Garante per la protezione dei dati personali (Italy) - 10196164

Garante per la protezione dei dati personali - 10196164

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(b) GDPR Article 5(1)(a) GDPR Article 6 GDPR Article 12(1) GDPR Article 13 GDPR Article 35 GDPR Article 88 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	23.10.2025
Published:
Fine:	15,000 EUR
Parties:	n/a
National Case Number/Name:	10196164
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	lde

The DPA fined the Municipality of Curtarolo €15,000 for unlawfully using video surveillance footage in order to investigate the behaviour of one of its employees.

English Summary

Facts

The data subject, a former employee of the Municipality of Curtarolo, filed a complaint alleging that the Municipality (the controller) had initiated a disciplinary procedure against her based on video and photographic footage, which was obtained using video surveillance systems inappropriately.

The data subject further claimed that the Mayor of the Municipality had asked a private citizen to record her while she was having lunch with friends, as part of an investigation into her behavior.

It was also reported that the controller’s video surveillance system lacked proper disclosure notices regarding personal data processing and failed to meet information requirements set forth in Articles 12 and 13 GDPR.

The controller responded that the video surveillance system was installed for public safety and crime prevention purposes. The footage in question, which captured the data subject leaving work without properly clocking out, was used in a disciplinary procedure that led to her dismissal. The footage was also used in a criminal investigation against the complainant for suspected misconduct, but the investigation concluded without charge.

The data subject filed a complaint to the DPA.

Holding

The DPA upheld the complaint, identifying violations of Articles 5(1)(a)(b) GDPR, Article 6(1)(c)(e) GDPR, Article 6(2) and (3) GDPR, Article 12(1) GDPR, Article 13 GDPR, Article 35 GDPR and Article 88 GDPR.

First of all, recording the data subject and two other employees outside of the work environment amounted to unlawful processing and thus non-compliance with the principle of lawfulness, fairness, and transparency (GDPR Articles 5(1)(a), 6(1)(c)(e), 6(2)(3).

When installing the video surveillance system, the controller did not inform in any way its employees, failing to comply with information obligations mandated by Articles 12 and 13 GDPR. Moreover, the purpose of the cameras according to the controller was to increase safety. Thus, the use of the recordings as a basis for the disciplinary actions against the data subject goes beyond the envisaged purpose of the processing, in violation of Article 5(1)(b) GDPR. Moreover, the installing of the surveillance system should have been subject to a prior carrying out of a data protection impact assessment; the lack of this action by the controller resulted in a breach of Article 35 GDPR.

The DPA, lastly, found a violation of Article 88 GDPR, as the controller processed personal data in the context of employment where it was not relevant, and no appropriate safeguards were put in place.

The DPA imposed on the controller a €15,000 fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10196164]

Provision of October 23, 2025

Register of Provisions
no. 628 of November 23, 2025

THE ITALIAN DATA PROTECTION AUTHORITY

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, Members, and Councillor Angelo Fanizza, Secretary General;

CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter "Regulation");

SEEN Legislative Decree 30 June 2003, n. 196 of 30 April 2019, containing the "Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the "Code");

CONSIDERING Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Data Protection Authority, approved with Resolution No. 98 of 4 April 2019, published in the Official Journal No. 106 of 8 May 2019 and on www.gpdp.it, web doc. No. 9107633 (hereinafter "Data Protection Authority Regulation No. 1/2019");

Having seen the documentation on file;

Having seen the observations made by the Secretary General pursuant to Article 15 of the Regulation of the Guarantor No. 1/2000 on the organization and functioning of the Office of the Guarantor for the Protection of Personal Data, web doc. No. 1098801;

Rapporteur: Professor Ginevra Cerrina Feroni;

WHEREAS

1. Introduction.

In a complaint filed pursuant to Article 77 of the Regulation, Ms. XX, a former employee of the Municipality of Curtarolo (hereinafter, the "Municipality"), stated that "on XX, disciplinary proceedings were initiated against [her] [...] for events that occurred from XX to XX on the basis of video and photographic documentation," obtained through "illegal use of video surveillance systems [...]".

In an addition to her complaint, the complainant further stated that, in the context of criminal proceedings initiated against her in relation to such facts, which concluded without charges for the same, emerged "from the report of other summary witness information [...] [a] further violation of privacy [...], having [the Mayor of the Municipality] instructed a private citizen to film [the complainant] while she was having lunch with two colleagues during a period of illness (moreover in a fully legitimate manner as it was outside the availability bands); This video was transmitted [via an instant messaging application] to the mayor's private cell phone and used [without] the complainant's knowledge and completely unlawfully."

The complainant also reported to the Authority, pursuant to Article 144 of the Code, that the Municipality had installed a video surveillance system without, however, having placed the required information signs containing information on the processing of first-level personal data and, more generally, without having fulfilled the main obligations set forth in the data protection legislation.

2. The preliminary investigation.

In response to a request for information from the Authority (see note prot. no. XX of XX), formulated pursuant to Article 157 of the Code, the Municipality, with note dated XX (prot. no. XX), declared, in particular, that:

A) in relation to the processing of personal data carried out through surveillance cameras Video surveillance installed on public roads:

"By resolution of the City Council of 20th June, [the Municipality] entrusted the Federation of Municipalities of Camposampierese [hereinafter, the "Federation"] through a specific agreement [...] with the operational management [...] of the video surveillance system [...]";

"The Municipality, with its own assignment dated 20th June, [...] equipped itself with a territorial video surveillance system with three devices [...], one of which was installed in Piazza Martiri [...]";

"The Federation then, during 20th June, [...] purchased and installed four additional devices, commissioning the software and video recording system of the Municipality's streets [...], entrusted to the local police";

"The Municipality entrusted [the Federation, as] data controller [of the data] with the [task of ensuring] compliance with the obligations to inform the data subject pursuant to art. 13 […] of the [Regulation]”;

“all video surveillance cameras […], installed on public roads, have always had the following purposes and legal bases: a) the purpose of protecting urban safety and public security […]. Legal basis: […] art. 5 Legislative Decree 51/2018; b) the purpose of protecting municipal assets […]; c) the purpose of protecting road safety and controlling vehicle traffic […]. Legal basis: […] art. 6, paragraph 1, letter e) [of the Regulation]; d) the purpose of environmental protection and administrative police […]. Legal basis: […] art. 6, paragraph 1, letter e) [of the Regulation]; e) […] solely in the capacity of judicial police, for the purposes of prevention, investigation, detection, and prosecution of crimes or the execution of criminal penalties, within the scope of judicial police activities. Legal basis: […] art. 6, paragraph 1, letter e) [of the Regulation] […]; art. 5 Legislative Decree 51/2018";

"The Municipality has published on its website the information on the processing of personal data relating to the video surveillance system drawn up by the Federation on XX.

