Garante per la protezione dei dati personali (Italy) - 9794895

Garante per la protezione dei dati personali - 9794895

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(e) GDPR Article 5(1)(a) GDPR Article 5(2) GDPR Article 12 GDPR Article 13 GDPR Article 24 GDPR Article 38(6) GDPR Article 83(1) GDPR Guidelines 3/2019 on processing of personal data through video devices d.lgs 101/18 d.lgs 196/03
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	09.06.2022
Published:	09.06.2022
Fine:	26,000 EUR
Parties:	Municipality of Policoro
National Case Number/Name:	9794895
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	Vilma Margarit

The Italian DPA ruled that outdated information on surveillance cameras' signs breaches the principle of lawful, fair, and transparent processing. It also held that a DPO of an entity cannot act simultaneously as defense counsel for the same entity.

English Summary

Facts

The Municipality of Policoro (Basilicata), implemented the use of CCTV cameras to monitor and fight waste abandonment within its territory. A data subject complained the Municipality had breached their data protection right of fair, transparent and lawful processing under art. 5(1)(a) as the sign signaling the CCTV monitoring referred to an outdated legislative decree. They also alleged a breach of art. 5(1)(e) and art. 13 GDPR, in so far the municipality never defined a data retention period for each processing purpose pursued. The last complaint moved forward by the data subject was that by being legally represented in Court by the same lawyer, who also acted as DPO of Policoro, the Municipality gave rise to a conflict of interest situation and breached art. 38(6) GDPR.

The Municipality argued that the claim had been done in front of the Justice of Peace, who had no competency to decide on issues of privacy. It was also alleged the judgement only pertained an administrative matter, without rising any data protection concerns or a situation of conflict of interest with the Municipality's DPO. The last argument alleged the processing and retention of the CCTV footage was related to illegal dumps within the municipal territory, meaning the filming had been carried out in the course of judicial police investigations and the data retention periods of the GDPR did not apply in this case.

Holding

The Italian DPA held that in this case the Municipality was carrying activities of data processing, by surveilling public entities by means of surveillance cameras.

It also noted, that in par. 41 of the Guidelines 3/2019 on the Processing of Personal Data by Video Devices, waste management is "among the institutional activities entrusted to local authorities". This means the surveillance done by the Municipality of Policoro, a task carried out in the public interest in connection with the exercise of official authority as per art.6(1)(e) GDPR, was unrelated to public security and/or judicial police and obliging the controller to comply with data protection principles.

The DPA found that the information provided in regards to the processing of personal data by means of surveillance cameras, did not meet the requirements of conciseness, transparency, intelligibility and easy readability contained in art. 5(1)(a) GDPR. The Municipality of Policoro had failed to provide suitable first-level information to the data subject, in so far the sign signaling the CCTV surveillance made reference to an outdated legislative decree (d.lgs 196/03) instead of the one currently in force (d.lgs 101/18). Furthermore, the data controller failed to provide the data subject with an adequate notice on second-level processing of their data. The signage did not include information on the most suitable impacts of the processing or an indication of a website, where to consult an extended version of the explanation.

The DPA also found a violation of art. 13 GDPR as well as the principles of storage limitation and accountability in art. 5(1)(e) and art. 5(2). It stated that "the longer the intended storage period (especially if longer than 72 hours), the more reasoned the analysis referring to the legitimacy of the purpose and necessity of storage must be". In this case, the data controller not only failed to set a maximum retention period for the images taken for the purpose of combating illegal littering, but also established the administrative fines for the violation two months after the images were recorded. This did not allow for the data controller to respect the principle of accountability.

Lastly, the DPA addressed the alleged conflict of interest raised by the involvement of the Policoro's DPO in the legal proceedings brought against the data subject. The DPA ruled DPOs "may perform other duties and functions," with the understanding that "the controller must ensure that such duties and functions do not give rise to a conflict of interest." The DPA also made reference to the Article 29 WP's Guidelines on Data Protection Officers, in which it is urged to not designate DPOs already acting as defense counsel for the same court. In the case at hand, it resulted that the DPO shared with the Municipality an interest in obtaining a rejection of the appeal. Consequently, the Italian Garante held this to be in violation of art. 38(6) GDPR, as well the fact that it undermined the DPO's independence.

