Garante per la protezione dei dati personali (Italy) - 9872646

Garante per la protezione dei dati personali - 9872646

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 13 GDPR Art 4 L. 300/1970 Article 114 Personal Data Protection Code
Type:	Other
Outcome:	n/a
Started:
Decided:
Published:	09.03.2023
Fine:	3,000 EUR
Parties:	Guardia di Finanza di Seregno sig. Stefano Molena
National Case Number/Name:	9872646
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	n/a

The Italian DPA imposed a €3,000 fine on an Italian store manager for the violation of Articles 5(1)(a) and 13 GDPR because he set up a video surveillance camera in his store without the required information signs.

English Summary

Facts

A working video surveillance camera was put up in a shop owned by Stefano Molena (controller). The camera was able to capture footage of the store's clients and employees (data subjects).

On February 2 2022, the Guard of Finance of Seregno (Guardia di Finaza di Seregno) performed an inspection at the controller's shop which resulted in a report that was transmitted to the Italian DPA (Garante).

On May 18 2022, the DPA notified the controller of the initiation of sanctioning proceedings. The controller stated that at the time of the inspection, the camera was not functioning and not connected to the contrtoller's computer system. The controller further stated that the camera was never made operational and had currently been removed.

On February 20 2023, the controller provided evidence that it had removed the camera and its monitor.

Holding

First, the Italian DPA held that the processing of personal data carried out by the controller through the use of a video surveillance camera violated Articles 5 (1)(a) and 13 GDPR. The DPA stated that the processing of personal data must always comply with the general principles of Article 5, in particular the principle of transparency, which demands that data subjects must always be informed that they are entering a video surveillance area. Information that must be provided when personal data are collected from a data subject is listed in Article 13 GDPR. In this case, the controller failed to put up the required information signs, which is why he was convicted of the violation of the aforementioned articles.

Second, the Italian DPA held that the controller violated Article 114 of the Personal Data Protection Code (Codice in materia di protezione dei dati personali), an Italian national law. The Article refers to a different Italian national provision (Art 4 L. 300/1970), which provides rules for when and under which conditions video surveillance of employee's activities is allowed. In particular, it states that authorization from the Italian labor inspectorate is needed, which the controller did not obtain. The provision is applicable thanks to Article 88 GDPR, which holds that it is permissible for national laws to provide a greater standard of protection than already given by the GDPR with regard to the processing of workers' personal data.

Due to these violations, the DPA imposed a €3,000 administrative fine on the controller. The DPA took into consideration the severity of the violations, the lack of any previous convictions for data protection violations against the controller and the fact that the controller had sent evidence of the removal of the surveillance camera.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web no. 9872646]

Injunction order - 9 March 2023

Register of measures
no. 69 of 9 March 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation");

HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";

HAVING REGARD TO the report of the Seregno Guardia di Finanza, sent with a note dated 2.17.2022 by the Guardia di Finanza - Special Unit for the protection of privacy and technological fraud, which refers to an inspection carried out on 12.2.2022 at the sole proprietorship operating the activity of "retail trade of fruit and vegetables", of which Mr. Stefano Molena is the owner, with which the presence of a functioning video surveillance camera has been ascertained, missing the appropriate information sign and carried out in violation of the guarantees provided for in art. 4 of Law 300/1970 referred to in art. 114 of the Code;

HAVING EXAMINED the documentation in the deeds;

HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER Prof. Geneva Cerrina Feroni;

WHEREAS

1. The report received and the start of the procedure.

With a note received on 2.17.2022, the Guardia di Finanza - Special unit for the protection of privacy and technological fraud - sent this Authority the report of the control, carried out on 2.2.22, by the Guardia di Finanza of Seregno (MB) at the sole proprietorship engaged in the activity of "retail trade of fruit and vegetables" located in Desio, XX, of which Mr. Stefano Molena is the owner and with whom the presence of a functioning video camera was ascertained, located inside the aforementioned commercial establishment, in the absence of the prescribed information signs.

Furthermore, the report reported that, although the video camera was suitable for filming internal spaces where employees of the company work, it did not appear that the required authorization from the territorially competent Labor Inspectorate had been requested before its installation.

With a note dated 18.5.22 (prot. n. 27167), the Office notified the party of the initiation of the sanctioning procedure pursuant to art. 166, paragraph 5, of the Code for violations of art. 5, par. 1, lit. a) and 13 of the Regulation and of the art. 114 of the Code.