"The agreement for the implementation of urban security stipulated with the Prefecture of Padua [with] Resolution No. XX of XX has been approved";

"The Municipality has begun preparing the impact assessment [on data protection], which is nearing completion […]";

"The […] conservation of images, which are kept for seven days, is entrusted to the local police at the Federation's premises";

B) regarding the use of video surveillance footage featuring the complainant:

"no agreement was reached with the union representatives, nor was authorization obtained from the Inspectorate [...]. The camera [...] in fact records the area for public safety reasons, solely for the purposes of crime prevention and detection [...] [with] 360-degree coverage [...] of the entire surrounding area";

"[...] following specific reports from several municipal employees [...] the [Mayor] [...], in her capacity as Local Police Officer/Judicial Police Officer pursuant to Article 57 of the Criminal Code, [...] took action by requesting the Federation's Local Police [...] to acquire footage of the public street";

"the facts alleged against the complainant, consisting of her systematically failing to clock in during her repeated exits from the municipal offices, led [...] to the issuing of a dismissal order without notice";

"Following viewing of the aforementioned videos, elements emerged that, potentially having criminal and disciplinary relevance, were brought to the attention of the appropriate authorities (i.e., [the competent disciplinary office]) and subsequently [...] also to the investigating authorities (by means of a report dated XX filed at the Carabinieri Station in Piazzola sul Brenta)";

"[…] this activity was carried out - being a report of a crime prosecutable ex officio - in the capacity of a Public Official and/or Judicial Police Officer pursuant to Article 57, paragraph 1, letter c), of the Code of Criminal Procedure (given the absence in the municipal area of "a State Police office or a Carabinieri or Financial Police command");"

C) regarding the use of a video, filmed by a Municipal employee, featuring the complainant and several of her colleagues, and its transmission to the Mayor via an instant messaging application:

"The [Mayor], having learned that the complainant during her illness […] had been seen walking […] and having lunch with colleagues, instructed […] a municipal employee […] to collect evidence (video) relating to this circumstance. The video relating to day XX […] was recorded and transferred via [a] messaging application to the Mayor's personal account by the same employee […]. After the images were transferred to the [Mayor], they were immediately deleted."

With a note dated XX (ref. no. XX), the Office, based on the information acquired, the investigations carried out, and the facts that emerged from the investigation, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of proceedings for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulation:

for having processed personal data, using video devices, in a manner inconsistent with the principles of "lawfulness, fairness, and transparency" and in the absence of a legal basis, in violation of Articles 5, paragraph 1, letter a) and 6 of the Regulation, as well as Article 2-ter of the Code;

for having failed to provide data subjects with adequate information on the processing of personal data, acting in a manner inconsistent with the principles of "lawfulness, fairness, and transparency," in violation of Articles 5, paragraph 1, letter a), 12, and 13 of the Regulation;

for having failed to conduct a data protection impact assessment before initiating the processing, in violation of Article 35 of the Regulation;

for placing the entrance to the town hall under video surveillance without ensuring compliance with the guarantees set forth in Article 4 of Law No. 300/1970 and for using the video surveillance footage for disciplinary purposes in a manner inconsistent with the principles of "lawfulness, fairness, and transparency" and "purpose limitation," in violation of Articles 5, paragraph 1, letters a) and b), 6, and 88 of the Regulation, as well as Article 114 of the Code (referring to Article 4 of Law No. 300/1970);

for carrying out investigative or other investigative activities regarding activities carried out by the complainant and two other employees outside of working hours, through one of their collaborators and using video devices, in a manner inconsistent with the principles of "lawfulness, fairness, and transparency" and without a legal basis, in violation of Articles 5, paragraph 1, letters b) and c) of the Code. a), 6 and 88 of the Regulation, as well as 113 of the Code (with reference to art. 8 of Law 300/1970).
With the same note, the aforementioned owner was invited to submit written defenses or documents to the Guarantor or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981).

With a note dated XX (ref. No. XX), the Municipality submitted a defense brief, declaring, in particular, that:

"[…] it was precisely through viewing the video surveillance images and comparing them with the attendance records that the lawful acquisition of the crime was substantiated [...]";

"[…] regardless of the manner in which the [complaint] was drafted, the introductory act of the investigative action must be considered, on a substantive level, as a clear communication of the crime pursuant to Article 347 of the Code of Criminal Procedure."

At the hearing, requested pursuant to Article 166, paragraph 6, of the Code and held on XX (see minutes, file no. XX of the same date), the Municipality stated, in particular, that "the interested party has not […] suffered any damage as a result of the processing," providing information on the matter.

3. Outcome of the investigation.

3.1 Processing of personal data through video devices installed on public roads.

The investigation initiated by the Office revealed that the Municipality has installed a video surveillance system, the technical management of which has been entrusted to the Federation. The system consists of several cameras installed on public roads, of which only five are currently active and functioning.

Furthermore, the Municipality has installed two additional video devices, equipped with automatic license plate recognition for vehicles in transit, to ensure road safety and monitor vehicle traffic.

However, the use of the aforementioned video devices by the Municipality does not comply with the regulations on the protection of personal data, as illustrated below.

3.2. Lawfulness of processing.

The processing of personal data through video devices by public entities is generally permitted if it is necessary to comply with a legal obligation to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (see Article 6, paragraphs 1, letters c) and e), and paragraphs 2 and 3 of the Regulation, as well as Article 2-ter of the Code; cf. paragraph 41 of the "Guidelines 3/2019 on the processing of personal data through video devices," adopted by the European Data Protection Board on January 29, 2020.

Article 6, paragraph 3, of the Regulation—in accordance with the provisions of Articles 8 of the European Convention on Human Rights and Articles 7, 8, and 52 of the Charter of Fundamental Rights of the European Union - specifies that the legal basis for the processing of data referred to in paragraph 1(c) and (e) must be established by Union law or the law of the Member State to which the data controller is subject. Such law must determine the purpose of the processing and contain specific provisions to adapt the application of the provisions of the Regulation. It is understood that Union or Member State law must, in any case, pursue an objective of public interest and be proportionate to the legitimate aim pursued.