The Italian DPA held a cumulative breach of art. 5(1)(a) and (e) and (2) (in conjunction with article 24), 12, 13 and 38(6) GDPR. It balanced the fact that the personal data processing affected all other citizens, who passed through the areas under surveillance, against the lack of previous violations committed by the data controller. The DPA issued a fine of €26,000 EUR to the Municipality of Policoro.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web n. 9794895]

Injunction order against the Municipality of Policoro - 9 June 2022 *

Record of measures
n. 214 of 9 June 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC, "General Data Protection Regulation" (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196, "Code regarding the protection of personal data", as amended by Legislative Decree 10 August 2018, n. 101, containing provisions for the adaptation of national law to the Regulation (hereinafter the "Code");

GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution no. 98 of 4 April 2019, published in the Official Gazette n. 106 of 8 May 2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter "Regulation of the Guarantor no. 1/2019");

GIVEN the documentation in the deeds;

HAVING REGARD to the observations of the Office made by the Secretary General pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and operation of the office of the Guarantor for the protection of personal data, in www.gpdp.it, doc. web n. 1098801;

SPEAKER Attorney Guido Scorza;

1. Introduction.

With a complaint of the XX, submitted pursuant to art. 77 of the Regulation, it was complained that the Municipality of Policoro (hereinafter, the "Municipality") would have used a video surveillance system in violation of the regulations on the protection of personal data.

In particular, the complainant stated that he had received three inspection reports, with which administrative sanctions were imposed for having "abandoned solid urban waste" on XX, XX and XX dates. The ascertainment of the violations, by viewing the video surveillance images, would have, however, occurred respectively on the date XX (i.e. 82 days after the date of recording of the images), XX (i.e. 79 days after the date of recording of the images) and XX (i.e. 64 days after the date the images were recorded).

The complainant also complained about the unsuitable installation of the signs containing the simplified information on video surveillance, as well as the non-compliance of the information contained in the minutes notified to him by the Municipality, as "lacking the content required by Articles 13 and 14 of the Regulation [and characterized by generality with regard to] the specific purpose of the assessment carried out ".

Finally, the complainant stated that he had "proceeded to lodge three distinct judgments before the Pisticci Justice of the Peace Office [...], with which, opposing the sanctions imposed [by the Municipality], he contested the unlawful acquisition and use of personal data and requested that the Administration be ordered to pay damages ". As part of these judgments, the Municipality would be constituted with the patronage of a lawyer who is also the Data Protection Officer ("DPO") of the Municipality. For this reason, a situation of "incompatibility between the [DPO] and the defense office of the Municipality was complained, taking into account that the [DPO] intervened in a proceeding in which illegality in the processing of data was highlighted".

2. The preliminary activity.

In response to a request for information from the Guarantor of the XX (prot. No. XX), the Municipality, with a note of the XX (prot. No. XX), stated, in particular, that:

“The disputed facts constitute […] administrative offenses for express violation of the municipal regulation of urban hygiene; [consequently], the envisaged discipline is that of […] Law no. 689/1981 ";

"With regard to the retention of data on the assumption of a retention period of more than 7 days, it is believed that in the event of filming carried out in the course of investigations by the judicial police, the discipline changes. The processing of data in the activities of p.g., in fact, at a European level does not fall within the scope of the [Regulation], but of Directive 2016/680 [...] [and of] Legislative Decree 51/2018 […] [; therefore,] in the course of investigations by p.g. who make use of the use of camera traps, the images must be kept for the time prescribed by art. 10 of the Presidential Decree n. 15 of 15.01.2018, which distinguishes different periods for different types of crime [...] ";

"For the storage of waste, in point 5.2 of the provision [of the Guarantor on video surveillance of 2010], the Guarantor admits the use of video surveillance systems only in the event of ineffectiveness or impossibility of alternative systems and both with regard to the provisions sanctioned administratively and for those of a criminal nature ";

"With regard to the privacy information by means of a computer sign, unlike what is claimed [in the complaint], the acquisition of the data is legitimate having prescribed a legitimate placement of the information, according to the dictates of the Municipal Council resolution n.XX of the XX ";

"The case envisaged is characterized by the minimum disclosure by means of an information sign and by the disclosure attached to the minutes that allows for the necessary information [...]";

"[...] there is no [...] any form of conflict of interest [, as the] object of the judgment concerned only the opposition to an administrative sanction governed by Law no. 689/1981 and […] no consideration could have had in court problems relating to [the] protection of personal data […] since the sanctioning system in force is subject to the discipline referred to in Law no. 689/1981, with the effect, therefore, that the judgment could not absolutely "touch data protection issues";

"We proceeded to formalize the mandate ad litem [to the lawyer, who] proceeded to defend the Entity on the basis of the only preliminary question posed on the basis of the erroneous appeal before the Justice of the Peace of Pisticci for not having the then appellant settled the matter in the ways and terms set forth in the discipline of the aforementioned Law no. 689/1981 ";

"The acts based on the defense concerned exclusively and solely the preliminary objection of the inadmissibility and inadmissibility of the appeal for the reasons highlighted above, also because, among other things, the Justice of the Peace is incompetent on the matter to instruct and decide on issues relating to problems relating [to] the matter of privacy ";

"The prosecutors [...] limited themselves exclusively to taking a position and deciding only on the ascertained inadmissibility of the proposed appeal because the transgressor, following the notification of the report in question, given the matter of the administrative violation, would have had to follow the rules concerning the system of sanctions provided for by Law no. 689/1981 ".

