Difference between revisions of "Garante per la protezione dei dati personali (Italy) - 9746047"

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali (Italy) |DPA_Wi...")
 
m
Line 53: Line 53:
 
}}
 
}}
  
The Italian private club “Ruian” was fined € 2000 for having camaras pointing to the public sidewalk, without affixing any appropriate information sign.  
+
The Italian private club Ruian was fined € 2000 for having camaras pointing to the public sidewalk, without affixing any appropriate information sign.  
  
 
== English Summary ==
 
== English Summary ==
  
 
=== Facts ===
 
=== Facts ===
At the private club “Ruian” a video-surveillance system was in operation which did not comply with data protection regulations. Two of the external cameras had an angle
+
At the private club Ruian a video-surveillance system was in operation which did not comply with data protection regulations. Two of the external cameras had an angle of view oriented toward the sidewalk and roadway in front of the club.  
angle of view oriented toward the sidewalk and roadway in front of the club.  
 
  
 
=== Holding ===
 
=== Holding ===
The Italian DPA recalled that the use of video surveillance systems may result in the processing of personal data, depending on the positioning of the cameras and the quality of the images captured. This processing must be carried out in compliance with the general principles contained in art. 5 of the Regulation and, in particular, with the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-surveillance area". To this end, therefore, the data controller must affix appropriate information signs.  
+
The Italian DPA recalled that the use of video surveillance systems may result in the processing of personal data, depending on the positioning of the cameras and the quality of the images captured. This processing must be carried out in compliance with the general principles contained in art. 5 of GDPR and, in particular, with the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-surveillance area". To this end, therefore, the data controller must affix appropriate information signs.  
  
 
The processing of personal data carried out by the Club is, therefore, illicit since it is not carried out in accordance with the principles of "lawfulness, fairness and transparency", as well as "minimisation" of the data, in violation of art. 5(1)(a) and (c) and 13 GDPR.  
 
The processing of personal data carried out by the Club is, therefore, illicit since it is not carried out in accordance with the principles of "lawfulness, fairness and transparency", as well as "minimisation" of the data, in violation of art. 5(1)(a) and (c) and 13 GDPR.  

Revision as of 09:19, 22 February 2022

Garante per la protezione dei dati personali (Italy) - 9746047
LogoIT.png
Authority: Garante per la protezione dei dati personali (Italy)
Jurisdiction: Italy
Relevant Law: Article 5(1)(a) GDPR
Article 5(1)(c) GDPR
Article 13 GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published: 27.01.2022
Fine: 2000 EUR
Parties: Circolo Ruian
National Case Number/Name: 9746047
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Italian
Original Source: Garante (in IT)
Initial Contributor: n/a

The Italian private club Ruian was fined € 2000 for having camaras pointing to the public sidewalk, without affixing any appropriate information sign.

English Summary

Facts

At the private club Ruian a video-surveillance system was in operation which did not comply with data protection regulations. Two of the external cameras had an angle of view oriented toward the sidewalk and roadway in front of the club.

Holding

The Italian DPA recalled that the use of video surveillance systems may result in the processing of personal data, depending on the positioning of the cameras and the quality of the images captured. This processing must be carried out in compliance with the general principles contained in art. 5 of GDPR and, in particular, with the principle of transparency which presupposes that "the interested parties must always be informed that they are about to enter a video-surveillance area". To this end, therefore, the data controller must affix appropriate information signs.

The processing of personal data carried out by the Club is, therefore, illicit since it is not carried out in accordance with the principles of "lawfulness, fairness and transparency", as well as "minimisation" of the data, in violation of art. 5(1)(a) and (c) and 13 GDPR.