The data controller is also, in any case, required to comply with the principles of data protection (see Article 5 of the Regulation), including "lawfulness, fairness, and transparency," and must be able to demonstrate that the processing is carried out in compliance with the Regulation (Articles 5(2) and 24 of the Regulation).

That said, it should be noted that the Municipality has declared that the four video surveillance devices deployed are, first and foremost, instrumental to the protection of urban security.

In this regard, it should be noted that, pursuant to the current sector regulations (see Articles 4 and 5, paragraph 2, letter a), of Legislative Decree No. 14 of February 20, 2017; see also Article 6, paragraphs 7 and 8, of Legislative Decree No. 11 of February 23, 2009; see Provisions No. 201 of April 10, 2025, Web Doc. No. 10139433; No. 805 of December 19, 2024, Web Doc. No. 10107263; No. 5 of January 11, 2024, Web Doc. 9977020 and October 20, 2022, no. 341, web doc. no. 9831369), municipalities may install video surveillance cameras on public roads for the "prevention and fight against widespread and predatory crime," subject to a pact for the implementation of urban security with the territorially competent Prefecture.

The Municipality entered into this agreement with the Prefecture of Padua on XX and, therefore, after the date of installation of two of the aforementioned five video surveillance cameras that are currently active (one camera installed in Piazza Martiri and two cameras installed at the Sports Facilities Park on XX), without however specifically indicating, within the aforementioned agreement, the specific areas of the municipal territory to be subjected to video surveillance (see art. 2 of the agreement, which indicates, in a completely generic manner, "road intersections, squares and public areas, public parks and buildings, school and institutional buildings"). This means that even the use of cameras installed by the Municipality after the date of signing of the aforementioned agreement cannot be considered compliant with the aforementioned legal framework for the sector, as no assessment has been carried out, jointly with the competent public safety authorities, regarding the actual need to use video surveillance in the specific sites where they were installed for the protection of urban safety. Consequently, it is impossible to attribute the processing of personal data in question to the sector regulations pursuant to art. 5, paragraph 2, letter a), of Legislative Decree no. 20 February 2017. 14.

It should also be noted that the purpose of "prevention, investigation, detection, and prosecution of crimes or the execution of criminal sanctions, within the scope of [judicial police] activities," cited by the Municipality, cannot justify the ex ante use of video surveillance cameras, that is, independently of specific investigative activities carried out by the local police on behalf of, under the authority of, and under the direction of the judicial authority (see Articles 5, paragraph 4, of Law No. 65 and 56 of the Code of Criminal Procedure of 7 March 1986). This purpose may potentially come into play if, within the scope of video surveillance activities already implemented for the protection of urban security, in accordance with the aforementioned sectoral framework, certain images may actually constitute evidence of criminal liability and must therefore be acquired for the purposes of related judicial proceedings (see Article 55 of the Code of Criminal Procedure; see Article 56 of the Code of Criminal Procedure). Criminal Court of Cassation, Section III, Sentence 30/08/2022, no. 31930, which states that "it constitutes [...] a long-standing, but never disputed, teaching that, pursuant to Law no. 65 of 7 March 1986, art. 5 and art. 57 of the Code of Criminal Procedure, paragraph 2, letter b), the status of judicial police officers is expressly attributed to municipal guards, who are recognized with the power to intervene within the territorial scope of the entity to which they belong and within the limits of their own powers, which include the performance of functions related to the ascertainment of crimes of any kind, which have occurred in their presence, and which require prompt intervention also for the purpose of acquiring evidence"; see also provisions no. 234 of 11 April 2024, web doc. no. 10013356; November 16, 2023, Nos. 577 and 578, web doc. Nos. 9963453 and 9963486; June 9, 2022, No. 214, web doc. No. 9794895).

Regarding the purpose of "environmental protection and administrative policing," also invoked during the investigation, the Municipality has not indicated any sector-specific provision, appropriate in terms of rank and quality, that would allow municipalities to subject public roads to video surveillance, with a wide angle and on a continuous basis, to pursue this processing purpose. Furthermore, the Municipality has not explained the specific administrative violations that could potentially be detected by the video surveillance cameras in question and the methods by which the alleged offenders filmed would be identified. Indeed, it must be considered that this processing purpose cannot be pursued with the same video surveillance cameras that cover a wide area of public roads for urban security purposes. Local authorities, however, may, within the legal framework applicable at the time of the complaint, use video devices (so-called camera traps) placed in specific and limited areas where there is a real risk of illegal waste abandonment or incorrect disposal, provided that such areas are duly marked with information signs (so that data subjects are fully aware of the fact that they are being filmed and can, if appropriate and where possible, decide to avoid video surveillance) and only if the use of alternative control tools and systems is not possible or proves ineffective; this however in compliance with the principle of data minimization, which requires configuring such devices with a viewing angle limited to the areas affected by the aforementioned phenomena, typically characterized by little or limited human presence (see FAQ of the Guarantor on video surveillance of 3 December 2020, web doc. no. 9496574, no. 13; see already the "Provision on video surveillance" of the Guarantor, of 8 April 2010, web doc. no. 1712680, par. 5.2; see, however, the new wording of art. 255, paragraph 1, of Legislative Decree 3 April 2006, no. 152 - Environmental regulations, as amended first by art. 6-ter of Legislative Decree 10 August 2023, no. 105, converted with Law 9 October 2023, no. 137, and then, lastly, by art. 1, paragraph 1, of Legislative Decree no. 116 of 8 August 2025, converted into law no. 147 of 3 October 2025, which brought certain conduct relating to environmental protection into the criminal sphere, previously sanctioned only through administrative means).

Finally, regarding the use of three video devices equipped with automatic vehicle detection capabilities for road safety and vehicle traffic control, the Municipality has not demonstrated that it used approved devices to verify compliance with the mandatory inspection and insurance obligations set forth in Articles 80 and 193 of the Highway Code (Legislative Decree No. 285 of April 30, 1992) and the deferred reporting of identified violations. Nor has the Municipality declared that the video devices in question, even if not approved, are used merely as a support tool for local police officers physically present in the areas affected by the checks, for the purpose of identifying vehicles to be stopped and immediately reporting any violations discovered by the officers, unless a factual situation exists that makes it impossible to stop the vehicle and immediately report it, with reasons to be detailed in the report (see Ministry of the Interior circulars no. XX of XX and no. XX of XX; cf. provision no. 805 of 19 December 2024, web doc. no. 10107263).

