Garante per la protezione dei dati personali (Italy) - 9949494
| Garante per la protezione dei dati personali - 9949494 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1) GDPR Article 6(1) GDPR Article 58(2)(b) GDPR Article 2(2)(c) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 16.07.2021 |
| Decided: | 12.10.2023 |
| Published: | 12.10.2023 |
| Fine: | n/a |
| Parties: | Mrs XX - natural person |
| National Case Number/Name: | 9949494 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante per la Protezione dei Dati Personali (in IT) |
| Initial Contributor: | melograno juice |
The Italian DPA issued a warning to a private person for installing a camera on the external wall of her house, which was also covering a nearby playground. The processing operation was in breach of the lawfulness and data minimisation principles.
English Summary
Facts
On 6 July 2021, a station of the Italian Carabinieri reported to the DPA that the private party in this proceeding (the controller), installed a surveillance system on the external wall of her property. Reportedly, the surveillance system in question was recording the public area in front of the controller’s property, including a nearby playground and a public square.
Pursuant to Article 157 of the Italian Privacy Code, the DPA opened a preliminary investigation.
During the investigation carried out on 2 March 2023, the DPA noted that the video surveillance system was made up of two recording devices. The first camera, a 360-degree camera, was active and could record images as well as audio and speak through the microphone. The camera was positioned right above the entrance door, and the controller controlled the camera through a smartphone application. The second camera was connected but not active, and it was looking over the driveway that leads to the entrance of the building.
In relation to the viewing angle of the cameras, the controller declared that the first camera, due to its characteristics, could also frame part of the nearby playground, although it was not in her interest to do so. She further clarified that the video surveillance had been installed due to incidents of damage or explicit threats received and that she wanted to utilise the footage for the purpose of lodging complaints.
On 15 June 2023, the controller took measures to replace the first camera with a fixed camera model pointed only towards the entrance of her property to bring the processing in compliance with the GDPR.
Holding
In the outcome of the investigation, the DPA first considered whether the GDPR applied to the data processing carried out by the controller.
In principle, under Article 2(2)(c) GDPR, the use of video surveillance systems by natural persons in their private property for domestic purposes falls outside of the material scope of the GDPR. However, in order for the exemption to apply, the processing must not exceed the controller's domestic sphere, the images are not shared with third parties and there is no processing of public areas, communal areas or third parties' private property.
The DPA also noted that in situations of actual risk, the controller may, on the basis of a legitimate interest, extend the area covered by cameras to areas outside its exclusive domain, provided that this is adequately justified and supported. In the present situation, however, the DPA believed that the controller had not demonstrated the existence of such an interest.
Thus, the DPA held that up to 15 June 2023, when corrective measures were implemented, the controller had carried out processing of personal data not compliant with the GDPR. In particular, the processing of personal data was not compliant with the principles of lawfulness and data minimization. Therefore, the controller violated Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 6(1) GDPR considering that the first camera was also framing part of the playground in front of the controller's property.
Taking into consideration that the controller replaced the camera in question, the DPA only issued a warning pursuant to Article 58(2)(b) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members and the councilor. Fabio Mattei, general secretary; HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the “Regulation”); HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter “Code”) as amended by Legislative Decree 10 August 2018, n. 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679"; GIVEN the report of 6 July 2021 from the XX Carabinieri Station; EXAMINED the documentation in the documents; GIVEN the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation no. 1/2000; SPEAKER prof. Pasquale Stanzione; PREMISE 1. The preliminary investigation activity. With the note dated 6 July 2021, the XX Carabinieri Station reported to this Authority the installation, on the external wall owned by Mrs. XX, of a camera which, from the investigations carried out and the photographic surveys, was suitable for recording the public area in front where there is a playground and a square. With the request for information dated 4 November 2022, formulated pursuant to art. 157 of Legislative Decree no. 196 of 2003, containing the Code regarding the protection of personal data, the Office started the preliminary investigation, inviting people to report on what was reported and at the same time delegated the Special Unit for the Protection of Privacy and Technological Frauds of the Financial Police to carry out the appropriate checks. During the investigation, carried out on 2 March 2023, the officers noted that the video surveillance system was made up of a first swiveling camera, with the possibility of 360° movement, positioned on the access door of the house, adjustable using the application installed on the smartphone; this device, in addition to taking images, also allows you to "record audio immediately and intervene by speaking through the microphone" and from a second, inactive camera, positioned immediately after an access driveway that connects the entrance with an internal space to the building. In relation to the viewing angle of the cameras, the party declared that "the system that records external images... is made up of two cameras... One, positioned right above the access door of the house, films the portion of the space in front the entrance and the immediately adjacent areas. My property, or rather the perimeter walls, border a small playground in front which I do not intend to take back. The other, I repeat, is connected but not active, directed, potentially capable of taking over the space of the driveway that connects the access gate to my home to the internal space of the building". The party also represented that "the camera which is positioned immediately above the access door, due to its characteristics, could also frame part of the playground. But it's not in my interest to do so. I have no intention of directing my cameras beyond the spaces of my ownership/availability. Without prejudice to all those incidents of damage or explicit threats towards me, which I declared earlier in the purposes pursued, for which I reserve the right to file a complaint through the images". Finally, the party declared that "as proof of this, I provide video/audio (attachment no. 10) saved on my phone and no longer present on the application, where it is clear how these people threaten me. I kept these videos/audios because I intend to confront my lawyer and file a complaint..." 