Garante per la protezione dei dati personali (Italy) - 9794895: Difference between revisions

From GDPRhub
No edit summary
No edit summary
Line 82: Line 82:


=== Holding ===
=== Holding ===
As a preliminary note, the DPA considered that the GDPR applied in full to the processing, since it concerned administrative proceedings in environmental matters, as opposed to a criminal investigation.
The DPA noted that the information on the sign's notifying people of video-surveillance was outdated. They referred to old legislation and lacked information on data subject's rights. There was also no additional information on these rights on the controller's website. The DPA therefore held that the controller violated the principle of lawfulness, fairness and transparency laid down in [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]], as well as Article 12 and 13 GDPR.
The DPA noted that the information on the sign's notifying people of video-surveillance was outdated. They referred to old legislation and lacked information on data subject's rights. There was also no additional information on these rights on the controller's website. The DPA therefore held that the controller violated the principle of lawfulness, fairness and transparency laid down in [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]], as well as Article 12 and 13 GDPR.


In addition, the DPA found that the controller failed to set time limits for the storage of the images, as there were still available after two months. The DPA stated that such surveillance footage should be deleted after a few days. Therefore, the controller violated the principles of storage limitation and accountability, as laid down in Article 5(1)(e) and 5(c) GDPR read in conjunction with [[Article 24 GDPR|Article 24 GDPR]].
In addition, the DPA found that the controller failed to set time limits for the storage of the images, as there were still available after two months. The DPA stated that in most cases surveillance footage should be deleted after a few days, preferably automatically. The longer the envisaged retention period (especially if it exceeds 72 hours), the more reasoned the controller's need for retention must be. Therefore, the controller violated the principles of storage limitation and accountability, as laid down in Article 5(1)(e) and 5(2) GDPR read in conjunction with [[Article 24 GDPR]].
 
DPO
 
It should also be pointed out that the complainant, from his perspective, as a result of the mandate received by the DPO, could no longer turn to the DPO (see Article 13(1)(b) of the Regulation), relying on his impartiality in the performance of his duties
 
according to which data subjects may contact the DPO for all matters relating to the processing of their personal data and for the exercise of their rights
 
In view of the foregoing, the Municipality, by entrusting to the DPO designated by it its defence in the proceedings in question, placed the DPO in a position of conflict of interest, in breach of Article 38(6) GDPR.
 
As well as by placing its DPO in a position of conflict of interest, in breach of Articles 5(1)(a) and (e) and (2) (read in conjunction with Article 24), 12, 13 and 38(6) of the Regulation
 
 
 


Lastly, the DPA held that the Municipality, by entrusting to the DPO designated by it its defence in the proceedings in question, placed the DPO in a position of conflict of interest, in breach of Article 38(6) GDPR. This also led to the data subject feeling unable to contact the DPO with regard to all issues related to processing of their personal data and to the exercise of their rights under Article 38(4) GDPR. The DPA stressed that it was also just the appearance of a conflict of interest that was important to take into account, regardless of the actual decision taken.
== Comment ==
== Comment ==
''Share your comments here!''
''Share your comments here!''

Revision as of 07:51, 13 September 2022

Garante per la protezione dei dati personali - 9794895
LogoIT.png
Authority: Garante per la protezione dei dati personali (Italy)
Jurisdiction: Italy
Relevant Law: Article 5(1)(a) GDPR
Article 5(1)(c) GDPR
Article 5(1)(e) GDPR
Article 13 GDPR
Article 14 GDPR
Article 24 GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 09.06.2022
Published:
Fine: 20,000 EUR
Parties: Municipality of Policoro
National Case Number/Name: 9794895
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Italian
Original Source: Garante (in IT)
Initial Contributor: Jette

.

English Summary

Facts

The data subject was fined for littering by the Municipality of Policoro (controller). He received surveillance footage as proof. However, alleged littering would have occurred several weeks ago. The data subject found this retention period to be excessive.

The data subject therefore filed a complaint with the Italian DPA for the use of video-surveillance systems in violation of the GDPR. He also stated that the sign's that contained information on the video-surveillance were insufficient. Furthermore, he stated that the minutes on the violation he received from the controller lacked information required by Article 13 and 14 GDPR. More specifically, about the purpose of the investigation carried out. Lastly, he argued that there was a conflict of interest with the controller's DPO. In a separate court case on the littering violations, the DPO acted as the controller's lawyer.

Holding

As a preliminary note, the DPA considered that the GDPR applied in full to the processing, since it concerned administrative proceedings in environmental matters, as opposed to a criminal investigation.

The DPA noted that the information on the sign's notifying people of video-surveillance was outdated. They referred to old legislation and lacked information on data subject's rights. There was also no additional information on these rights on the controller's website. The DPA therefore held that the controller violated the principle of lawfulness, fairness and transparency laid down in Article 5(1)(a) GDPR, as well as Article 12 and 13 GDPR.

In addition, the DPA found that the controller failed to set time limits for the storage of the images, as there were still available after two months. The DPA stated that in most cases surveillance footage should be deleted after a few days, preferably automatically. The longer the envisaged retention period (especially if it exceeds 72 hours), the more reasoned the controller's need for retention must be. Therefore, the controller violated the principles of storage limitation and accountability, as laid down in Article 5(1)(e) and 5(2) GDPR read in conjunction with Article 24 GDPR.