In light of the foregoing considerations, it must be concluded that the Municipality has processed personal data (images of natural persons or otherwise related to them; license plate numbers of vehicles in transit) using video devices in a manner that does not comply with the principle of "lawfulness, fairness, and transparency," and in the absence of a legal basis, in violation of Articles 15 and 16 of Legislative Decree no. 5, paragraph 1, letter a), and 6, paragraph 1, letter c), and letter e), and paragraphs 2 and 3 of the Regulation, as well as 2-ter of the Code.

3.3 Transparency of processing.

In compliance with the principles of "lawfulness, fairness, and transparency," the data controller must take appropriate measures to provide the data subject, prior to processing, with all the information required by the Regulation in a concise, transparent, intelligible, and easily accessible form, using clear and plain language (see Articles 5, paragraph 1, letter a), 12, 13, and 14 of the Regulation).

When video devices are used, the data controller, in addition to providing first-level information by placing warning signs near the area subject to video surveillance, must also provide data subjects with "second-level information," which must "contain all the mandatory elements pursuant to Article 13 of the [Regulation]" and "be easily accessible to the data subject, for example through a comprehensive information page made available at a central point […] or posted in an easily accessible place" ("Guidelines 3/2019 on the processing of personal data through video devices," cited above, in particular paragraph 7; but see also the "Provision on video surveillance," cited above, in particular paragraph 3.1; most recently, see the Garante's FAQs on video surveillance, cited above, no. 4).

First-level information (warning sign) "should communicate the most important information, such as the purposes of the processing, the identity of the controller, and the existence of the data subject's rights, together with information on the most significant impacts of the processing" (ECB Guidelines, cited above, para. 114). Furthermore, the signage must also contain information that may be unexpected for the data subject. This could include, for example, the transmission of data to third parties, particularly if located outside the EU, and the retention period. If this information is not provided, the data subject should be able to trust that only real-time monitoring is taking place (without any data recording or transmission to third parties) (ECB Guidelines, cited above, para. 115). First-level warning signage must contain a clear reference to the second-level information, for example, by indicating a website where the full privacy notice can be found.

In this case, the Municipality stated that it installed signs containing the first-level information in the month of XX, and therefore after the Authority initiated its investigation. Only with regard to two of the video license plate reading devices located at the Via Einaudi roundabout did the Municipality refer to the "presence of the first-level information on XX," without, however, specifying any specific date of installation of the information signs in question.

In any case, it must be noted that these signs contain first-level information that is inadequate to ensure a sufficient level of transparency for data subjects and to comply with the information requirements set forth in the current European data protection legal framework (see the Garante's FAQ No. 4 on video surveillance, which in turn refers to the example sign proposed by the European Data Protection Board in the aforementioned "Guidelines 3/2019 on the processing of personal data through video devices," paragraphs 115-116).

These signs, which include the warning "video-surveillance area" along with a picture of a camera, do not clearly state the name of the data controller ("the recording is carried out by the FCC local police"), indicate a completely generic purpose for the processing ("for security purposes"), make no mention of the rights granted to data subjects by the Regulation, and fail to account for the recording of video surveillance footage for the period established by the data controller. Furthermore, there is no reference to how data subjects can access the complete second-level information notice, thus fundamentally compromising the effectiveness of the transparency mechanism based on layered first- and second-level information notices, as per the aforementioned Guidelines of the European Data Protection Board.

Regarding the complete second-level disclosure, the Municipality stated that it published the "Regulation governing video surveillance in the Camposampierese municipalities" dated XX on its website on XX, thus only after the Authority had initiated its investigation. This document contained all the information required by Article 13 of the Regulation (see Annex XX of the Municipality's note dated XX). Given that the regulation in question was adopted by the Federation and not by the Municipality, it cannot, in any case, be considered a disclosure on the processing of personal data pursuant to Articles 12 and 13 of the Regulation. This is because it is a document drafted for purposes other than those underlying the obligations set forth in the Regulation to ensure transparency of processing. Therefore, it cannot replace the information that the data controller must provide to data subjects, prior to initiating the processing, regarding the essential characteristics of the processing, in a concise, transparent, intelligible, and easily accessible form, using clear and simple language.

It is therefore established that the Municipality failed to provide data subjects with adequate information regarding the processing of personal data, acting in a manner inconsistent with the principles of "lawfulness, fairness, and transparency," in violation of Articles 5(1)(a), 12, and 13 of the Regulation.

3.4 Data protection impact assessment.

In the event of high risks to data subjects—for example, arising from the use of new technologies and always present where systematic, large-scale surveillance of a publicly accessible area is carried out (see Article 35(3)(c) of the Regulation)—the data controller must conduct a data protection impact assessment, in order to adopt, in particular, appropriate measures to address such risks, after consulting the Garante in advance, where the conditions are met (see Articles 35 and 36(1) of the Regulation).

In the present case, the Municipality was certainly required to conduct a data protection impact assessment, given that, pursuant to Article 35(3)(c) of the Regulation, such an assessment is always required in the case of "systematic large-scale surveillance of an area accessible to the public," a circumstance that applies in the present case, given the use of video devices on public roads, some of which, moreover, are equipped with automatic license plate recognition capabilities for passing vehicles.

Furthermore, given that one of the video devices in question filmed not only the public road but also the entrance to the municipal building and, therefore, was suitable for monitoring the entry and exit of municipal workers from their workplaces, as indeed occurred in the present case (see section 3.5 below), the Municipality should have conducted a data protection impact assessment also with regard to the workers' personal data. Both in consideration of the particular “vulnerability” of data subjects in the workplace context (see recital 75 and art. 88 of the Regulation and the “Guidelines on data protection impact assessment and the criteria for determining whether processing is “likely to result in a high risk” pursuant to Regulation 2016/679”, WP 248, of 4 April 2017, which, among the categories of vulnerable data subjects, expressly mention “employees”) and of the possible “systematic monitoring” in the workplace context, understood as “processing used to observe, monitor or control data subjects, including data collected via networks” (see criterion no. 3 indicated in the Guidelines, cit., but see also criteria 4 and 7; see art. 88, par. 2, of the Regulation; see also provision 11 October 2018, no. 467, web doc. no. 9058979, annex no. 1, which expressly mentions the "processing carried out within the employment relationship using technological systems [...] from which the possibility of remotely monitoring the activities of employees arises"; see, among others, provisions of 10 April 2025, no. 201, web doc. no. 10139433; 16 November 2023, no. 578, web doc. no. 9963486 and 1 December 2022, no. 409, web doc. no. 9833530).