With a note of the XX (prot. No. XX), the Office, on the basis of the elements acquired, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, par. 2, of the Regulations, inviting the aforementioned owner to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (Article 166, paragraphs 6 and 7, of the Code; as well as Article 18, paragraph 1, of Law no. . 689 of 11/24/1981). With the aforementioned note, the Office found that the Municipality has put in place the processing of personal data through video devices in a manner that does not comply with the principles of "lawfulness, correctness and transparency", "conservation limitation" and "accountability", by providing an information on the processing of personal data of the first level which is not suitable and by failing to provide information on the processing of personal data of the second level, as well as by placing their DPO in a position of conflict of interest, in violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13, and 38, par. 6, of the Regulation.

With a note of the XX (prot.n.XX), the Municipality sent to the Guarantor its defense writings in relation to the notified violations, declaring, in particular, that:

"The Report [...] of the XX of the Local Police Command, [...] highlights [...] that the Local Police, in addition to performing administrative police functions, also performs judicial police functions";

“By order of the Local Police Command […] n. 2 local police officers performing judicial police functions pursuant to art. 57 c.p.p. Not only that, but with the minutes of the appointment of the twentieth to prot. N. XX, the Officers of p.g. of the local Police Headquarters appointed as auxiliary to p.g. Mr. […] for the supply and installation, assistance and maintenance of n. 4 fixed / mobile cameras for video surveillance aimed at controlling illegal landfills in the municipal area, with the express task of acquiring the images and developing the material useful for the further investigations of p.g. by the proceeding Local Police ";

"Therefore, the full legitimacy of the data processing in relation to the retention period beyond seven days from the detection of the data is clearly evident, given that in the course of investigations by p.g., the discipline does not fall within the scope of the GDPR, but in directive 2016/680, then implemented with Legislative Decree 51/2018, which concerns the processing of data carried out by public authorities for the purposes of prevention, investigation, detection and prosecution of crimes or execution of criminal sanctions ";

"In the course of investigations by p.g. who make use of the use of camera traps, - the information can be omitted (Point 3.1.1 of the Provision of the Guarantor of 8 April 2010) ";

"The person in charge (ie, the person who physically carries out the data processing operations) must necessarily hold the qualification referred to in art. 57 c.p.p .. ";

"The images must be kept for the time prescribed by art. 10 of the Presidential Decree n. 15 of 15.01.2018, which distinguishes different periods for different types of crime (moreover, even in the case of ascertained administrative offenses, the images must be kept after the 7-day term referred to above, as they enter another proceeding). Among other things, it should be noted that the applicable discipline is that of administrative sanctions pursuant to Law no. 689/1981, which in accordance with art. 14 regulates the term of ninety days to propose the appeal which runs from the date of detection / ascertainment of the data, as extrapolated and stored until the definition of the procedure to allow the right of defense in the cross-examination between the parties ";

"In consideration of the storage times dictated by art. 10 of the Presidential Decree n. 15 of 15.01.2018 [...], as well as the 90 days to propose the appeal provided for by art. 14 of Law no. 689/1981 […] it is possible to state that the retention times of both cases are greater than 82 days contested [by the Guarantor] ";

"With City Council Resolution no. XX of the XX, the Entity provided for the obligation to provide specific information [, it being understood that] in the course of investigations by p.g. who make use of the use of camera traps, the information can be omitted [...] ";

the complainant ", as already claimed in the XXth notes, referred to the Office of the Justice of the Peace to challenge the report against the administrative sanction, calling it" Appeal against administrative sanction "without any mention of the matter of privacy";

"The mention" for violation of the privacy rules "(Sentences n.XX and n.XX) constitutes the reconstruction of the requests [of the appellant] reported in the part dedicated to the fact, since then, and what is more relevant, in the dedicated part to the law, which belongs to the magistrate, there is no mention of the matter of privacy, given that the judgment could not absolutely “touch data protection issues”;

"The mere fact that in the judgments in question [the complainant] had raised objections regarding compliance with the legislation on the protection of personal data does not in any way lead to a situation of conflict of interest [of the DPO]";

"The Entity has taken steps to examine the entire context and the elements available and in the light of the incorrect approach of the then appellant, has proceeded to appoint the lawyer […] For the purposes of legal representation so that reasons relating to the inadmissibility may arise […] ”;