Lastly, the DPA held that the Municipality, by entrusting to the DPO designated by it its defence in the proceedings in question, placed the DPO in a position of conflict of interest, in breach of Article 38(6) GDPR. This also led to the data subject feeling unable to contact the DPO with regard to all issues related to processing of their personal data and to the exercise of their rights under Article 38(4) GDPR. The DPA stressed that it was also just the appearance of a conflict of interest that was important to take into account, regardless of the actual decision taken.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web n. 9794895]

Injunction order against the Municipality of Policoro - 9 June 2022

Record of measures
n. 214 of 9 June 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC, "General Data Protection Regulation" (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196, "Code regarding the protection of personal data", as amended by Legislative Decree 10 August 2018, n. 101, containing provisions for the adaptation of national law to the Regulation (hereinafter the "Code");

GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution no. 98 of 4 April 2019, published in the Official Gazette n. 106 of 8 May 2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter "Regulation of the Guarantor no. 1/2019");

HAVING REGARD to the documentation on file;

GIVEN the observations of the Office made by the Secretary General pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and operation of the office of the Guarantor for the protection of personal data, in www.gpdp.it, doc. web n. 1098801;

SPEAKER Attorney Guido Scorza;

1. Introduction.

With complaint of the XX, submitted pursuant to art. 77 of the Regulation, it was complained that the Municipality of Policoro (hereinafter, the "Municipality") would have used a video surveillance system in violation of the regulations on the protection of personal data.

In particular, the complainant stated that he had received three assessment reports, with which administrative sanctions were imposed for having "abandoned solid urban waste" on XX, XX and XX dates. The ascertainment of the violations, by viewing the video surveillance images, would have, however, occurred respectively on the date XX (i.e. 82 days after the date of recording of the images), XX (i.e. 79 days after the date of recording of the images) and XX (i.e. 64 days after the date the images were recorded).

The complainant also complained about the unsuitable installation of the signs containing the simplified information on video surveillance, as well as the non-compliance of the information contained in the minutes notified to him by the Municipality, as "lacking the content required by Articles 13 and 14 of the Regulation [and characterized by generality with regard to] the specific purpose of the assessment carried out ".

Lastly, the complainant stated that he had "proceeded to lodge three distinct judgments before the Pisticci Justice of the Peace Office [...], with which, opposing the sanctions imposed [by the Municipality], he contested the unlawful acquisition and use of personal data and requested that the Administration be sentenced to pay damages ". As part of these judgments, the Municipality would be constituted with the patronage of a lawyer who is also the Data Protection Officer ("DPO") of the Municipality. For this reason, a situation of "incompatibility between the [DPO] and the defense office of the Municipality was complained, taking into account that the [DPO] intervened in a proceeding in which illegality in the processing of data was highlighted".

2. The preliminary activity.

In response to a request for information from the Guarantor of the XX (prot. No. XX), the Municipality, with a note of the XX (prot. No. XX), stated, in particular, that:

“The disputed facts constitute […] administrative offenses for express violation of the municipal regulation of urban hygiene; [consequently], the envisaged discipline is that of […] Law no. 689/1981 ";

"With regard to the retention of data on the assumption of a retention period of more than 7 days, it is believed that in the event of filming carried out in the course of investigations by the judicial police, the discipline changes. The processing of data in the activities of p.g., in fact, at a European level does not fall within the scope of the [Regulation], but of Directive 2016/680 [...] [and of] Legislative Decree 51/2018 […] [; therefore,] in the course of investigations by p.g. that make use of the use of camera traps, the images must be kept for the time prescribed by art. 10 of the Presidential Decree n. 15 of 15.01.2018, which distinguishes different periods for different types of offense [...] ";

"For the storage of waste, in point 5.2 of the provision [of the Guarantor on video surveillance of 2010], the Guarantor admits the use of video surveillance systems only in the event of ineffectiveness or impossibility of alternative systems and both as regards the provisions sanctioned administratively and for those of a criminal nature ";

"With regard to the privacy information by means of a computer sign, unlike what is claimed [in the complaint], the acquisition of the data is legitimate having prescribed a legitimate placement of the information, according to the dictates of the Municipal Council resolution no. XX of the XX ";

"The case envisaged is characterized by the minimum disclosure by means of an information sign and by the disclosure attached to the minutes that allows for the necessary information [...]";

"[...] there is no [...] any form of conflict of interest [, as the] object of the judgment concerned only the opposition to an administrative sanction governed by Law no. 689/1981 and […] no consideration could have in court problems relating [to] the protection of personal data […] since the sanctioning system in force is subject to the discipline of Law no. 689/1981, with the effect, therefore, that the judgment could not absolutely "touch data protection issues";

"We proceeded to formalize the mandate ad litem [to the lawyer, who] proceeded to defend the Entity on the basis of the only preliminary question posed on the basis of the erroneous appeal before the Justice of the Peace of Pisticci for not having the then appellant settled the matter in the ways and terms set forth in the discipline of the aforementioned Law no. 689/1981 ";

"The acts based on the defense concerned exclusively and solely the preliminary objection of the inadmissibility and inadmissibility of the appeal for the reasons highlighted above, also because, among other things, the Justice of the Peace is incompetent on the matter to instruct and decide on issues relating to problems relating [to] the matter of privacy ";

"The prosecutors [...] limited themselves exclusively to taking a position and deciding only on the ascertained inadmissibility of the proposed appeal because the transgressor, following the notification of the report in question, given the matter of the administrative violation, would have had to follow the regulations concerning the system of sanctions provided for by Law no. 689/1981 ".