With a note dated 6/26/2022, the company sent written defenses declaring that at the time of the inspection "the video camera was not functional or even connected to the computer system of the business" and that it "was never made operational" as installed for deterrence purposes only and has currently been phased out.

With a note dated 10.2.2023, photographic documentation was received proving that the company had removed the camera and related monitor.

2. The legal framework of the treatment carried out

The use of video surveillance systems can determine, in relation to the positioning of the cameras and the quality of the images captured, the processing of personal data. This treatment must be carried out in compliance with the general principles contained in the art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-monitored area".

For this purpose, therefore, the data controller must affix suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - 8 April 2010 [1712680] (in this sense also the FAQs on video surveillance, published on the Authority's website).

Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "As regards video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while the further mandatory details can be provided by other means (second level). In the guidelines it is also foreseen that “Such information may be provided in combination with an icon to give, in a conspicuous, intelligible and clearly legible way, an overview of the intended treatment (article 12, paragraph 7, of the RGPD) . The format of the information will have to adapt to the various locations”. The information should be positioned in a way that allows the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) “to allow the data subject to estimate which area is covered by a camera in way to avoid surveillance or adjust their behavior, if necessary”.

The processing of personal data carried out in the context of the employment relationship, if necessary for the purpose of managing the relationship itself (see articles 6, paragraph 1, letter c); 9, par. 2, lit. b) of the Regulation), must take place in compliance with the general principles indicated by art. 5 of the Regulation, and in particular of the principle of lawfulness, on the basis of which the processing is lawful if it complies with the applicable sector regulations (Article 5, paragraph 1, letter a) of the Regulation). Consistent with this approach, the art. 88 of the Regulation is without prejudice to the national rules of greater protection ("more specific rules") aimed at ensuring the protection of rights and freedoms with regard to the processing of workers' personal data. The national legislator has approved, as a more specific provision, art. 114 of the Code which among the conditions of lawfulness of the treatment established the observance of the provisions of art. 4, law 20 May 1970, n. 300. The violation of the art. 88 of the Regulation is subject, if the requisites are met, to the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, letter. d) of the Regulation.

Based on the aforementioned art. 4, the. no. 300 of 1970, video surveillance equipment, if from the same derives "also the possibility of remote control" of employee activity, "may be used exclusively for organizational and production needs, for workplace safety and for the protection of company assets ” and the relative installation must, in any case, be carried out following the stipulation of a collective agreement with the unitary trade union representatives or with the company union representatives or, where it has not been possible to reach such an agreement or in the absence of the representatives, only in preceded by the issue of a specific authorization by the Labor Inspectorate.

The activation and conclusion of this guarantee procedure is therefore an indefectible condition for the installation of video surveillance systems. Violation of this provision is punishable by law (see article 171 of the Code). The processing of personal data carried out by the company through the video surveillance system is therefore illegal, in the terms set out above, in relation to articles 5, par. 1, lit. a), 13 and 114 of the Code.

3. The outcome of the investigation and the sanctioning procedure.

On the basis of the investigation carried out by the Seregno Finance Police, it emerged that the video surveillance camera, installed at the sole proprietorship engaged in the "retail trade of fruit and vegetables" located in Desio, XX, was active and working; in fact, the report refers that the data processing activity carried out therein consists of "real-time shooting and recording", that the images are "in colour, clear, suitable for capturing the entire part open to the public and therefore suitable for filming shop customers and employees” and it should be noted that the company owner can access the recordings (see sheet 2 of the report).

It also appears from the report that the party, called to express his opinions regarding the verification operations and his conclusions, represented that he had nothing to declare and signed the report.

Therefore, despite the party's lawyer having declared, with the aforesaid note dated 06.26.2022, that at the time of the check "the video camera was not functioning or even connected to the computer system of the business", it is noted that, pursuant to the 'art. 2700 of the Italian Civil Code, the report drawn up by a public official provides full proof, up to a complaint of forgery, of the truthfulness of the statements contained therein and of the facts ascertained by the reporters and which occurred in their presence.

The report also reports that the sign bearing the information pursuant to art. 13 of the Regulation and adopted the guarantee measures, provided for by art. 4 of Law no. 300/1970, referred to by art. 114 of the Code, in relation to the presence of employees in the video surveillance room.