"[...] the inadmissibility of the appeal, we read in the three Sentences, concerns the incorrect application [...] of the legislation relating [to] the administrative sanctions referred to in Law no. concerning the matter of the protection of personal data […] The inadmissibility of the appeals already presented at first reading was all too evident […] ”;

"Attorney [...] obtained a favorable ruling of inadmissibility but this does not mean that the same, as DPO, would not have hesitated to bring the issues relating [to] any violations in privacy matters to the attention of the data controller if they were manifested ".
The hearing required pursuant to art. 166, paragraph 6, of the Code, during which the Municipality declared, in particular, the following:

"The Administration has acted in the service of the territory and the defense of the environment, to counteract the phenomenon of illegal waste abandonment, using the so-called camera traps as a deterrent. The Administration therefore acted in absolute good faith for the pursuit of the public interest, as well as to protect the reputation of the Body itself, whose image is harmed by the phenomenon of illegal waste abandonment ";

"The choice to give a mandate to the DPO to represent the Municipality in court was also dictated by the need to optimize the Administration's resources, believing in good faith [...] that this choice could not give rise to a conflict of interest. This is because, otherwise, the Municipality would have had to appoint a third party, with a further increase in costs ";

"The body's defense was set up by the Administration itself (ie by the Local Police Command and by the officials and managers in charge). The lawyer in charge, as an external, limited himself to representing this position in court [...] ";

"In any case, the Guidelines of the European Committee on the figure of the DPO hypothesize a conflict of interest when, in the context of the defense in court, profiles regarding the protection of personal data are" touched ", a circumstance that does not exist in the present case . Furthermore, there are no judicial decisions that have dealt with this specific type of conflict of interest ";

"With regard to the fulfillment of disclosure obligations, it should be noted that the Guidelines of the European Committee were published shortly before the facts of the complaint. In any case, it is reiterated that the local police acted by exercising their judicial police functions (despite not having received a specific assignment from the judicial authority) and, therefore, the information on the processing of personal data could also be of the all omitted ".

3. Outcome of the preliminary investigation.

3.1 The correctness and transparency of the processing: the information.

The processing of personal data by means of video surveillance systems by public entities is generally allowed if it is necessary to fulfill a legal obligation to which the data controller is subject or for the performance of a task of public interest or connected to the exercise. of public powers vested in the same (art. 6, par. 1, lett. c) and e), and 3, of the Regulation, as well as 2-ter of the Code; cf. par. 41 of the "3/2019 Guidelines on the processing of personal data through video devices", adopted by the European Data Protection Committee on XX). In this context, it is noted that waste management is one of the institutional activities entrusted to local authorities.

The data controller is, in any case, required to comply with the principles of data protection pursuant to art. 5 of the Regulation, including that of "lawfulness, correctness and transparency" (Article 5, paragraph 1, letter a), of the Regulation), according to which the data controller must take appropriate measures to provide interested all the information referred to in Articles. 13 and 14 of the Regulations in a concise, transparent, intelligible and easily accessible form, with simple and clear language (see Article 12 of the Regulations).

When video surveillance systems are used, the data controller, in addition to making the first level information, by affixing warning signs near the area subject to video surveillance, must also provide the interested parties with "second level information", which must "contain all the mandatory elements pursuant to Article 13 of the [Regulation]" and "be easily accessible for the interested party" ("Guidelines 3/2019 on the processing of personal data through video devices", cit., in particular par. 7; but see already the "Provision on video surveillance" of the Guarantor of 8 April 2010, web doc. n. 1712680, in particular par. 3.1; see also the FAQ n. 4 of the Guarantor on video surveillance, web doc. 9496574).

The first level information (warning sign) "should communicate the most important data, for example the purposes of the processing, the identity of the data controller and the existence of the rights of the data subject, together with information on the most significant impacts of the processing "(" Guidelines 3/2019 on the processing of personal data through video devices ", cit., par. 114). In addition, the signs must also contain information that may be unexpected for the person concerned. This could be, for example, the transmission of data to third parties, in particular if located outside the EU, and the retention period. If this information is not indicated, the interested party should be able to trust that there is only real-time surveillance (without any data recording or transmission to third parties) (ibidem, cit., Par. 115). The first level warning signs must also contain a clear reference to the second level of information, for example by indicating a website on which the text of the extended information can be consulted.

During the investigation, the Municipality stated that in the vicinity of the areas in which the so-called camera traps the information sign provided for by the Municipal Council Resolution n. XX of the XX. This information sign takes up the model indicated by the Guarantor within the previous regulatory framework for the protection of personal data (see Annex 1 to the "Provision on video surveillance" of 8 April 2010, cit.).