With a note of the XX (prot. No. XX), the Office, on the basis of the elements acquired, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, par. 2, of the Regulations, inviting the aforementioned holder to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (Article 166, paragraphs 6 and 7, of the Code; as well as Article 18, paragraph 1, of Law no. . 689 of 11/24/1981). With the aforementioned note, the Office found that the Municipality has put in place the processing of personal data through video devices in a manner that does not comply with the principles of "lawfulness, correctness and transparency", "conservation limitation" and "accountability", by providing information on the processing of personal data of the first level that is not suitable and by failing to provide information on the processing of personal data of the second level, as well as by placing their DPO in a position of conflict of interest, in violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13, and 38, par. 6, of the Regulation.

With a note of the XX (prot.n.XX), the Municipality sent its defense writings in relation to the notified violations to the Guarantor, declaring, in particular, that:

"The XXth Report [...] of the Local Police Command, [...] highlights [...] that the Local Police, in addition to performing administrative police functions, also performs judicial police functions";

“By order of the Local Police Command […] n. 2 local police officers performing judicial police functions pursuant to art. 57 c.p.p. Not only that, but with the minutes of the appointment of the twentieth to prot. N. XX, the Officers of p.g. of the local Police Headquarters appointed as auxiliary to p.g. Mr. […] for the supply and installation, assistance and maintenance of n. 4 fixed / mobile cameras for video surveillance aimed at controlling illegal landfills in the municipal area, with the express task of acquiring the images and developing the material useful for the further investigations of p.g. by the proceeding Local Police ";

"Therefore, the full legitimacy of the data processing in relation to the retention period beyond seven days from the detection of the data is clearly evident, given that in the course of investigations by p.g., the discipline does not fall within the scope of the GDPR, but in directive 2016/680, then implemented with Legislative Decree 51/2018, which concerns the processing of data carried out by public authorities for the purposes of prevention, investigation, detection and prosecution of crimes or execution of criminal sanctions ";

"In the course of investigations by p.g. who make use of the use of camera traps, - the information can be omitted (Point 3.1.1 of the Provision of the Guarantor of 8 April 2010) ";

"The person in charge (ie, the person who physically carries out the data processing operations) must necessarily hold the qualification referred to in art. 57 c.p.p .. ";

"The images must be kept for the time prescribed by art. 10 of the Presidential Decree n. 15 of 15.01.2018, which distinguishes different periods for different types of crime (moreover, even in the case of ascertained administrative offenses, the images must be kept after the 7-day term referred to above, as they enter another procedure). Among other things, it should be noted that the applicable discipline is that of administrative sanctions pursuant to Law no. 689/1981, which in mind of art. 14 regulates the term of ninety days to propose the appeal which runs from the date of the detection / ascertainment of the data, as extrapolated and stored until the definition of the procedure to allow the right of defense in the cross-examination between the parties ";

"In consideration of the storage times dictated by art. 10 of the Presidential Decree n. 15 of 15.01.2018 [...], as well as the 90 days to propose the appeal provided for by art. 14 of Law no. 689/1981 […] it is possible to state that the retention times of both cases are higher than the 82 days contested [by the Guarantor] ”;

“With City Council Resolution no. XX of the XX, the Entity provided for the obligation to provide specific information [, it being understood that] in the course of investigations by p.g. who make use of the use of camera traps, the information can be omitted [...] ";

the complainant ", as already claimed in the XXth notes, referred to the Office of the Justice of the Peace to challenge the report against the administrative sanction, calling it" Appeal against administrative sanction "without any mention of the matter of privacy";

"The mention" for violation of the privacy rules "(Sentences n.XX and n.XX) constitutes the reconstruction of the requests [of the appellant] reported in the part dedicated to the fact, since then, and what is more relevant, in the dedicated part to the law, which belongs to the magistrate, there is no mention of the matter of privacy, given that the judgment could not absolutely “touch data protection issues”;

"The mere fact that in the judgments in question [the complainant] had raised objections regarding compliance with the legislation on the protection of personal data does not in any way lead to a situation of conflict of interest [of the DPO]";

"The Entity has taken steps to examine the entire context and the elements available and in the light of the incorrect approach of the then appellant, has proceeded to appoint the lawyer […] For the purposes of legal representation so that reasons relating to the inadmissibility may arise […] ";

"[...] the inadmissibility of the appeal, we read in the three Sentences, concerns the incorrect application [...] of the legislation relating [to] the administrative sanctions referred to in Law no. concerning the matter of the protection of personal data […] The inadmissibility of the appeals already presented at first reading was all too evident […] ”;

"Attorney [...] obtained a favorable ruling of inadmissibility but this does not mean that the same, as a DPO, would not have hesitated to bring the issues relating [to] any violations in privacy matters to the attention of the data controller if they were manifested ".
On the 20th, the hearing required pursuant to art. 166, paragraph 6, of the Code, during which the Municipality declared, in particular, the following:

"The Administration has acted at the service of the territory and the defense of the environment, to counteract the phenomenon of illegal waste abandonment, using the so-called camera traps as a deterrent. The Administration has therefore acted in absolute good faith for the pursuit of the public interest, as well as to protect the reputation of the Body itself, whose image is harmed by the phenomenon of illegal waste abandonment ";

"The choice to give a mandate to the DPO to represent the Municipality in court was also dictated by the need to optimize the Administration's resources, believing in good faith [...] that this choice could not give rise to a conflict of interest. This is because, otherwise, the Municipality would have had to appoint a third party, with a further increase in costs ";

