Garante per la protezione dei dati personali (Italy) - 9931319
From GDPRhub
| Garante per la protezione dei dati personali - 9931319 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 13 GDPR Article 58(2)(i) GDPR Article 83(5) GDPR Article 114 Privacy Code Article 166 Privacy Code |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 14.01.1922 |
| Decided: | |
| Published: | 18.07.2023 |
| Fine: | 1,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 9931319 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Italian DPA (in IT) |
| Initial Contributor: | m_g_a |
The Italian DPA fined a company €1,000 for installing a video surveillance system inside the shop without any information sign and without having previously agreed on its installation with union representatives.
English Summary
Facts
On 14 January 2022, a complaint was presented to the DPA regarding the installation of a video surveillance system both outside and inside a shop owned by the data controller without any appropriate information signs.
Following the complaint, on 10 November 2022, an inspection activity was conducted by the Financial Guard on behalf of the Italian DPA at the commercial activity in question.
It emerged that there was a working video camera in the shop, but there were no information signs nor, although there were employees, had authorisation been requested from the Labour Inspectorate.
On 1 March 2023, the data controller sent a defensive note stating that, although the necessary authorisation had not been requested, the employees were aware of the presence of a video camera in the store. Furthermore, the controller stated to have acted in good faith since it was not aware that the installation of the information notice was mandatory and that, after the inspection, it immediately proceeded to remove the video surveillance system.
Holding
Following the inspection, the DPA found a violation of Article 5(1)(a) GDPR on the principle of transparency, Article 13 GDPR and Article 114 of the Italian Privacy Code.
The video surveillance system was functioning and active, and no information sign was present in accordance with Article 13 GDPR. In addition, pursuant to Article 114 of the Italian Privacy Code, in order to install video surveillance systems in the presence of employees, it is necessary for the installation of the video surveillance system to be agreed on with the Unitary Union Representation or the Trade Union Representatives and, if this was not possible, the system had to be previously authorised by the Labour Inspectorate, which the controller did not request.
The DPA stated that such an infringement could not be considered as ‘minor’: taking into account the nature, gravity and duration of the breach, the degree of responsibility and how the supervisory authority became aware of the breach.
Therefore, the DPA fined the controller €1,000 under Article 58(2)(i) GDPR, Article 83(5) GDPR and Article 166 of the Italian Privacy Code.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Provision of 18 July 2023
Register of measures
n. 317 of 18 July 2023
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members, and the councilor. Fabio Mattei general secretary;
HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the “Regulation”);
HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter “Code”) as amended by Legislative Decree 10 August 2018, n. 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";
HAVING REGARD TO the report of the Financial Police - Special unit for the protection of privacy and technological fraud, transmitted with a note dated 22.11.2022, which reports an inspection carried out on 10 November 2022, at the commercial activity "Camille Albane Paris" (owned by the Prodav s.r.l.), located in Peschiera Borromeo (MI), via della Liberazione 8, with which the presence of a functioning video surveillance camera was ascertained without the appropriate information sign and in the absence of the guarantees provided for in the art. 4 of Law 300/1970 referred to in the art. 114 of the Code;
EXAMINED the documentation in the documents;
GIVEN the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation no. 1/2000;
SPEAKER Prof. Ginevra Cerrina Feroni;
PREMISE
1. The report received and the start of the procedure.
With a complaint dated 14.1.22, the installation was reported to this Authority, at the shop called “Camille Albane Paris” located inside the shopping center called “Galleria Borromea” in Peschiera Borromeo (MI), via della Liberazione 8, ( owned by Prodav s.r.l.) of a video surveillance system that does not comply with the rules on the protection of personal data, as the cameras, positioned both outside and inside the store, were not indicated by appropriate information signs.
Following the inspection activity requested by the Office, the Financial Police - Special unit for the protection of privacy and technological fraud, with a note dated 22.11.2022, sent to the Guarantor the documents relating to the inspection carried out on 10.11.2022 at the aforementioned commercial activity.
The report reported the presence of a video surveillance system consisting of a functioning camera positioned inside the room in the absence of information signs regarding its presence.
It was also established that, although there were employees working in the business, the installation of the video surveillance system had been carried out without the necessary authorization from the competent Labor Inspectorate.
Following the inspection, with a note dated 11.18.2022, the Company sent additional documentation, including photographic documentation, proving the removal of the camera placed above the cash register.
The Office, with a note dated 8.2.2023 (protocol no. 22296), notified the act of initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of articles. 5 par. 1, letter. a) and 13, 88 of the Regulation and 114 of the Code.