With the power conferred by article 58(2)(d) GDPR and in conformity with article 83(5), the Italian DPA imposed on the Ruian club an administrative fine of € 2000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web n. 9746047]
Injunction order against the “Ruian” cultural club - January 27, 2022
Record of measures
n. 20 of January 27, 2022
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei general secretary;
GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation");
GIVEN the legislative decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 on "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";
GIVEN the note of 10 July 2020 from the Municipality of Florence;
EXAMINED the documentation in deeds;
HAVING REGARD to the observations made by the Secretary General pursuant to art. 15 of the regulation of the Guarantor n. 1/2000;
RAPPORTEUR prof. Pasquale Stanzione;
WHEREAS
1. The assessment by the municipal police.
1.1. With the note of 10 July 2020, the Municipal Police of the Municipality of Florence communicated to this Authority that on 22 June 2020, it had carried out an inspection at the "Ruian" private club (hereinafter the "Club"), located in Florence, via San Biagio a Petriolo n. 34, following a report from the Florence Peretola Carabinieri Station. From the inspections carried out by the Urban Security and Heritage Department, it was ascertained that, at the Club, a video surveillance system that did not comply with the rules on the protection of personal data was functioning. In particular, the agents ascertained that the cameras, six placed inside the room and three outside and connected to an IT system inside the building, were not signaled by any sign containing the information and that two of the external cameras had a angle of view oriented towards the sidewalk and the carriageway in front of the Club, with the shot also turned, in one case, towards the facade of the Barracks of the Carabinieri Station next to the headquarters of the club.
1.2. The Office, on the basis of the findings of the investigations carried out, notified the Club (prot. No. 52501/21) the act of initiating the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of art. 5, par. 1, lett. a) and c) of the Regulations (angle of view not limited to the Club area) and art. 13 of the Regulations (absence of information).
The party did not send briefs or defensive writings (Article 18 of Law no. 689/1981).
2. The legal framework of the processing carried out
2.1. The use of video surveillance systems may result in the processing of personal data in relation to the positioning of the cameras and the quality of the images recorded. This treatment must be carried out in compliance with the general principles contained in art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "interested parties must always be informed that they are about to enter a video surveillance area".
For this purpose, therefore, the data controller must affix suitable information signs according to the indications contained in point 3.1. of the provision on video surveillance - April 8, 2010 [1712680] (in this sense also the Faq on video surveillance, published on the Authority's website).
Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "With regard to video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while the additional mandatory details can be provided by other means (second level). The guidelines also provide that "This information may be provided in combination with an icon to give, in a clearly visible, intelligible and clearly legible way, an overview of the treatment envisaged (Article 12, paragraph 7, of the GDPR) . The format of the information will have to adapt to the various locations ". The information should be positioned in such a way as to allow the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) "to allow the data subject to estimate which area is covered by a camera in so as to avoid surveillance or adapt one's behavior, where necessary ".
2.2. It is also necessary to consider that the need to use video surveillance to protect the legitimate interests of a holder stops at the borders of the areas of its own pertinence. Even in cases where it is necessary to extend video surveillance to the immediate vicinity of the pertinent area, the data controller must in any case implement suitable measures to prevent the video surveillance system from collecting data even beyond the relevant areas, possibly obscuring such areas (see in this regard Guidelines No. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 27).
3. The outcome of the investigation.
3.1. On the basis of the verification activities carried out and the subsequent assessments carried out by the Office, it is ascertained that the Club has carried out a processing of personal data, by means of a video surveillance system in violation of the general principles regarding the protection of personal data referred to to art. 5, par. 1, lett. a) and c) and in the absence of suitable information in disregard of the provisions of art. 13 of the Regulation.
It is up to the data controller, in this case to be identified in the Club, to evaluate the lawfulness of the same place in place through the video cameras and to inform the interested parties of the presence of the same, by affixing suitable notices bearing the information, from which it appears indication of the owner and the purposes of the processing.