"The defense of the Entity was set upstream by the Administration itself (or by the Local Police Command and by the officials and managers in charge). The attorney in charge, as an external, limited himself to representing this position in court [...] ";

"In any case, the Guidelines of the European Committee on the figure of the DPO assume a conflict of interest when, in the context of the defense in court, profiles regarding the protection of personal data are" touched ", a circumstance that does not exist in this case . Furthermore, there are no judicial decisions that have dealt with this specific type of conflict of interest ";

"With regard to the fulfillment of disclosure obligations, it should be noted that the Guidelines of the European Committee were published shortly before the facts of the complaint. In any case, it is reiterated that the local police acted by exercising their judicial police functions (despite not having received a specific assignment from the judicial authority) and, therefore, the information on the processing of personal data could also be of the all omitted ".

3. Outcome of the preliminary investigation.

3.1 The correctness and transparency of the processing: the information.

The processing of personal data by means of video surveillance systems by public subjects is generally allowed if it is necessary to fulfill a legal obligation to which the data controller is subject or for the execution of a task of public interest or connected to the exercise. of public powers vested in the same (art. 6, par. 1, lett. c) and e), and 3, of the Regulation, as well as 2-ter of the Code; cf. par. 41 of the "Guidelines 3/2019 on the processing of personal data through video devices", adopted by the European Data Protection Committee on XX). In this context, it is noted that waste management is one of the institutional activities entrusted to local authorities.

The data controller is, in any case, required to comply with the principles of data protection pursuant to art. 5 of the Regulation, including that of "lawfulness, correctness and transparency" (Article 5, paragraph 1, letter a), of the Regulation), according to which the data controller must take appropriate measures to provide interested all the information referred to in Articles. 13 and 14 of the Regulations in a concise, transparent, intelligible and easily accessible form, with simple and clear language (see Article 12 of the Regulations).

When video surveillance systems are used, the data controller, in addition to making the first level information, by affixing warning signs near the area subject to video surveillance, must also provide the interested parties with "second level information", which must "contain all the mandatory elements pursuant to Article 13 of the [Regulation]" and "be easily accessible for the interested party" ("Guidelines 3/2019 on the processing of personal data through video devices", cit., in particular par. 7; but see already the "Provision on video surveillance" of the Guarantor of 8 April 2010, web doc. n. 1712680, in particular par. 3.1; see also the FAQ n. 4 of the Guarantor regarding video surveillance, web doc. 9496574).

The first level information (warning sign) "should communicate the most important data, for example the purposes of the processing, the identity of the data controller and the existence of the rights of the data subject, together with information on the most significant impacts of the processing "(" Guidelines 3/2019 on the processing of personal data through video devices ", cit., par. 114). In addition, the signs must also contain information that may be unexpected for the person concerned. This could be, for example, the transmission of data to third parties, in particular if located outside the EU, and the retention period. If this information is not indicated, the interested party should be able to trust that there is only real-time surveillance (without any data recording or transmission to third parties) (ibidem, cit., Par. 115). The first level warning signs must also contain a clear reference to the second level of information, for example by indicating a website on which the text of the extended information can be consulted.

During the investigation, the Municipality stated that in the vicinity of the areas in which the so-called camera traps the information sign provided by the Municipal Council Resolution n. XX of the XX. This information sign takes up the model indicated by the Guarantor within the previous regulatory framework for the protection of personal data (see Annex 1 to the "Provision on video surveillance" of 8 April 2010, cit.).

In this regard, it should be noted that the reference, made in the cartel used by the Municipality (as well as in the information reported at the bottom of the report no. XX notified to the complainant), is incorrect - as it is no longer current - to art. . 13 of the Code, which was repealed by Legislative Decree 10 August 2018, n. 101.

Furthermore, this cartel, which is, moreover, devoid of references to the rights of the interested parties, does not indicate the ways in which the interested parties (i.e. not only the subjects to whom an administrative violation is contested, but all the natural persons who enter the range action of the camera traps) can receive a complete information on the second level treatment (see par. 117-119 of the "Guidelines 3/2019 on the processing of personal data through video devices), cit.).

Nor does it emerge from the documents that the Municipality has drawn up this second level information and brought it to the attention of the interested parties, for example by publishing it on the institutional website of the Municipality.

As for the defense proposed by the Municipality, on the basis of which the information on the processing of personal data is not in any case due, given that the treatments in question were carried out in the context of judicial police activities (with consequent application of Legislative Decree no. lgs. 18 May 2018, n. 51), it is noted that the Municipality has accused the complainant of certain administrative violations for "unlawful delivery of waste". It follows that the Municipality processes personal data, through video devices, "for the performance of a task of public interest or connected to the exercise of public authority vested in the data controller" (Article 6, paragraph 1, letter e) of the Regulation), or to ascertain conduct that is sanctioned primarily by administrative means (see articles 192, "abandonment ban", and 255, "abandonment of waste", of Legislative Decree 3 April 2006, 152; article 13 of the law of 24 November 1981, no. 689).

These treatments are, therefore, completely unrelated to the activities of public security and judicial police, which the local police can carry out, in any case, only in a limited form and under certain conditions (see articles 3 and 5 of the law 7 March 1986, no. 65). Therefore, they fully fall within the scope of application of the Regulations and the Code, also with regard to the obligation for the data controller to provide data subjects with information on the processing of personal data.