In this regard, it should be noted that the reference, made in the cartel used by the Municipality (as well as in the information reported at the bottom of the report no. XX notified to the complainant), is incorrect - as it is no longer current - to art. . 13 of the Code, which was repealed by Legislative Decree 10 August 2018, n. 101.

Furthermore, this sign, which is, moreover, devoid of references to the rights of the interested parties, does not indicate the ways in which the interested parties (i.e. not only the subjects to whom an administrative violation is contested, but all the natural persons who enter the action of camera traps) can receive complete information on second level processing (see par. 117-119 of the "Guidelines 3/2019 on the processing of personal data through video devices), cit.).

Nor does it emerge from the documents that the Municipality has drawn up this second level information and brought it to the attention of the interested parties, for example by publishing it on the institutional website of the Municipality.

As for the defense proposed by the Municipality, on the basis of which the information on the processing of personal data is not in any case due, given that the treatments in question were carried out in the context of judicial police activities (with consequent application of Legislative Decree no. lgs. 18 May 2018, n. 51), it is noted that the Municipality has accused the complainant of certain administrative violations for "unlawful delivery of waste". It follows that the Municipality processes personal data, through video devices, "for the performance of a task of public interest or connected to the exercise of public authority vested in the data controller" (Article 6, paragraph 1, letter e) of the Regulation), or to ascertain conduct that is sanctioned primarily by administrative means (see articles 192, "abandonment ban", and 255, "abandonment of waste", of Legislative Decree 3 April 2006, 152; article 13 of the law of 24 November 1981, no. 689).

These treatments are, therefore, completely unrelated to the activity of public security and judicial police, which the local police can carry out, in any case, only in a limited form and under certain conditions (see articles 3 and 5 of the law 7 March 1986, no. 65). Therefore, they fully fall within the scope of application of the Regulations and the Code, also with regard to the obligation for the data controller to provide data subjects with information on the processing of personal data.

On the other hand, as stated by the Municipality at the hearing, the same had not received any assignment from the judicial authority, preventing this circumstance in itself from tracing the processing of personal data in question to the scope of police activities. judicial.

In light of the foregoing considerations, the Municipality has processed personal data through video devices, providing data subjects with an unsuitable information on the processing of first-level personal data and failing to provide information on the processing of second-level personal data, in a manner that does not comply with the principle of "lawfulness, correctness and transparency" and in violation of Articles 5, par. 1, lett. a), 12 and 13 of the Regulations.

3.2 The principles of "conservation limitation" and "accountability".

Pursuant to art. 5, par. 1, lett. e), of the Regulation, personal data must be "stored in a form that allows identification of the data subjects for a period of time not exceeding the achievement of the purposes for which they are processed" ("conservation limitation") ".

On the basis of the principle of accountability (articles 5, paragraph 2, and 24 of the Regulation), it is up to the data controller to identify the retention times of the images, taking into account the context and purposes of the processing, as well as the risk for rights. and the freedoms of individuals; this unless specific legal provisions expressly provide for specific data retention times.

Even with regard to the processing of personal data carried out by means of video surveillance systems, the recorded images cannot be kept longer than necessary for the purposes for which they were acquired. In particular, “personal data should be - in most cases (for example if video surveillance is used to detect vandalism) - deleted after a few days, preferably through automatic mechanisms. The longer the envisaged retention period (especially if it exceeds 72 hours), the more reasoned must be the analysis referring to the legitimacy of the purpose and the need for conservation "(FAQ n. 5 of the Guarantor on video surveillance, cit ., which incorporates the indications provided in the "Guidelines 3/2019 on the processing of personal data through video devices", cit., par. 121).

During the investigation, it emerged that the Municipality has not set the maximum retention times for the images taken by the so-called camera traps for the purpose of combating the phenomenon of illegal waste abandonment and, consequently, with regard to the case subject to the complaint, it proceeded to ascertain administrative violations in more than two months from the date of registration of the images.

Also in relation to this profile, the Municipality argued that the processing of personal data carried out by it would be attributable to judicial police activities, with consequent application of Legislative Decree 18 May 2018, n. 51. These theses cannot, however, be accepted, as the above considerations regarding the full application of the provisions of the Regulation and the Code to the processing of personal data carried out by the Municipality for the purpose of ascertaining administrative violations are valid. in environmental matters.

Consequently, in view of the principle of accountability and in compliance with the conservation limitation principle, the Municipality should have defined the maximum retention terms for video surveillance images for each processing purpose pursued, adequately motivating the choices made in this regard.

Therefore, the Municipality has processed personal data through video devices in a manner that does not comply with the principles of "conservation limitation" and "accountability", in violation of Articles 5, par. 1, lett. e), and par. 2 (in conjunction with art. 24) of the Regulation.