It is therefore proven, in the present case, that the party has processed personal data, by means of a video surveillance system, in the absence of the required information. This conduct is in contrast with the provisions of art. 13 of the Regulation, according to which the data controller is required to provide the interested party with all the information relating to the essential characteristics of the treatment.

Furthermore, considering that the installation of the video surveillance system had not previously been authorized by the Labor Inspectorate, the processing was also carried out in violation of art. 114 of the Code regarding the protection of personal data.

4. Conclusions: declaration of illegality of the treatment. Corrective measures pursuant to art. 58, par. 2, Regulation.

The processing of personal data carried out by the sole proprietorship is therefore unlawful, in the terms set out above, in relation to articles 5, par. 1, lit. a) (principle of transparency) and 13 (information) of the Regulation and articles 114 of the Code regarding the protection of personal data.

The violation ascertained in the terms set out in the reasoning cannot be considered "minor", taking into account the nature, gravity and duration of the violation, the degree of responsibility and the manner in which the supervisory authority became aware of the violation ( see recital 148 of the Regulation).

Although the party, in the defense briefs, declared that it had taken steps to eliminate the camera, the same did not send any documentation proving what was declared.

5. Injunction order.

The Guarantor, pursuant to art. 58, par. 2, lit. i) of the Regulation and of the art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. law 24 November 1981 n. 689), in relation to the processing of personal data carried out by the company by means of the video surveillance system, of which it was ascertained the unlawfulness, in the terms set out above, in relation to articles 5, par. 1, lit. a), 13 of the Regulation and in art. 114 of the Code.

With reference to the elements listed by art. 83, par. 2 of the Regulation for the purposes of applying the administrative fine and the related quantification, taking into account that the fine must be "in each individual case effective, proportionate and dissuasive" (art. 83, paragraph 1 of the Regulation), it is represented that, in the present case, the following circumstances were taken into consideration:

with regard to the nature, gravity and duration of the violation, the conduct of the data controller was taken into consideration, as well as the liability connected with the non-fulfillment of the obligation to provide the information to the interested parties and to implement the guarantee procedure envisaged by the art. 114 of the Code;

the absence of specific precedents against the company relating to violations of the regulations on the protection of personal data;

the circumstance that the sole proprietorship, owner of the treatment, has sent written defenses declaring the removal of the system and proving what was declared with suitable documentation.

It is also believed that they assume relevance, in the present case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness with which the Authority must comply in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the economic conditions of the offender, determined with reference to the financial statements for the year 2022.

Based on the aforementioned elements, evaluated as a whole, it is decided to determine the amount of the pecuniary sanction in the amount of 3,000.00 (three thousand) euros for the violation of articles 5, 13 of the Regulation and 114 of the Code.

In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor Regulation n. 1/2019, this provision must be published on the Guarantor's website.

Finally, it should be noted that the conditions pursuant to art. 17 of regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

ALL THAT BEING CONSIDERED, THE GUARANTOR

declares, pursuant to articles 57, par. 1, lit. f) and 83 of the Regulation, the illegality of the treatment carried out by Mr. Stefano Molena through the use of the video surveillance system installed at the premises of the sole proprietorship carrying on the "retail trade of fruit and vegetables" located in Desio, XX, of which he is the owner, in the terms set out in motivation, for the violation of the articles 5, 13 of the Regulation and 114 of the Code;

ORDER

to mr. Stefano Molena, owner of the sole proprietorship engaged in the "retail trade of fruit and vegetables" located in Desio, XX, P.I. XX, to pay the sum of 3,000.00 (three thousand) euros as an administrative fine for the violations indicated in this provision;

ENJOYS

then to the same Mr. Stefano Molena, owner of the sole proprietorship engaged in the "retail trade of fruit and vegetables" located in Desio, XX to pay the sum of 3,000.00 (three thousand) euros, according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the law n. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, without prejudice to the offender's right to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the term referred to in art. 10, paragraph 3, of Legislative Decree lgs. no. 150 of 1 September 2011 envisaged for the filing of the appeal as indicated below.

HAS

pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, the publication of this provision on the Guarantor's website and believes that the conditions set forth in art. 17 of regulation no. 1/2019.

Pursuant to art. 78 of the Regulation, of the articles 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, against this provision it is possible to lodge an appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 9 March 2023

PRESIDENT
Station

THE SPEAKER
Cerrina Feroni

THE SECRETARY GENERAL
Matthew