On the other hand, as stated by the Municipality at the hearing, the same had not received any assignment from the judicial authority, preventing this circumstance in itself from tracing the processing of personal data in question to the scope of police activities. judicial.

In light of the foregoing considerations, the Municipality has processed personal data through video devices, providing data subjects with an unsuitable information on the processing of first-level personal data and failing to provide information on the processing of second-level personal data, in a manner that does not comply with the principle of "lawfulness, correctness and transparency" and in violation of Articles 5, par. 1, lett. a), 12 and 13 of the Regulation.

3.2 The principles of "conservation limitation" and "accountability".

Pursuant to art. 5, par. 1, lett. e), of the Regulation, personal data must be "stored in a form that allows identification of the data subjects for a period of time not exceeding the achievement of the purposes for which they are processed" ("conservation limitation") ".

On the basis of the principle of accountability (articles 5, paragraph 2, and 24 of the Regulation), it is up to the data controller to identify the retention times of the images, taking into account the context and purposes of the processing, as well as the risk for rights. and the freedoms of individuals; this unless specific legal provisions expressly provide for specific data retention times.

Even with regard to the processing of personal data carried out by means of video surveillance systems, the recorded images cannot be kept longer than necessary for the purposes for which they were acquired. In particular, “personal data should be - in most cases (for example if video surveillance is used to detect vandalism) - deleted after a few days, preferably through automatic mechanisms. The longer the envisaged retention period (especially if it exceeds 72 hours), the more reasoned must be the analysis referring to the legitimacy of the purpose and the need for conservation "(FAQ n. 5 of the Guarantor on video surveillance, cit ., which incorporates the information provided in the "Guidelines 3/2019 on the processing of personal data through video devices", cit., par. 121).

During the investigation, it emerged that the Municipality has not set the maximum retention times for the images taken through the so-called camera traps for the purpose of combating the phenomenon of illegal waste abandonment and, consequently, with regard to the case subject to the complaint, it proceeded to ascertain administrative violations in more than two months from the date of registration of the images.

Also in relation to this profile, the Municipality argued that the processing of personal data carried out by it would be attributable to judicial police activities, with the consequent application of Legislative Decree 18 May 2018, n. 51. These theses cannot, however, be accepted, as the above considerations regarding the full application of the provisions of the Regulation and the Code to the processing of personal data carried out by the Municipality for the purpose of ascertaining administrative violations are valid. in environmental matters.

Consequently, in view of the principle of accountability and in compliance with the conservation limitation principle, the Municipality should have defined the maximum retention terms for video surveillance images for each processing purpose pursued, adequately motivating the choices made in this regard.

Therefore, the Municipality has processed personal data through video devices in a manner that does not comply with the principles of "conservation limitation" and "accountability", in violation of Articles 5, par. 1, lett. e), and par. 2 (in conjunction with art. 24) of the Regulation.

3.3 The conflict of interest of the Data Protection Officer.

With regard to the figure of the DPO, the legislation on data protection provides that the designation of the same is always due by public entities (Article 37, paragraph 1, letter a), of the Regulation).

As regards the position of the DPO, art. 38, par. 6, of the Regulation provides that the same "[may] perform other tasks and functions", it being understood that "the data controller [must ensure] that such tasks and functions do not give rise to a conflict of interest".

With regard to this profile, the "Guidelines on data protection officers", adopted by the European Data Protection Committee on 13 December 2016, as amended and adopted on 5 April 2017, highlight that "a conflict of interests if, for example, an external DPO is asked to represent the owner or manager in a judgment that touches on data protection issues "(par. 3.5).

In the present case, the complainant stated that he had "filed three distinct judgments before the Office of the Justice of the Peace (R.G. XX; XX and XX), with which, opposing the sanctions imposed, he contested the unlawful acquisition and use of personal data and requested that the Administration be sentenced to pay damages […] ”.

From sentence no. XX of the XX of the Office of the Justice of the Peace of Pisticci, on record, it emerges that "with an appeal filed on XX [the complainant] lodged an opposition against the report no. XX drawn up on XX by the Local Police of the Municipality of Policoro and notified on XX [...] ", asking" [the judicial authority] the annulment of the contested report with the victory of expenses; the condemnation of the defendant to the reimbursement of the damages suffered in the amount of € […], or of that smaller or greater sum deemed to be of justice, for violation of the rules on privacy ".

Similarly, from sentence no. XX, in the records, it appears that "the appellant disputes the report [as the same] lacks essential data, [and as there is] violation of the privacy regulations, illegitimate adoption of video surveillance".

In the judgments in question, originating from appeals in which exceptions were raised also regarding compliance with the legislation on the protection of personal data, the Municipality was, therefore, represented and defended by a lawyer who held the role of DPO of the Entity .

This, as clarified by the European Committee for the protection of personal data in the “Guidelines on data protection officers”, cited above, has given rise to a situation of conflict of interest.

The circumstance that, as declared by the Municipality, the judicial authority has declared the appeals inadmissible, due to lack of jurisdiction, is not, in this regard, conclusive, given that the Municipality was, in any case, represented by its DPO in judgments. within which the complainant had raised exceptions regarding compliance with the legislation on the protection of personal data. In this regard, it must be considered that, when the Municipality entrusted its defense to the DPO, it could not predict the outcome of the trial, being, therefore, abstractly possible for the judge to declare his competence and to pronounce in the merit, even incidentally, on issues relating to the protection of personal data.