3.3 The conflict of interest of the Data Protection Officer.

With regard to the figure of the DPO, the legislation on data protection provides that the designation of the same is always due by public entities (Article 37, paragraph 1, letter a), of the Regulation).

As regards the position of the DPO, art. 38, par. 6, of the Regulation provides that the same "[may] perform other tasks and functions", it being understood that "the data controller [must ensure] that such tasks and functions do not give rise to a conflict of interest".

With regard to this profile, the "Guidelines on data protection officers", adopted by the European Data Protection Committee on 13 December 2016, as amended and adopted on 5 April 2017, highlight that "a conflict of interests if, for example, an external DPO is asked to represent the owner or manager in a judgment that touches on data protection issues "(par. 3.5).

In the present case, the complainant stated that he had "lodged three distinct judgments before the Office of the Justice of the Peace (R.G. XX; XX and XX), with which, opposing the sanctions imposed, he contested the unlawful acquisition and use of personal data and requested that the Administration be sentenced to pay damages […] ”.

From sentence no. XX of the XX of the Office of the Justice of the Peace of Pisticci, on record, it emerges that "with an appeal filed on XX [the complainant] lodged an opposition against the report no. XX drawn up on XX by the Local Police of the Municipality of Policoro and notified on XX [...] ", asking" [the judicial authority] the annulment of the contested report with the victory of expenses; the condemnation of the defendant to the reimbursement of the damages suffered in the amount of € […], or of that smaller or greater sum deemed to be of justice, for violation of the rules on privacy ".

Similarly, from sentence no. XX, in the records, it appears that "the appellant disputes the report [as it] is lacking in essential data, [and as there is] violation of the rules on privacy, illegitimate adoption of video surveillance".

In the judgments in question, originating from appeals in which exceptions were raised also regarding compliance with the legislation on the protection of personal data, the Municipality was, therefore, represented and defended by a lawyer who held the role of DPO of the Entity .

This, as clarified by the European Committee for the protection of personal data in the "Guidelines on data protection officers", cited above, has given rise to a situation of conflict of interest.

The circumstance that, as declared by the Municipality, the judicial authority has declared the appeals inadmissible, due to lack of jurisdiction, is not, in this regard, conclusive, given that the Municipality was, in any case, represented by its DPO in judgments. within which the complainant had raised exceptions regarding compliance with the legislation on the protection of personal data. In this regard, it must be considered that, when the Municipality entrusted its defense to the DPO, it could not predict the outcome of the trial, being, therefore, abstractly possible for the judge to declare his competence and to pronounce in the merit, even incidentally, on matters relating to the protection of personal data.

Furthermore, given that the DPO, as the Entity's lawyer, shared with the latter the interest in obtaining the rejection of the appeals, he was to be considered, from the date of the assignment of the assignment to defend the Entity, in a position of conflict of interest. In fact, in the performance of their duties, and in particular the task of "supervising [...] the [...] Regulation, other provisions or of the Union or of the Member States relating to data protection as well as the policies of the data controller processing [...] regarding the protection of personal data "(Article 39, paragraph 1, letter b) of the Regulation), with specific reference to the processing of personal data carried out through the video devices in question, the DPO had detected violations of the legislation on data protection, he could not have brought them to the attention of the data controller without, at the same time, prejudicing the procedural position of the Entity and its own interest, as legal, to obtain a favorable ruling by the court appointed by the complainant. Conversely, any assessments made by the same subject, as legal, in order to support the lawfulness of the processing in court, could have compromised the autonomy of judgment and the position of independence that the same, as a DPO, is required to ensure.

Precisely in light of these considerations, the Guarantor, in the "Guidance document on the designation, position and duties of the Data Protection Officer (DPO) in the public sphere", attached to the provision. 29 April 2021, n. 186, doc. web n. 9589104, has expressly drawn the attention of public subjects "to the fact that it is difficult to predict a priori that a legal dispute cannot also involve personal data protection profiles", inviting them "to designate a DPO who, at the same time, does not carry out for them the role of defender in court "(par. 10.3).

It should also be noted that the complainant, from his perspective, as a consequence of the mandate received from the DPO, was no longer able to contact him (see Article 13, paragraph 1, letter b) of the Regulation), trusting in his impartiality in the performance of their duties, as the provision pursuant to art. 38, par. 4, of the Regulation, according to which interested parties can contact the DPO for all questions relating to the processing of their personal data and for the exercise of their rights such as, for example, those of access, cancellation or limitation (respectively, articles 15 , 17 and 18 of the Regulation). Also in relation to this profile, the Guarantor pointed out that "in the eyes of the interested party who wants to contact the DPO, the fact that he is also the legal defender of the entity at the same time undermines his independence. Therefore, regardless of the circumstances that may actually occur - such as, for example, that the judgment involved matters of personal data protection - [we were invited] all public administrations to designate a DPO who, at the same time, does not carry out for them the role of defender in court "(" Guidance document on the designation, position and duties of the Data Protection Officer (DPO) in the public sphere ", cit., par. 10.3).

