consider that the need to use video surveillance to protect the legitimate interests of a holder stops at the borders of the areas of its own pertinence. Even in cases where it is necessary to extend video surveillance to the immediate vicinity of the pertinent area, the data controller must in any case implement suitable measures to prevent the video surveillance system from collecting data even beyond the relevant areas, possibly obscuring such areas (see in this regard Guidelines No. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 27). 3. The outcome of the investigation. 3.1. On the basis of the verification activities carried out and the subsequent assessments carried out by the Office, it is ascertained that the Club has carried out a processing of personal data, by means of a video surveillance system in violation of the general principles regarding the protection of personal data referred to to art. 5, par. 1, lett. a) and c) and in the absence of suitable information in disregard of the provisions of art. 13 of the Regulation. It is up to the data controller, in this case to be identified in the Club, to evaluate the lawfulness of the same place in place through the video cameras and to inform the interested parties of the presence of the same, by affixing suitable notices bearing the information, from which it appears indication of the owner and the purposes of the processing. The treatment must also be carried out in such a way as to limit the viewing angle to the area actually to be protected, avoiding, as far as possible, the recovery of surrounding places and details that are not relevant for the protection of the legitimate interest of the owner of the treatment (public spaces, other commercial establishments or public buildings unrelated to the activities of the owner, etc.). 3.2. The processing of personal data put in place by the Club is therefore illegal as it is carried out in a manner that does not comply with the principles of "lawfulness, correctness and transparency", as well as "minimization" of data, in violation of art. 5, par. 1, lett. a) and c) and art. 13 of the Regulation. 4. Order of injunction. 4.1. For the above, it is deemed necessary to order the Club, pursuant to art. 58, par. 2, lett. d), of the Regulations, the adoption of the necessary measures to ensure information to the interested parties and to limit the recovery to the areas of relevance only, as indicated in point 3.1 of this decision. 4.2. The Guarantor, pursuant to art. 58, par. 2, lett. i) of the Regulations and art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. Law of 24 November 1981 n. 689), in relation to the processing of personal data carried out by the party by means of the video surveillance system, in violation of art. . 5, par. 1, lett. a) and c) and art. 13 of the Regulation. 4.3. With reference to the elements listed in art. 83, par. 2, of the Regulation for the purpose of applying the pecuniary administrative sanction and its quantification, taking into account that the sanction must be "in each individual case effective, proportionate and dissuasive" (Article 83, par. 1 of the Regulation), that, in the present case, the following circumstances were taken into consideration: with regard to the nature, severity and duration of the violation, the negligent conduct of the data controller was taken into consideration as well as the responsibility related to the non-fulfillment of the obligation to disclose the information to the interested parties; the absence of specific precedents against the party relating to violations of the regulations on the protection of personal data; the circumstance that the party did not cooperate with the Authority in the course of the proceedings, by not sending its own defensive writings. 4.4. Due to the aforementioned elements, assessed as a whole, it is believed to determine the amount of the financial penalty in the amount of € 2,000.00 (two thousand) for the violation of art. 5, par. 1, lett. a) and c) and art. 13 of the Regulation. 4.5. In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, this provision should be published on the Guarantor's website. Finally, it is believed that the conditions set out in art. 17 of regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor. WHEREAS, THE GUARANTOR pursuant to art. 57, par. 1, lett. a) and 83 of the Regulations, declares the unlawfulness of the processing carried out by the "Ruian" cultural circle (p. IVA 07004590480), based in via San Biagio al Petriolo, 34 Florence, in the terms set out in the motivation, for the violation of articles 5, par. 1, lett. a) and c) and 13 of the Regulations; INJUNCES to the "Ruian" cultural club, pursuant to art. 58, par. 2, lett. d) of the Regulation: a) to conform the treatments carried out through the video surveillance system by providing: to provide information to interested parties by affixing suitable signs warning them of the presence of a video surveillance system; to limit the recording of the cameras only to the areas of relevance, as indicated in point 3.1 of this decision. b) to pay the sum of € 2,000.00 (two thousand), according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the l. n. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, the offender has the right to settle the dispute by paying - again in the manner indicated in the annex - of an amount equal to half of the sanction imposed within the term referred to in art. 10, paragraph 3, of the d. lgs. n. 150 of 1 September 2011 envisaged for the filing of the appeal as indicated below; ORDER pursuant to art. 58, par. 2, lett. i) of the Regulations to the “Ruian” cultural club, to pay the sum of 2,000.00 (two thousand) euros as a pecuniary administrative sanction for the violations indicated in this provision; HAS pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, the publication of this provision on the website of the Guarantor and believes that the conditions set out in art. 17 of regulation no. 1/2019. It requests the "Ruian" cultural club to communicate which initiatives have been undertaken in order to implement the provisions of this provision and to provide, in any case, adequately documented feedback pursuant to art. 157 of the Code, within 45 days from the date of notification of this provision; any non-response may result in the application of the administrative sanction provided for by art. 83, par. 5, lett. e) of the Regulations. Pursuant to art. 78 of the Regulation, of art. 152 of the Code and 10 of the legislative decree 1 September 2011, n. 150, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad. Rome, January 27, 2022 PRESIDENT Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Mattei