Furthermore, given that the DPO, as the Entity's lawyer, shared with the latter the interest in obtaining the rejection of the appeals, he was to be considered, from the date of the assignment of the assignment to defend the Entity, in a position of conflict of interest. Where, in fact, in the performance of its duties, and in particular the task of "supervising [...] the [...] Regulation, other provisions or of the Union or of the Member States relating to data protection as well as the policies of the owner of the processing [...] regarding the protection of personal data "(Article 39, paragraph 1, letter b) of the Regulation), with specific reference to the processing of personal data carried out through the video devices in question, the DPO had detected violations of the legislation on data protection, he could not have brought them to the attention of the data controller without, at the same time, prejudicing the procedural position of the Entity and its own interest, as legal, to obtain a favorable ruling by the court appointed by the complainant. Conversely, any assessments made by the same subject, as legal, in order to support the lawfulness of the processing in court, could have compromised the autonomy of judgment and the position of independence that the same, as a DPO, is required to ensure.

Precisely in light of these considerations, the Guarantor, in the "Guidance document on the designation, position and duties of the Data Protection Officer (RPD) in the public sphere", attached to the provision. 29 April 2021, n. 186, doc. web n. 9589104, has expressly drawn the attention of public subjects "to the fact that it is difficult to predict a priori that a legal dispute cannot also involve personal data protection profiles", inviting them "to designate a DPO who, at the same time, does not carry out for them the role of defender in court "(par. 10.3).

It should also be noted that the complainant, from his perspective, as a consequence of the mandate received from the DPO, was no longer able to contact him (see Article 13, paragraph 1, letter b) of the Regulation), trusting in his impartiality in the performance of their duties, as the provision pursuant to art. 38, par. 4, of the Regulation, according to which interested parties can contact the DPO for all matters relating to the processing of their personal data and for the exercise of their rights such as, for example, those of access, cancellation or limitation (respectively, articles 15 , 17 and 18 of the Regulation). Also in relation to this profile, the Guarantor pointed out that "in the eyes of the interested party who wants to contact the DPO, the fact that he is also the legal defender of the entity at the same time undermines his independence. Therefore, regardless of the circumstances that may actually arise - such as, for example, as to exclude that the judgment involved issues of protection of personal data - all public administrations have been invited to designate a DPO who, at the same time, does not carry out for them the role of defender in court "(" Guidance document on the designation, position and duties of the Data Protection Officer (DPO) in the public sphere ", cit., par. 10.3).

By reason of the above, the Municipality, entrusting the DPO designated by it with its defense in the judgments in question, has placed the same in a position of conflict of interest, in violation of art. 38, par. 6, of the Regulation.

4. Conclusions.

In light of the aforementioned assessments, it is noted that the statements made by the data controller in the defensive writings ˗ the truthfulness of which one may be called to answer pursuant to art. 168 of the Code ˗ although deserving of consideration, they do not allow to overcome the findings notified by the Office with the act of initiation of the procedure and are insufficient to allow the filing of this procedure, however, none of the cases provided for by the art. 11 of the Guarantor Regulation n. 1/2019.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by the Municipality is noted, for having carried out processing of personal data through video devices in a manner that does not comply with the principles of "lawfulness, correctness and transparency "," retention limitation "and" accountability ", providing information on the processing of first-level personal data that is not suitable and failing to provide information on the processing of second-level personal data, as well as putting one's DPO in a position of conflict of interest, in violation of art. 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulation.

The violation of the aforementioned provisions makes the administrative sanction provided for by art. 83, par. 5, of the Regulation, pursuant to art. 58, par. 2, lett. i), and 83, par. 3, of the same Regulation.

5. Corrective measures (art. 58, par. 2, letter d), of the Regulation).

The unlawful conduct carried out by the Municipality has not completely exhausted its effects, as, to date, the same has not demonstrated that it has provided the interested parties with appropriate information on the processing of first-level personal data and information on the processing of second-level personal data, as well as having set the maximum retention times for images shot using video devices.

It is therefore considered necessary, pursuant to art. 58, par. 2, lett. d), of the Regulations, to order the Municipality, within thirty days of notification of this provision, to:

identify the maximum retention times of the images on the basis of the purposes pursued with the aforementioned video surveillance system (Article 5, paragraph 1, letter e), and par. 2, in conjunction with art. 24, of the Regulation);

provide interested parties with appropriate information on the processing of first-level personal data and information on the processing of second-level personal data (Articles 5, paragraph 1, letter a), 12 and 13 of the Regulation).

Pursuant to art. 157 of the Code, the Municipality will have to communicate to this Authority what initiatives have been undertaken in order to implement the provisions of this provision, and in any case to provide adequately documented feedback, within thirty days of notification of this provision.

6. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (articles 58, par. 2, lett. I and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The Guarantor, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations as well as art. 166 of the Code, has the power to "inflict a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or instead of such measures, depending on the circumstances of each single case "and, in this context," the College [of the Guarantor] adopts the injunction order, with which it also disposes with regard to the application of the ancillary administrative sanction of its publication, in whole or in excerpt, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code "(Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).

In this regard, taking into account art. 83, par. 3, of the Regulation, in the present case - also considering the reference contained in art. 166, paragraph 2, of the Code - the violation of the aforementioned provisions is subject to the application of the same administrative fine provided for by art. 83, par. 5, of the Regulation.

The aforementioned administrative fine imposed, depending on the circumstances of each individual case, must be determined in the amount taking into account the elements provided for by art. 83, par. 2, of the Regulation.