By reason of the above, the Municipality, entrusting the DPO designated by it with its defense in the judgments in question, has placed the same in a position of conflict of interest, in violation of art. 38, par. 6, of the Regulation.

4. Conclusions.

In light of the aforementioned assessments, it is noted that the statements made by the data controller in the defense writings ˗ whose truthfulness may be called upon to answer pursuant to art. 168 of the Code ˗ although worthy of consideration, they do not allow to overcome the findings notified by the Office with the act of initiation of the procedure and are insufficient to allow the filing of this procedure, however, none of the cases provided for by the art. 11 of the Guarantor Regulation n. 1/2019.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by the Municipality is noted, for having carried out processing of personal data through video devices in a manner that does not comply with the principles of "lawfulness, correctness and transparency "," conservation limitation "and" accountability ", providing information on the processing of first-level personal data that is not suitable and failing to provide information on the processing of second-level personal data, as well as putting one's DPO in a position of conflict of interest, in violation of art. 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulation.

The violation of the aforementioned provisions makes the administrative sanction provided for by art. 83, par. 5, of the Regulation, pursuant to art. 58, par. 2, lett. i), and 83, par. 3, of the same Regulation.

5. Corrective measures (art. 58, par. 2, letter d), of the Regulation).

The unlawful conduct conducted by the Municipality has not completely exhausted its effects, as, at present, the same has not demonstrated that it has provided the interested parties with appropriate information on the processing of first-level personal data and information on the processing of second-level personal data, as well as having set the maximum retention times for images shot using video devices.

It is therefore considered necessary, pursuant to art. 58, par. 2, lett. d), of the Regulations, to order the Municipality, within thirty days of notification of this provision, to:

identify the maximum retention times of the images on the basis of the purposes pursued with the aforementioned video surveillance system (Article 5, paragraph 1, letter e), and par. 2, in conjunction with art. 24, of the Regulation);

provide interested parties with appropriate information on the processing of first-level personal data and information on the processing of second-level personal data (Articles 5, paragraph 1, letter a), 12 and 13 of the Regulation).

Pursuant to art. 157 of the Code, the Municipality will have to communicate to this Authority what initiatives have been undertaken in order to implement the provisions of this provision, and in any case to provide adequately documented feedback, within thirty days of notification of this provision.

6. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (articles 58, par. 2, lett. I and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The Guarantor, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations as well as art. 166 of the Code, has the power to "inflict an administrative pecuniary sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or instead of such measures, depending on the circumstances of each single case "and, in this context," the College [of the Guarantor] adopts the injunction order, with which it also disposes with regard to the application of the ancillary administrative sanction of its publication, in whole or in excerpt, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code "(Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).

In this regard, taking into account art. 83, par. 3, of the Regulation, in the present case - also considering the reference contained in art. 166, paragraph 2, of the Code - the violation of the aforementioned provisions is subject to the application of the same administrative fine provided for by art. 83, par. 5, of the Regulation.

The aforementioned administrative fine imposed, depending on the circumstances of each individual case, must be determined in the amount taking into account the elements provided for by art. 83, par. 2, of the Regulation.

In relation to the aforementioned elements, it was considered that since 2004 the Guarantor has provided information to the data controllers with regard to the need to duly inform the interested parties about the processing of personal data through video devices and the need to define the maximum retention times. of the recorded images (see the General Provision on video surveillance of 29 April 2004, web doc. n. 1003482, paragraphs 3.1 and 3.4). It was also considered that the processing of personal data in question affected not only the complainant, but all other citizens who have passed through the areas subjected to video surveillance. As for the violation profiles that concerned the DPO, it was taken into account that, as declared by the Municipality, the defense in court of the Municipality was conferred on the DPO in order not to incur an "increase in costs", which would have resulted from assignment of the mandate to a third party (see Article 83, paragraph 2, letter k), of the Regulation).

On the other hand, it should be noted that there are no previous violations committed by the data controller or previous measures pursuant to art. 58 of the Regulation.

Due to the aforementioned elements, assessed as a whole, and considering that the Municipality falls within the demographic dimension of less than 20,000 inhabitants, it is considered to determine the amount of the pecuniary sanction, in the amount of 26,000 (twenty-six thousand) euros for the violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulations, as a pecuniary administrative sanction, pursuant to art. 83, par. 1, of the Regulation, effective, proportionate and dissuasive.