In this regard, the data controller stated that "the Municipality has begun preparing the impact assessment, which is nearing completion."

Therefore, since the Municipality failed to conduct a data protection impact assessment before initiating the processing, Article 35 of the Regulation has been violated.

3.5 The use of video surveillance footage in the context of the employment relationship, including for disciplinary purposes.

From the Municipality's memo to the competent Office for Disciplinary Proceedings dated 20th December, filed in the case file, it emerges that, following several reports alleging that the complainant "frequently absented herself from work during the performance of her work duties to go outside the building [to attend to personal needs]," both "data relating to attendance records carried out via badge" and "images obtained from cameras located outside the town hall, which, for security reasons, frame the public street and the town hall itself," were acquired. By cross-referencing this data with the video surveillance images obtained from the aforementioned camera, the complainant was accused of having entered and exited the municipal building on numerous occasions without recording this in the attendance recording system.

In a subsequent report filed by the Municipality with the aforementioned Office for Disciplinary Proceedings on xx, the complaint was further accused of similar conduct, again based on a comparison between the data from the attendance recording system and the video surveillance images. Furthermore, the complainant was accused of "during the [interested party's] illness [...] on two documented occasions, albeit outside of the hours of availability, on date [...] (filmed by external cameras on the public street) walking in front of the town hall."

As a result of these complaints, the complainant was issued a dismissal without notice order. The preamble to the order states that the report submitted to the competent disciplinary office included "a copy of the recordings taken from a public video surveillance system, legitimately positioned on the public street," and that the Municipality's investigations into the complainant's absences from work were "supported by video footage," as the Municipality "examined the images recorded by cameras located outside the town hall," alleging that the complainant had "repeatedly left the workplace without completing the required "clocking in" and "clocking out," generally staying outside the Town Hall to attend to her personal needs."

It is therefore established that, following several reports submitted by colleagues of the complainant, the Municipality used footage from a video surveillance camera installed on the public street (Piazza Martiri) for the purpose of ensuring urban safety. This was done to verify the validity of the reports and to acquire evidence to support any disciplinary charges that were subsequently brought against the complainant.

The Municipality therefore processed the video surveillance footage for a purpose (i.e., the investigation and challenge of conduct deemed relevant to disciplinary action in the context of the employment relationship) that cannot be considered compatible (see Article 6, paragraph 4, of the Regulations) with the purpose for which the video surveillance system was installed (i.e., the protection of urban safety; see Decision No. 341 of October 20, 2022, web doc. No. 9831369).

The processing operations carried out by the Municipality for purposes related to the management of the employment relationship then in place with the complainant cannot, in fact, be considered logically connected to or derived from the processing operations carried out by the same Municipality for urban security purposes, which are aimed at "preventing and combating widespread and predatory crime" (see Article 5, paragraph 2, letter a), of Legislative Decree no. 14 of February 20, 2017; see Working Party Article 29, "Opinion 03/2013 on Purpose Limitation" (WP 203) of April 2, 2013, paragraph III.2.2.(a), which states that a relationship may exist between the original processing purpose and the subsequent processing purpose if the subsequent processing is already implicit to some extent in the initial purpose, or can be considered a logical subsequent step in light of that initial purpose).

The use of video surveillance on public roads to verify the complainant's proper fulfillment of her employment obligations also conflicts with the expectations of citizens, on the one hand, that the images acquired by cameras installed on public roads are processed exclusively for the aforementioned urban security purposes, and, on the other, of municipal workers, that only video devices that can provide indirect monitoring of work performance and for which compliance with the guarantees set forth in Article 4, paragraphs 1 and 3, of Law No. 20 May 1970, are used. 300 (see also Articles 88 of the Regulation and 114 of the Code) may be used by the employer for all purposes related to the employment relationship (see "Opinion 03/2013 on purpose limitation," cited above, paragraph II.3, which states that further processing cannot be considered foreseeable if it is not sufficiently related to the original processing purpose and does not meet the reasonable expectations of the data subjects at the time the data was collected, taking into account the context in which such collection occurred).

Considering that, in the specific case, the Municipality has not demonstrated the existence of independent lawfulness requirements for the processing of video surveillance images, already acquired and processed for urban security purposes, even for the different purpose of ascertaining and challenging the complainant for conduct relevant to disciplinary action, the related processing of personal data must be deemed to have been carried out in a manner that does not comply with the principle of "lawfulness, fairness, and transparency" and in the absence of a legal basis, in violation of Articles 5, paragraph 1, letter a), and Article 6 of the Regulation.

In any case, it must be considered that the data controller may use for further processing only personal data lawfully collected in the presence of an appropriate legal basis, having previously "satisfied all the requirements for the lawfulness of the original processing" (see Recital No. 50 of the Regulation), and therefore to the extent that the original collection was lawfully carried out, taking into account the primary purpose and in compliance with the general principles of data protection. Given the unlawfulness of the upstream processing carried out using the video surveillance cameras in question (see paragraph 3.2 above), and given the unusability of "personal data processed in violation of the relevant data processing regulations" (Article 2-decies of the Code), it is believed that any subsequent processing of personal data carried out by the Entity must also be considered unlawful.

It must therefore be concluded that the Municipality processed the video surveillance footage in question for a purpose incompatible with the original purpose, in a manner inconsistent with the principle of "purpose limitation," in violation of Article 5, paragraph 1, letter b), of the Regulation.

Nor can the Municipality's defense be accepted, according to which the acquisition of the video surveillance footage constituted "an acquisition of information on the initiative of a crime pursuant to Article 55 of the Code of Criminal Procedure, in the capacity of a Judicial Police Officer, pursuant to Article 57, paragraph 1, letter c), of the Code of Criminal Procedure" and that "the act initiating the investigative action must be considered, on a substantive level, as a clear communication of information on a crime pursuant to Article 347 of the Code of Criminal Procedure." This is because the Municipality, acting as the complainant's employer, accessed the video surveillance images in order to compare the attendance records with the video surveillance images and verify the complainant's compliance with the obligations arising from the employment relationship. Therefore, only following this operation, and not as a result of merely viewing the video surveillance images, did the Mayor consider there to be sufficient grounds to file a complaint, for the alleged crime under Article 640, paragraph 2, no. 1, of the Criminal Code, with the Judicial Authority, which subsequently ordered the case to be closed. Indeed, as is evident from the ruling of the Court of Padua, in the documents, the proceedings were initiated following a "complaint filed by [the ...] Mayor" and not following notification of a crime pursuant to Article 640, paragraph 2, no. 1, of the Criminal Code. 347 of the Code of Criminal Procedure in the context of judicial police activities, as argued by the Municipality during the proceedings (see provision no. 234 of April 11, 2024, web doc. no. 10013356).