In relation to the aforementioned elements, it was considered that since 2004 the Guarantor has provided information to the data controllers with regard to the need to duly inform the data subjects about the processing of personal data through video devices and the need to define the maximum retention times. of the recorded images (see the General Provision on video surveillance of 29 April 2004, web doc. n. 1003482, paragraphs 3.1 and 3.4). It was also considered that the processing of personal data in question affected not only the complainant, but all other citizens who have passed through the areas subject to video surveillance. As for the violation profiles that concerned the DPO, it was taken into account that, as declared by the Municipality, the defense in court of the Municipality was conferred on the DPO in order not to incur an "increase in costs", which would have resulted from assignment of the mandate to a third party (see Article 83, paragraph 2, letter k), of the Regulation).

On the other hand, it should be noted that there are no previous violations committed by the data controller or previous provisions pursuant to art. 58 of the Regulation.

Due to the aforementioned elements, assessed as a whole, and considering that the Municipality falls within the demographic dimension of less than 20,000 inhabitants, it is considered to determine the amount of the financial penalty, in the amount of 26,000 (twenty-six thousand) euros for the violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulations, as a pecuniary administrative sanction, pursuant to art. 83, par. 1, of the Regulation, effective, proportionate and dissuasive.

Taking into account that the Municipality has completely failed to provide the interested parties with an extended, second-level information on the processing of personal data through video devices, it is also believed that the ancillary sanction of publication on the website of the Guarantor of the this provision, provided for by art. 166, paragraph 7 of the Code and art. 16 of the Guarantor Regulation n. 1/2019.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

WHEREAS, THE GUARANTOR

notes, pursuant to art. 57, par. 1, lett. f), the unlawfulness of the processing carried out by the Municipality of Policoro, for the violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulations, within the terms set out in the motivation

ORDER

pursuant to art. 58, par. 2, lett. i), and 83 of the Regulations, as well as art. 166, paragraph 2, of the Code, to the Municipality of Policoro, in the person of the pro-tempore legal representative, with registered office in Piazza Aldo Moro, 1 - 75025 Policoro (MT), C.F. 00111210779, to pay the sum of € 26,000 (twenty-six thousand) as a pecuniary administrative sanction for the violations indicated in the motivation. It is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;

INJUNCES

to the Municipality of Policoro:

1. in case of non-settlement of the dispute, pursuant to art. 166, paragraph 8, of the Code, to pay the sum of € 26,000 (twenty-six thousand) according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the l. n. 689/1981;

2. pursuant to art. 58, par. 2, lett. d) of the Regulations, to conform the processing to the provisions of the Regulations, adopting the corrective measures indicated in paragraph 5 of this provision, no later than 30 days from the date of receipt of the same;

3. pursuant to art. 58, par. 1, lett. a), of the Regulation and 157 of the Code, to communicate to this Authority, providing an adequately documented feedback, within thirty days from the notification of this provision, the initiatives undertaken to ensure compliance of the treatment with the Regulation;

HAS

the publication of this provision on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code (see Article 16 of the Guarantor Regulation No. 1/2019);

the annotation of this provision in the internal register of the Authority, provided for by art. 57, par. 1, lett. u), of the Regulations, violations and measures adopted in compliance with art. 58, par. 2, of the Regulation (see Article 17 of the Guarantor Regulation no. 1/2019).

Pursuant to art. 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.

Rome, 9 June 2022

PRESIDENT
Stanzione

THE RAPPORTEUR
Peel

THE SECRETARY GENERAL
Mattei

[doc. web n. 9794895]

Injunction order against the Municipality of Policoro - 9 June 2022

Record of measures
n. 214 of 9 June 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC, "General Data Protection Regulation" (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196, "Code regarding the protection of personal data", as amended by Legislative Decree 10 August 2018, n. 101, containing provisions for the adaptation of national law to the Regulation (hereinafter the "Code");

GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution no. 98 of 4 April 2019, published in the Official Gazette n. 106 of 8 May 2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter "Regulation of the Guarantor no. 1/2019");

HAVING REGARD to the documentation on file;

GIVEN the observations of the Office made by the Secretary General pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and operation of the office of the Guarantor for the protection of personal data, in www.gpdp.it, doc. web n. 1098801;

SPEAKER Attorney Guido Scorza;

1. Introduction.

With complaint of the XX, submitted pursuant to art. 77 of the Regulation, it was complained that the Municipality of Policoro (hereinafter, the "Municipality") would have used a video surveillance system in violation of the regulations on the protection of personal data.

In particular, the complainant stated that he had received three assessment reports, with which administrative sanctions were imposed for having "abandoned solid urban waste" on XX, XX and XX dates. The ascertainment of the violations, by viewing the video surveillance images, would have, however, occurred respectively on the date XX (i.e. 82 days after the date of recording of the images), XX (i.e. 79 days after the date of recording of the images) and XX (i.e. 64 days after the date the images were recorded).

The complainant also complained about the unsuitable installation of the signs containing the simplified information on video surveillance, as well as the non-compliance of the information contained in the minutes notified to him by the Municipality, as "lacking the content required by Articles 13 and 14 of the Regulation [and characterized by generality with regard to] the specific purpose of the assessment carried out ".