With a note dated 1.3.2023, the Company sent defensive writings representing that:
- only one camera was active and functioning;
- the employees were aware of the installation of the camera inside the room;
- to have acted in good faith, in the "mistaken belief" that the obligation to affix information signs was not necessary;
- to have taken steps, immediately after the on-site inspection carried out by the Financial Police, to "decommission the plant" as proven by additional photographic documentation sent on 11.18.22.
2. The legal framework of the processing carried out
The use of video surveillance systems may determine, in relation to the positioning of the cameras and the quality of the images taken, the processing of personal data. This processing must be carried out in compliance with the general principles contained in the art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-surveillance area".
For this purpose, the data controller must place suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - 8 April 2010 [1712680] (in this sense also the FAQs on video surveillance, published on the Authority's website).
Similarly, Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that “With regards to video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while further mandatory details can be provided by other means (second level). The guidelines also provide that “Such information may be provided in combination with an icon to give, in a prominent, intelligible and clearly legible manner, an overview of the intended processing (Article 12, paragraph 7, of the GDPR) . The format of the information will have to adapt to the various locations." The information should be positioned in a way that allows the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) “to enable the data subject to estimate which area is covered by a camera in way to avoid surveillance or adjust one's behavior where necessary."
The processing of personal data carried out within the scope of the employment relationship, if necessary for the purpose of managing the relationship itself (see articles 6, par. 1, letter c); 9, par. 2, letter. b) of the Regulation), must be carried out in compliance with the general principles indicated by the art. 5 of the Regulation, and in particular the principle of lawfulness, according to which processing is lawful if it complies with the applicable sector regulations (art. 5, par. 1, letter a) of the Regulation). Consistent with this approach, the art. 88 of the Regulation was without prejudice to the national standards of greater protection ("more specific standards") aimed at ensuring the protection of rights and freedoms with regard to the processing of workers' personal data. The national legislator approved, as a more specific provision, the art. 114 of the Code which among the conditions of lawfulness of the processing established compliance with the provisions of the art. 4, law 20 May 1970, n. 300. The violation of art. 88 of the Regulation is subject, if the requirements are met, to the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, letter. d) of the Regulation.
Based on the aforementioned art. 4, l. n. 300 of 1970, video surveillance equipment, if from the same derives "also the possibility of remote control" of employee activity, "can be used exclusively for organizational and production needs, for workplace safety and for the protection of company assets ” and the related installation must, in any case, be carried out following the stipulation of a collective agreement with the unitary trade union representation or with the company trade union representatives or, where it has not been possible to reach such an agreement or in the event of the absence of the representations, only in as preceded by the issuing of specific authorization by the Labor Inspectorate.
The activation and conclusion of this guarantee procedure is therefore an indispensable condition for the installation of video surveillance systems. Violation of this provision is criminally sanctioned (see art. 171 of the Code). The processing of personal data carried out by the company through the video surveillance system is therefore illicit, in the terms set out above, in relation to the articles. 5, par. 1, letter. a), 13 and 114 of the Code.
Nor is the circumstance, represented by the company, that the workers "were aware" of the processing of personal data through the video surveillance system capable of eliminating the obligation to comply with the aforementioned regulation.
In fact, on this point, the jurisprudence of legitimacy has repeatedly held that the art. 4, l. n. 300 of 1970 cit., "protects interests of a collective and super-individual nature", therefore even the consent, possibly given by individual workers to the installation of systems, is not equivalent to the necessary activation of the procedure with the employee representatives or, failing that, under the control of the public authority (see, among others, Cass., section III pen., 8 May 2017, n. 22148 and 17.12.2019, n. 50919 cit.). In this regard, furthermore, it is noted that the Guarantor has repeatedly reiterated that in the workplace, consent does not constitute an appropriate legal basis for the processing of employees' personal data (see, among others, provision 13.12.2018, n. 500 , web doc. no. 9068983, point 3.1.; with specific reference to video surveillance see provisions of 4 July 2013, no. 336, web doc. no. 2578071 and 18 July 2013, no. 361, web doc. no. 2605290) .
3. The outcome of the investigation and sanctioning proceedings.
On the basis of the investigation carried out, it emerged that the video surveillance system, installed on the premises of the business called "Camille Albane Paris", owned by Prodav s.r.l., was active and functioning and that no sign indicating the the information referred to in the art. 13 of the Regulation; furthermore, it was installed in the absence of the guarantees provided for by the art. 4 of Law no. 300/1970, referred to in the art. 114 of the Code, in relation to the work activity carried out, in the video-monitored room, by the Company's staff.