Furthermore, considering that the Municipality's report to the competent Office for Disciplinary Proceedings of the 20th, in the case file, shows that the "cameras [were] placed outside the town hall and [...] framed [...] [not only] the public street [but also] the town hall itself," and therefore the entry and exit areas of the workplace, this circumstance, given the lack of activation of the guarantees provided for by Article 4, paragraph 1, of Law no. 300/1970 (union agreement or authorization from the National Labor Inspectorate) and the actual use of video surveillance images for disciplinary purposes, leads us to believe that, in this case, the Municipality's conduct also conflicts with Articles 88 of the Regulation and 114 of the Code.

As consistently reiterated in the provisions of the Data Protection Authority, processing resulting from the use of technological tools in places where work activities also take place finds its legal basis in the sector-specific regulations set forth in Article 4 of Law No. 300/1970. This provision defines, uniformly at the national level, the scope of processing permitted in every work context (public and private) and constitutes a more specific and more comprehensive provision in domestic law than Article 88 of the Regulation. Compliance with this provision—due to the reference contained in the Code to pre-existing national sector-specific provisions protecting the dignity of individuals in the workplace, with particular reference to possible controls by the employer (Article 114 "Guarantees regarding remote monitoring")—is a condition for the lawfulness of the processing (see Articles 5, paragraph 1, letter a) and 6, paragraph 1, letter c) of the Regulation). see, at the European level, the indications contained in the aforementioned “Guidelines 3/2019 on the processing of personal data through video devices”, cit., especially par. 11, as well as the previous indications of the Article 29 Working Party in “Opinion 2/2017 on data processing in the workplace”, WP 249; cf. par. 4.1 of the “Provision on video surveillance”, cit., and, lastly, FAQ no. 9 of the Guarantor on video surveillance, cit., and the numerous decisions of the Guarantor relating to specific cases, including, with regard to the use of video surveillance in the workplace, provisions of 10 July 2025, no. 410, web doc. no. 10162731; 10 April 2025, no. 201, web doc. no. 10139433; April 11, 2024, No. 234, web doc. No. 10013356; November 16, 2023, No. 578, web doc. No. 9963486; September 16, 2021, No. 331, web doc. No. 9719768; March 11, 2021, No. 90, web doc. No. 9582791; March 5, 2020, No. 53, web doc. No. 9433080; September 19, 2019, No. 167, web doc. No. 9147290).

This is in accordance with the case law of the European Court of Human Rights in the case Antovic and Mirković v. Montenegro (Application No. 70838/13 of 28 November 2017), which established that respect for private life must also be extended to public workplaces (in this case, university classrooms), highlighting that the use of video devices in the workplace can only be justified in compliance with the guarantees provided by the applicable national law, the absence of which constitutes an unlawful interference with the employee's private life, pursuant to Article 8, paragraph 2, of the ECHR.

The data protection system, integrated with Article 4 of Law 300/1970, on the other hand, protects the person who works, not only when the surveillance devices are placed inside the workplace - the circumstance that access to said premises by workers occurs discontinuously and for short periods of time being irrelevant - but also in the case in which external or perimeter areas in which workers pass through are subjected to video surveillance, given the possibility, as in the case in question, of filming their image and the activities they carry out (see provisions of 10 April 2025, no. 201, web doc. no. 10139433, on the use of a video surveillance camera framing the external entrance of a local police station and part of the parking lot for service cars; 11 March 2021, no. 90, web doc. no. 9582791, concerning the use of surveillance cameras). Video surveillance in the corridors of a building housing a University Department; May 9, 2018, no. 277, web doc. no. 8998303, regarding a video surveillance system installed in internal and external areas of a building of the headquarters of a public body, including access points; April 18, 2013, no. 200, web doc. no. 2483269, regarding footage that specifically concerned the access points, corridors, and some areas open to users of a State Archives; February 9, 2012, no. 56, web doc. no. 1886999, in which the footage concerned the access points to the garages of a local police station, as well as the internal corridor leading to the armory; November 17, 2011, no. 434, web doc. no. 1859558, in which the footage concerned the main entrances and emergency areas, corridors on various floors, and access areas to certain office areas).

In this case, this Municipality placed video surveillance on an area of the public road that includes access to the municipal offices, which is undoubtedly used by the Municipality's workers entering or leaving the workplace, without ensuring compliance with the guarantees set forth in Article 4, paragraph 1, of Law 300/1970. This violation violated Articles 5, paragraph 1, letter a), 6, and 88 of the Regulation, as well as Article 114 of the Code (referring to Article 4 of Law 300/1970).

Furthermore, this violation was not provided to workers with specific information regarding the processing of personal data via video devices and their use, including for all purposes related to the employment relationship (see Article 4, paragraph 3, of Law 300/1970), thus also violating Articles 5, paragraph 1, letter a), 6, and 88 of the Regulation. 1, letter a), 12, paragraph 1, and 13 of the Regulations.

3.6 The footage taken by the Municipality with a different video device.

From the statements made during the investigation, it emerges that the Mayor of the Municipality, having learned from a report that the complainant had been seen walking and having lunch with colleagues during her illness, instructed "a municipal employee [...] to collect evidence (videos) relating to this circumstance." This employee, after recording a video, sent it to the Mayor's cell phone via an instant messaging application, given that "the Municipality [...] does not have sufficient financial resources to provide the Mayor with a cell phone and a phone number registered to the Municipality." These videos were subsequently used by the Municipality in the disciplinary proceedings initiated against the complainant.

The Municipality, therefore, conducted investigative or other investigation activities regarding the complainant's activities outside of working hours, through one of its own employees—who, moreover, did not appear to be part of the staff responsible for supervising work activities (see Article 3 of Law 300/1970)—and, therefore, without using individuals who professionally and regulatedly practice the profession of investigator, in compliance with the safeguards established by law (see Chapter IV of the "Rules of Ethics relating to the processing of personal data carried out to carry out defensive investigations or to assert or defend a right in court, published pursuant to Article 20, paragraph 4, of Legislative Decree No. 101 of August 10, 2018," dated December 19, 2018, web doc. No. 9069653).