The treatment must also be carried out in such a way as to limit the viewing angle to the area actually to be protected, avoiding, as far as possible, the recovery of surrounding places and details that are not relevant for the protection of the legitimate interest of the owner of the treatment (public spaces, other commercial establishments or public buildings unrelated to the activities of the owner, etc.).
3.2. The processing of personal data put in place by the Club is therefore illegal as it is carried out in a manner that does not comply with the principles of "lawfulness, correctness and transparency", as well as "minimization" of data, in violation of art. 5, par. 1, lett. a) and c) and art. 13 of the Regulation.
4. Order of injunction.
4.1. For the above, it is deemed necessary to order the Club, pursuant to art. 58, par. 2, lett. d), of the Regulations, the adoption of the necessary measures to ensure information to the interested parties and to limit the recovery to the areas of relevance only, as indicated in point 3.1 of this decision.
4.2. The Guarantor, pursuant to art. 58, par. 2, lett. i) of the Regulations and art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. Law of 24 November 1981 n. 689), in relation to the processing of personal data carried out by the party by means of the video surveillance system, in violation of art. . 5, par. 1, lett. a) and c) and art. 13 of the Regulation.
4.3. With reference to the elements listed in art. 83, par. 2, of the Regulation for the purpose of applying the pecuniary administrative sanction and its quantification, taking into account that the sanction must be "in each individual case effective, proportionate and dissuasive" (Article 83, par. 1 of the Regulation), that, in the present case, the following circumstances were taken into consideration:
with regard to the nature, severity and duration of the violation, the negligent conduct of the data controller was taken into consideration as well as the responsibility related to the non-fulfillment of the obligation to disclose the information to the interested parties;
the absence of specific precedents against the party relating to violations of the regulations on the protection of personal data;
the circumstance that the party did not cooperate with the Authority in the course of the proceedings, by not sending its own defensive writings.
4.4. Due to the aforementioned elements, assessed as a whole, it is believed to determine the amount of the financial penalty in the amount of € 2,000.00 (two thousand) for the violation of art. 5, par. 1, lett. a) and c) and art. 13 of the Regulation.
4.5. In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, this provision should be published on the Guarantor's website.
Finally, it is believed that the conditions set out in art. 17 of regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
WHEREAS, THE GUARANTOR
pursuant to art. 57, par. 1, lett. a) and 83 of the Regulations, declares the unlawfulness of the processing carried out by the "Ruian" cultural circle (p. IVA 07004590480), based in via San Biagio al Petriolo, 34 Florence, in the terms set out in the motivation, for the violation of articles 5, par. 1, lett. a) and c) and 13 of the Regulations;
INJUNCES
to the "Ruian" cultural club, pursuant to art. 58, par. 2, lett. d) of the Regulation:
a) to conform the treatments carried out through the video surveillance system by providing:
to provide information to interested parties by affixing suitable signs warning them of the presence of a video surveillance system;
to limit the recording of the cameras only to the areas of relevance, as indicated in point 3.1 of this decision.
b) to pay the sum of € 2,000.00 (two thousand), according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the l. n. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, the offender has the right to settle the dispute by paying - again in the manner indicated in the annex - of an amount equal to half of the sanction imposed within the term referred to in art. 10, paragraph 3, of the d. lgs. n. 150 of 1 September 2011 envisaged for the filing of the appeal as indicated below;
ORDER
pursuant to art. 58, par. 2, lett. i) of the Regulations to the “Ruian” cultural club, to pay the sum of 2,000.00 (two thousand) euros as a pecuniary administrative sanction for the violations indicated in this provision;
HAS
pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, the publication of this provision on the website of the Guarantor and believes that the conditions set out in art. 17 of regulation no. 1/2019.
It requests the "Ruian" cultural club to communicate which initiatives have been undertaken in order to implement the provisions of this provision and to provide, in any case, adequately documented feedback pursuant to art. 157 of the Code, within 45 days from the date of notification of this provision; any non-response may result in the application of the administrative sanction provided for by art. 83, par. 5, lett. e) of the Regulations.
Pursuant to art. 78 of the Regulation, of art. 152 of the Code and 10 of the legislative decree 1 September 2011, n. 150, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.
Rome, January 27, 2022
PRESIDENT
Stanzione
THE RAPPORTEUR
Stanzione
THE SECRETARY GENERAL
Mattei