2. The initiation of the proceedings. With the communication dated 17 April 2023, the Office notified the party of the initiation of the proceedings, pursuant to art. 166, paragraph 5, of the Code. This is because, on the basis of the checks carried out and the declarations made, it was in fact ascertained that the video surveillance system, due to its technical characteristics, is suitable for filming areas that are not of direct relevance, being public spaces (parks) , and, therefore, the related processing of personal data was carried out in the absence of a valid assumption of lawfulness - also in relation to "audio" recordings attributable to conversations that took place in a public area - in violation of the articles. 5, par.1, letter. a), c) and 6, par. 1 of the Regulation and in the absence of the information required by art. 13 of the Regulation The party, informed by the Office of the possibility of producing defensive writings or documents in relation to the proceedings against him, sent a note indicating the measures adopted to bring the aforementioned processing into compliance with the Regulation. Specifically, on 15 June 2023, a communication was sent to the Office which showed that "Mrs ... took steps to replace the camera relating to the video surveillance system located in the house at XX, XX, with the model with a fixed camera pointed towards the entrance...". 3. The outcome of the investigation. Upon examination of the declarations made by the party during the proceedings, given that, unless the fact constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies news or circumstances or produces deeds or documents falsifiers is liable pursuant to art. 168 of the Code, it is ascertained that Ms. XX processed personal data that did not comply with the relevant regulations on the protection of personal data contained in the GDPR. The processing of data carried out through a video surveillance system if carried out by natural persons for personal and domestic purposes is to be included in the causes of exclusion of the application of the data protection legislation referred to in art. 2 par. 2 of EU Regulation 2016/679. In this regard, recital no. 18 of the Regulation specifies that an "exclusively personal or domestic activity" is considered to be one carried out without creating a connection with a commercial or professional activity. The use of video surveillance systems by natural persons in areas of direct interest (such as those relating to their home and its appurtenances) is therefore to be considered, in principle, excluded from the material scope of application of the relevant provisions. of data protection, because it falls within the processing carried out for the exercise of activities of an exclusively personal and domestic nature. This is provided that the scope of data communication does not exceed the owner's family sphere and the images are not communicated to third parties or disseminated and the processing does not extend beyond the areas strictly pertaining to the owner by taking images in common areas (including condominium type such as stairs, entrance halls, car parks), places open to the public (streets or squares), or areas belonging to third parties (gardens, terraces, doors or windows belonging to third parties). It therefore follows that it is possible to install video recording systems, without having to fulfill the obligations established by the rules on the protection of personal data, as long as the viewing angle of the cameras is limited only to the areas of their relevance, also possibly through the activation of a function to darken the excess parts. Only in the presence of situations of actual risk, the data controller may, on the basis of a legitimate interest, extend the recording of the video cameras to areas beyond its exclusive relevance, provided that this is adequately motivated and supported by suitable documentation (e.g. complaints, threats, thefts). In such cases, the data controller is however required to comply with the provisions on personal data protection, found in Guidelines no. 3/2019, on the processing of personal data through video devices, adopted by the European Data Protection Committee and in the General Provision on video surveillance of 8 April 2010 (available on the Authority's website www.gpdp.it, doc. web 1712680). In the case in question, the investigation found that the recovery of the areas beyond those of relevance, took place in the absence of suitable conditions of lawfulness, considering that the data controller has not demonstrated the existence of a legitimate interest relating to a situation of actual risk that would have justified such treatment. The above also applies to the capture of conversations taking place in public spaces through audio devices. 4. Conclusions: declaration of unlawfulness of the processing. Corrective measures pursuant to art. 58, par. 2, of the Regulation. In light of the above considerations, it is therefore noted that, at least until the corrective interventions referred to in the communication of 15 June 2023, the processing of personal data carried out is unlawful as it is carried out in a manner that does not comply with the principles of "lawfulness" and “minimization” of data, in violation of art. 5, par. 1, letter. a) and c) and of the art. 6, par. 1 of the Regulation, in consideration of the fact that the camera, due to its characteristics, was suitable for also framing part of the playground in front of Mrs. XX's home (see Inspection Report). It is taken into account that the declarations contained in the defense writings are to be considered worthy of consideration for the purposes of evaluating the conduct and that the same has exhausted its effects, the data controller having replaced the previously installed camera with a fixed one. towards the entrance; in relation to the foregoing, the case can be classified as a "minor violation", pursuant to art. 83, par. 2 and Recital 148 of the Regulation. It is therefore considered sufficient to warn the data controller pursuant to art. 58, par. 2, letter. b), of the Regulation. Finally, it is noted that the conditions set out in art. 17 of the Guarantor Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor. ALL THE WHEREAS, THE GUARANTOR a) declares, pursuant to articles. 57, par. 1, letter. a) and 83 of the Regulation, the illegality of the processing carried out by Mrs XX (tax code XX), resident in XX, within the terms set out in the motivation, for the violation of art.5, par. 1, letter. a) and c) and of the art. 6, par. 1 of the Regulation; b) pursuant to art. 58, par. 2, letter. b) of the Regulation warns the same data controller for the violation of the art. 5, par. 1, letter. a) and c) and of the art. 6, par. 1 of the Regulation; HAS the annotation in the internal register of the Authority of the violations and measures adopted pursuant to the art. 58, par. 2, of the GDPR with this provision, as required by art. 17 of the Guarantor Regulation n. 1/2019. Pursuant to art. 78 of Regulation (EU) 2016/679, as well as articles. 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same art. 10, within thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad. Rome, 12 October 2023 PRESIDENT Stantion THE SPEAKER Stantion THE GENERAL SECRETARY Mattei