Taking into account that the Municipality has completely failed to provide the interested parties with an extended, second-level information on the processing of personal data through video devices, it is also considered that the ancillary sanction of publication on the website of the Guarantor of the this provision, provided for by art. 166, paragraph 7 of the Code and art. 16 of the Guarantor Regulation n. 1/2019.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

WHEREAS, THE GUARANTOR

notes, pursuant to art. 57, par. 1, lett. f), the unlawfulness of the processing carried out by the Municipality of Policoro, for the violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulations, within the terms set out in the motivation

ORDER

pursuant to art. 58, par. 2, lett. i), and 83 of the Regulations, as well as art. 166, paragraph 2, of the Code, to the Municipality of Policoro, in the person of the pro-tempore legal representative, with registered office in Piazza Aldo Moro, 1 - 75025 Policoro (MT), C.F. 00111210779, to pay the sum of € 26,000 (twenty-six thousand) as a pecuniary administrative sanction for the violations indicated in the motivation. It is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;

INJUNCES

to the Municipality of Policoro:

1. in case of non-settlement of the dispute, pursuant to art. 166, paragraph 8, of the Code, to pay the sum of € 26,000 (twenty-six thousand) according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the l. n. 689/1981;

2. pursuant to art. 58, par. 2, lett. d) of the Regulations, to conform the processing to the provisions of the Regulations, adopting the corrective measures indicated in paragraph 5 of this provision, no later than 30 days from the date of receipt of the same;

3. pursuant to art. 58, par. 1, lett. a), of the Regulation and 157 of the Code, to communicate to this Authority, providing an adequately documented feedback, within thirty days from the notification of this provision, the initiatives undertaken to ensure compliance of the treatment with the Regulation;

HAS

the publication of this provision on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code (see Article 16 of the Guarantor Regulation No. 1/2019);

the annotation of this provision in the internal register of the Authority, provided for by art. 57, par. 1, lett. u), of the Regulations, violations and measures adopted in compliance with art. 58, par. 2, of the Regulation (see art.17 of the Guarantor Regulation no. 1/2019).

Pursuant to art. 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.

Rome, 9 June 2022

PRESIDENT
Stanzione

THE RAPPORTEUR
Peel

THE SECRETARY GENERAL
Mattei

* The provision was challenged

[doc. web n. 9794895]

Injunction order against the Municipality of Policoro - 9 June 2022 *

Record of measures
n. 214 of 9 June 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC, "General Data Protection Regulation" (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196, "Code regarding the protection of personal data", as amended by Legislative Decree 10 August 2018, n. 101, containing provisions for the adaptation of national law to the Regulation (hereinafter the "Code");

GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution no. 98 of 4 April 2019, published in the Official Gazette n. 106 of 8 May 2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter "Regulation of the Guarantor no. 1/2019");

GIVEN the documentation in the deeds;

HAVING REGARD to the observations of the Office made by the Secretary General pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and operation of the office of the Guarantor for the protection of personal data, in www.gpdp.it, doc. web n. 1098801;

SPEAKER Attorney Guido Scorza;

1. Introduction.

With a complaint of the XX, submitted pursuant to art. 77 of the Regulation, it was complained that the Municipality of Policoro (hereinafter, the "Municipality") would have used a video surveillance system in violation of the regulations on the protection of personal data.

In particular, the complainant stated that he had received three inspection reports, with which administrative sanctions were imposed for having "abandoned solid urban waste" on XX, XX and XX dates. The ascertainment of the violations, by viewing the video surveillance images, would have, however, occurred respectively on the date XX (i.e. 82 days after the date of recording of the images), XX (i.e. 79 days after the date of recording of the images) and XX (i.e. 64 days after the date the images were recorded).

The complainant also complained about the unsuitable installation of the signs containing the simplified information on video surveillance, as well as the non-compliance of the information contained in the minutes notified to him by the Municipality, as "lacking the content required by Articles 13 and 14 of the Regulation [and characterized by generality with regard to] the specific purpose of the assessment carried out ".

Finally, the complainant stated that he had "proceeded to lodge three distinct judgments before the Pisticci Justice of the Peace Office [...], with which, opposing the sanctions imposed [by the Municipality], he contested the unlawful acquisition and use of personal data and requested that the Administration be ordered to pay damages ". As part of these judgments, the Municipality would be constituted with the patronage of a lawyer who is also the Data Protection Officer ("DPO") of the Municipality. For this reason, a situation of "incompatibility between the [DPO] and the defense office of the Municipality was complained, taking into account that the [DPO] intervened in a proceeding in which illegality in the processing of data was highlighted".

2. The preliminary investigation.