Furthermore, as highlighted by the Preliminary Investigations Judge of the Court of Padua, who ordered the dismissal of the criminal proceedings initiated against the complainant following a complaint filed by the Mayor of the Municipality alleging a crime under Article 640, paragraph 2, no. 1, of the Criminal Code, the Authority, as an employer, "could well have arranged appropriate medical examinations, as had already occurred in the past," also considering that "the reason for the illness resulting from the certificates produced [...] did not require the patient's hospitalization or confinement to her home."

The Municipality therefore implemented, through a video device, the unlawful processing of the personal data of the complainant and two employees, in a manner that did not comply with the principles of "lawfulness, fairness, and transparency" and lacked a legal basis, in violation of Articles 5, paragraph 1, letter a), and 6 of the Regulation.

Furthermore, under current legislation, employers are prohibited from processing information that is not relevant to the management of the employment relationship, given the risks of discrimination ordinarily associated with such processing. Therefore, by ordering the production of video footage of the complainant, in the company of colleagues, outside of the workplace, for use for disciplinary purposes, the Municipality also violated the prohibition on "conducting investigations, including through third parties, [...] into facts that are not relevant to the assessment of the worker's professional aptitude," pursuant to Article 8 of Law No. 300/1970, as well as Article 10 of Legislative Decree No. 276 of 10 September 2003, both expressly referenced in Article 113 of the Code. Nor could the treatment in question be considered necessary, given that there is a specific sector regulation which regulates, within a guarantee framework, the ways in which the employee can benefit from absence for health reasons and the information flows of which the employer is the recipient (see art. 55-septies, paragraph 2, of Legislative Decree 30 March 2001, n. 165; Prime Ministerial Decree referred to in art. 50, paragraph 5-bis, of Legislative Decree 30 September 2003, n. 269, converted, with amendments, by Law 24 November 2003, n. 326, introduced by art. 1, paragraph 810, of Law 27 December 2006, n. 296), attributing exclusively to the inspection offices of the competent social security institutions the activities of verifying the actual existence of a state of health of the employee. worker incompatible with work performance, through the system of medical check-ups (so-called medical check-ups) (see art. 5 of Law no. 300/1970, pursuant to which "assessments by the employer of the employee's suitability and infirmity due to illness or injury are prohibited. The control of absences due to illness can only be carried out through the inspection services of the competent social security institutions, which are required to carry them out when the employer requests it"; see already the "Guidelines on the processing of personal data of workers for the purposes of managing the employment relationship in the public sector", adopted with provision 14 June 2007, no. 23, web doc. no. 1417809, par. 8.2; see, most recently, provision 9 May 2024, no. 270, web doc. no. 10025870 and the further provisions referred to therein).

For these reasons, it must be concluded that the Municipality's conduct also violated Articles 88 of the Regulation and 113 of the Code (with reference to Article 8 of Law 300/1970).

4. Conclusions.

In light of the above considerations, it is noted that the statements made by the data controller during the investigation – the veracity of which may be held accountable pursuant to Article 168 of the Code – although worthy of consideration, do not address the concerns notified by the Office with the document initiating the proceedings and are insufficient to allow the dismissal of this proceeding. Furthermore, none of the cases provided for in Article 11 of the Guarantor Regulation No. 1/2019 apply.

Therefore, the Office's preliminary assessments are confirmed and the processing of personal data by the Municipality using video devices is found to be unlawful, in violation of Articles 5, paragraph 1, letters a) and b), 6, paragraph 1, letters c) and e), and paragraphs 2 and 3, 12, paragraph 1, 13, 35, and 88 of the Regulation, as well as Articles 2-ter, 113, and 114 of the Code.

The violations of the aforementioned provisions occurred as a result of two distinct conducts, which must be considered separately for sanctioning purposes: the first concerns the processing of personal data using video surveillance cameras located on public roads for alleged purposes attributable to the Municipality's institutional responsibilities, in violation of Articles 5, paragraph 1, letters a) and b), 6, paragraph 1, letters c) and e), and paragraphs 2 and 3, 12, paragraph 1, 13, 35, and 88 of the Code. 1, 13, and 35 of the Regulation, as well as Article 2-ter of the Code (see paragraphs 3.1-3.4 above); the second, which can be considered unitary (same processing or related processing), concerns the use of video devices in the workplace, including for disciplinary purposes, with violation of Articles 5, paragraph 1, letters a) and b), 6, paragraph 1, letter c), 12, paragraph 1, 13, 35, and 88 of the Regulation, as well as Articles 113 and 114 of the Code (see paragraphs 3.5 and 3.6 above).

For both conducts, Article 83, paragraph 3, of the Regulation applies, pursuant to which the total amount of the administrative pecuniary sanction does not exceed the amount specified for the most serious violation. Considering that, for both conducts, the most serious violations, relating to Articles 5, paragraph 1, letters a) and b), 6, letters c) and e), and paragraphs 2 and 3, 12, paragraph 1, 13, and 88 of the Regulation, as well as 2-ter, 113, and 114 of the Code, are subject to the penalty provided for by art. 83, paragraph 5, of the Regulation, as also referred to in art. 166, paragraph 2, of the Code, the total amount of each penalty is to be quantified up to €20,000,000.

In this context, considering, in any case, that the conduct has exhausted its effects—given that the Municipality, in its defense briefs, has stated that it has taken steps to remedy the contested violations, with respect to which the Authority reserves the right to conduct any further assessment, including through a separate investigation—the conditions for the adoption of further corrective measures pursuant to art. 58, paragraph 2, of the Regulation.

5. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letters i) and 83 of the Regulation; Article 166, paragraph 7, of the Code).

The Guarantor, pursuant to Articles 58, paragraph 2, letters i) and 83 of the Regulation as well as Article 166 of the Code, has the power to "impose a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] corrective measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each individual case." Within this framework, "the [Garante] Panel shall adopt the injunction order, by which it shall also order the application of the additional administrative sanction to be published, in full or in extract, on the Garante's website pursuant to Article 166, paragraph 7, of the Code" (Article 16, paragraph 1, of the Garante Regulation No. 1/2019).

The aforementioned pecuniary administrative sanction imposed, depending on the circumstances of each individual case, must be determined in amount taking due account of the factors set out in Article 83, paragraph 2, of the Regulation.