In the present case, it is therefore proven that processing of personal data was carried out, by means of a video surveillance system, in the absence of the required information. This conduct is in contrast with the provisions of the art. 13 of the Regulation, according to which the data controller is required to provide the interested party with all information relating to the essential characteristics of the processing; since the installation of the video surveillance system had not previously been authorized by the Labor Inspectorate, the processing was also carried out in violation of the art. 114 of the Code regarding the protection of personal data.
4. Conclusions: declaration of unlawfulness of the processing. Corrective measures pursuant to art. 58, par. 2, Regulations.
The processing of personal data carried out by the individual company is therefore unlawful, in the terms set out above, in relation to the articles. 5, par. 1, letter. a) (principle of transparency) and 13 (information) of the Regulation and art. 114 of the Code regarding the protection of personal data.
The violation ascertained within the terms set out in the justification cannot be considered "minor", taking into account the nature, severity and duration of the violation, the degree of responsibility and the way in which the supervisory authority became aware of the violation ( see cons. 148 of the Regulation).
It should also be taken into account that, following the on-site inspection, the Company decided to decommission the video surveillance system, proving its disinstallation through photographic evidence; this was also confirmed in the defense writings sent by the party to the Guarantor.
5. Order of injunction.
The Guarantor, pursuant to art. 58, par. 2, letter. i) of the Regulation and of the art. 166 of the Code, has the power to inflict a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. law 24 November 1981 n. 689), in relation to the processing of personal data carried out by the company by means of the video surveillance system, of which it was ascertained the illegality, in the terms set out above, in relation to the articles. 5, par. 1, letter. a), 13 of the Regulation and art. 114 of the Code.
With reference to the elements listed in the art. 83, par. 2 of the Regulation for the purposes of applying the pecuniary administrative sanction and its quantification, taking into account that the sanction must be "effective, proportionate and dissuasive in each individual case" (art. 83, par. 1 of the Regulation), it is represented that, in the specific case, the circumstances reported below were taken into consideration:
with regard to the nature, gravity and duration of the violation, the conduct of the data controller was taken into consideration, the circumstance that only one camera was installed and removed during the investigation process, as well as the liability connected to the failure to fulfill the obligation of provide information to interested parties and implement the guarantee procedure provided for by the art. 114 of the Code;
the absence of specific precedents against the company relating to violations of the regulations regarding the protection of personal data;
the circumstance that the company, data controller, has sent defensive writings to the Guarantor proving what was declared with suitable documentation.
It is also believed that they assume relevance, in the specific case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness which the Authority must comply with in determining the amount of the sanction (art. 83, par. 1, of the Regulation), the economic conditions of the offender, determined with reference to the financial statements for the year 2022.
On the basis of the aforementioned elements, evaluated as a whole, it is decided to determine the amount of the pecuniary sanction in the amount of 1,000.00 (one thousand) euros for the violation of the articles. 5, 13 of the Regulation and 114 of the Code.
In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor's regulation no. 1/2019, this provision must be published on the Guarantor's website.
Finally, it is noted that the conditions set out in art. 17 of regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
ALL THE WHEREAS, THE GUARANTOR
declares, pursuant to articles. 57, par. 1, letter. f) and 83 of the Regulation, the unlawfulness of the processing carried out by Prodav s.r.l. through the use of the video surveillance system installed at the headquarters called "Camille Albane Paris" of which it is the owner, in the terms set out in the motivation, for the violation of the articles. 5, 13 of the Regulation and 114 of the Code;
ORDER
to Prodav s.r.l. P.I. 07559730960, with registered office in Milan Via Angeloni 33, to pay the sum of 1,000.00 (one thousand) euros as a pecuniary administrative sanction for the violations indicated in this provision;
ORDERS
therefore to Prodav s.r.l. itself. to pay the sum of €,000.00 (one thousand), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts in accordance with the art. 27 of law no. 689/1981. We represent that pursuant to art. 166, paragraph 8 of the Code, the right remains for the violator to settle the dispute through the payment - always according to the methods indicated in the annex - of an amount equal to half of the sanction imposed within the deadline referred to in the art. 10, paragraph 3, of the legislative decree. lgs. n. 150 of 1 September 2011 provided for the filing of the appeal as indicated below.
HAS
pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor's regulation no. 1/2019, the publication of this provision on the Guarantor's website and believes that the conditions set out in the art. 17 of regulation no. 1/2019.
Pursuant to art. 78 of the Regulation, of the articles. 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, it is possible to appeal against this provision before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.
Rome, 18 July 2023
PRESIDENT
Stantion
THE SPEAKER
Cerrina Feroni
THE GENERAL SECRETARY
Mattei