5.1 Conduct pertaining to the processing of personal data through video surveillance cameras located on public roads

Considering that:

The Municipality, on xx, despite the installation of two of the cameras comprising its system, had nevertheless entered into an implementation agreement with the territorially competent Prefecture, albeit without the necessary level of detail regarding the identification of the specific areas of the municipal territory to be subjected to video surveillance (Article 83, paragraph 2, letter a), of the Regulation);

The violation is negligent, having been committed as a result of incorrect legal assessments by the Entity (Article 83, paragraph 2, letter b), of the Regulation);

The processing did not involve sensitive data belonging to the special categories referred to in Article 9 of the Regulation (see Article 83, paragraph 2, letter g), of the Regulation), it is considered that, in this case, the level of severity of the violation committed by the data controller is medium (see European Data Protection Board, "Guidelines 4/2022 on the calculation of administrative pecuniary sanctions under the GDPR" of 24 May 2023, point 60).

That said, considering that the data controller is a small entity (approximately 7,200 inhabitants), and therefore has limited organizational and financial resources, it is believed that, for the purposes of quantifying the fine, the following circumstances should be taken into account:

The Municipality cooperated well with the Authority during the investigation (Article 83, paragraph 2, letter f), of the Regulation);

There are no previous relevant violations committed by the Municipality (Article 83, paragraph 2, letter e), of the Regulation).

Based on the above factors, assessed as a whole, it is deemed appropriate to set a fine of €5,000 (five thousand) for violation of Articles 5, paragraph 1, letter a), 6, paragraph 1, letters c) and e), and paragraphs 2 and 3, 12, paragraph 1, 13, and 35 of the Regulation, as well as Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83, paragraph 1, of the Regulation, to be effective, proportionate, and dissuasive.

It is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Italian Data Protection Authority No. 1/2019, this chapter containing the injunction order should be published on the Italian Data Protection Authority's website. This is due to the fact that the use of video surveillance cameras involved public spaces, resulting in the processing of personal data that "allows the detection of the presence and behavior of individuals in the space in question" ("Guidelines 3/2019 on the processing of personal data through video devices", paragraph 2.1, cited), without the data subjects being fully aware of the actual purpose of the processing and all the characteristics of the processing.

Finally, it is noted that the conditions set out in Article 17 of Regulation No. 1/2019 are met.

5.2 Conduct relating to the use of video devices in the workplace, including for disciplinary purposes

Considering that:

The violation, partly due to incorrect legal assessments by the Authority, has had significant repercussions on the complainant's personal and professional life, given that the images obtained from the video devices in question were used in disciplinary proceedings that resulted in dismissal without notice, even though the Municipality has maintained that the professional damage was substantially mitigated by certain supervening circumstances (Article 83, paragraph 2, letters a) and b), of the Regulation);

Even though the processing did not involve data belonging to the special categories referred to in Article 83, paragraph 2, letters b) and c), of the Regulation, 9 of the Regulation, which also resulted in an invasive form of control over the complainant's privacy. The complainant was filmed by the Municipality, along with several colleagues, outside of her workplace and during working hours, in the absence of any lawful grounds (see Article 83, paragraph 2, letters a) and g), of the Regulation). In this case, it is believed that the seriousness of the violation committed by the data controller is high (see European Data Protection Board, "Guidelines 4/2022 on the calculation of administrative fines under the GDPR" of 24 May 2023, point 60).

Given the above, considering that the data controller is a small entity (approximately 7,200 inhabitants) and therefore has limited organizational and financial resources, it is believed that, in determining the fine, the following circumstances should be taken into consideration:

The Municipality cooperated well with the Authority during the investigation (Article 83, paragraph 2, letter f), of the Regulation);

There are no previous relevant violations committed by the Municipality (Article 83, paragraph 2, letter e), of the Regulation).

Based on the above factors, assessed as a whole, it is deemed appropriate to determine the fine amount of €10,000 (ten thousand) for the violation of Articles 5, paragraph 1, letters a) and b), 6, paragraph 1, letter c), 12, paragraph 1, letter e), and 13, paragraph 2, letter f), of the Regulation. 1, 13, 35, and 88 of the Regulation, as well as Articles 113 and 114 of the Code, as an administrative pecuniary sanction deemed, pursuant to Article 83, paragraph 1, of the Regulation, to be effective, proportionate, and dissuasive.

It is also believed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Italian Data Protection Authority (Garante) No. 1/2019, this chapter containing the injunction order should be published on the Garante's website. This is in light of the fact that the processing carried out involved personal data relating to vulnerable data subjects in the workplace and, from a different perspective, also involved the license plate data of vehicles transiting within the municipal territory. This information is particularly sensitive, as its analysis can abstractly yield information regarding the data subjects' movements within the municipal territory.

Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 are met.

NOW THEREFORE, THE GUARANTOR

declares, pursuant to Article 57, paragraph 1, letter f), of the Regulation, the unlawfulness of the processing carried out by the Municipality of Curtarolo due to violation of Articles 5, paragraph 1, letters a) and b), 6, paragraph 1, letters c) and e), and paragraphs 2 and 3, 12, paragraph 1, 13, 35, and 88 of the Regulation, as well as Articles 2-ter, 113, and 114 of the Code, in accordance with the terms set out in the reasons;

ORDERS

to the Municipality of Curtarolo, represented by its legal representative pro tempore, with registered office at Via Gorizia, 2 - 35010 Curtarolo (PD), Fiscal Code 80009430283, to pay the total sum of €15,000 (fifteen thousand) as an administrative fine for the violations indicated in the grounds. It is hereby stated that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine;

ORDERS

the aforementioned Municipality, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, to pay the total sum of €15,000 (fifteen thousand) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981;

ORDERS

- pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Guarantor Regulation No. 1/2019, the publication of the injunction order on the Guarantor's website;

- pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Guarantor Regulation No. 1/2019, the publication of this provision on the Authority's website;

- pursuant to Article 17 of the Guarantor Regulation No. 1/2019, the recording of violations and measures adopted in accordance with Article 58, paragraph 2 of the Regulation in the Authority's internal register provided for by Article 57, paragraph 1, letter u) of the Regulation.

Pursuant to Articles 78 of the Regulation, 152 of the Code, and 10 of Legislative Decree No. 150/2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the provision itself, or within sixty days if the appellant resides abroad.

Rome, October 23, 2025

THE PRESIDENT
Stanzione

THE REPORTER
Cerrina Feroni

THE GENERAL SECRETARY
Fanizza

[web doc. no. 10196164]

Provision of October 23, 2025

Register of Provisions
no. 628 of November 23, 2025

THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, and Attorney Guido Scorza, members, and Angelo Fanizza, general secretary;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter "Regulation");

SEEN Legislative Decree no. 196 of 30 June 2003 196 of 30 April 2019, containing the "Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the "Code");