Lastly, the complainant stated that he had "proceeded to lodge three distinct judgments before the Pisticci Justice of the Peace Office [...], with which, opposing the sanctions imposed [by the Municipality], he contested the unlawful acquisition and use of personal data and requested that the Administration be sentenced to pay damages ". As part of these judgments, the Municipality would be constituted with the patronage of a lawyer who is also the Data Protection Officer ("DPO") of the Municipality. For this reason, a situation of "incompatibility between the [DPO] and the defense office of the Municipality was complained, taking into account that the [DPO] intervened in a proceeding in which illegality in the processing of data was highlighted".

2. The preliminary activity.

In response to a request for information from the Guarantor of the XX (prot. No. XX), the Municipality, with a note of the XX (prot. No. XX), stated, in particular, that:

“The disputed facts constitute […] administrative offenses for express violation of the municipal regulation of urban hygiene; [consequently], the envisaged discipline is that of […] Law no. 689/1981 ";

"With regard to the retention of data on the assumption of a retention period of more than 7 days, it is believed that in the event of filming carried out in the course of investigations by the judicial police, the discipline changes. The processing of data in the activities of p.g., in fact, at a European level does not fall within the scope of the [Regulation], but of Directive 2016/680 [...] [and of] Legislative Decree 51/2018 […] [; therefore,] in the course of investigations by p.g. that make use of the use of camera traps, the images must be kept for the time prescribed by art. 10 of the Presidential Decree n. 15 of 15.01.2018, which distinguishes different periods for different types of offense [...] ";

"For the storage of waste, in point 5.2 of the provision [of the Guarantor on video surveillance of 2010], the Guarantor admits the use of video surveillance systems only in the event of ineffectiveness or impossibility of alternative systems and both as regards the provisions sanctioned administratively and for those of a criminal nature ";

"With regard to the privacy information by means of a computer sign, unlike what is claimed [in the complaint], the acquisition of the data is legitimate having prescribed a legitimate placement of the information, according to the dictates of the Municipal Council resolution no. XX of the XX ";

"The case envisaged is characterized by the minimum disclosure by means of an information sign and by the disclosure attached to the minutes that allows for the necessary information [...]";

"[...] there is no [...] any form of conflict of interest [, as the] object of the judgment concerned only the opposition to an administrative sanction governed by Law no. 689/1981 and […] no consideration could have in court problems relating [to] the protection of personal data […] since the sanctioning system in force is subject to the discipline of Law no. 689/1981, with the effect, therefore, that the judgment could not absolutely "touch data protection issues";

"We proceeded to formalize the mandate ad litem [to the lawyer, who] proceeded to defend the Entity on the basis of the only preliminary question posed on the basis of the erroneous appeal before the Justice of the Peace of Pisticci for not having the then appellant settled the matter in the ways and terms set forth in the discipline of the aforementioned Law no. 689/1981 ";

"The acts based on the defense concerned exclusively and solely the preliminary objection of the inadmissibility and inadmissibility of the appeal for the reasons highlighted above, also because, among other things, the Justice of the Peace is incompetent on the matter to instruct and decide on issues relating to problems relating [to] the matter of privacy ";

"The prosecutors [...] limited themselves exclusively to taking a position and deciding only on the ascertained inadmissibility of the proposed appeal because the transgressor, following the notification of the report in question, given the matter of the administrative violation, would have had to follow the regulations concerning the system of sanctions provided for by Law no. 689/1981 ".

With a note of the XX (prot. No. XX), the Office, on the basis of the elements acquired, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, par. 2, of the Regulations, inviting the aforementioned holder to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (Article 166, paragraphs 6 and 7, of the Code; as well as Article 18, paragraph 1, of Law no. . 689 of 11/24/1981). With the aforementioned note, the Office found that the Municipality has put in place the processing of personal data through video devices in a manner that does not comply with the principles of "lawfulness, correctness and transparency", "conservation limitation" and "accountability", by providing information on the processing of personal data of the first level that is not suitable and by failing to provide information on the processing of personal data of the second level, as well as by placing their DPO in a position of conflict of interest, in violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13, and 38, par. 6, of the Regulation.

With a note of the XX (prot.n.XX), the Municipality sent its defense writings in relation to the notified violations to the Guarantor, declaring, in particular, that:

"The XXth Report [...] of the Local Police Command, [...] highlights [...] that the Local Police, in addition to performing administrative police functions, also performs judicial police functions";

“By order of the Local Police Command […] n. 2 local police officers performing judicial police functions pursuant to art. 57 c.p.p. Not only that, but with the minutes of the appointment of the twentieth to prot. N. XX, the Officers of p.g. of the local Police Headquarters appointed as auxiliary to p.g. Mr. […] for the supply and installation, assistance and maintenance of n. 4 fixed / mobile cameras for video surveillance aimed at controlling illegal landfills in the municipal area, with the express task of acquiring the images and developing the material useful for the further investigations of p.g. by the proceeding Local Police ";

"Therefore, the full legitimacy of the data processing in relation to the retention period beyond seven days from the detection of the data is clearly evident, given that in the course of investigations by p.g., the discipline does not fall within the scope of the GDPR, but in directive 2016/680, then implemented with Legislative Decree 51/2018, which concerns the processing of data carried out by public authorities for the purposes of prevention, investigation, detection and prosecution of crimes or execution of criminal sanctions ";

"In the course of investigations by p.g. who make use of the use of camera traps, - the information can be omitted (Point 3.1.1 of the Provision of the Guarantor of 8 April 2010) ";

"The person in charge (ie, the person who physically carries out the data processing operations) must necessarily hold the qualification referred to in art. 57 c.p.p .. ";

"The images must be kept for the time prescribed by art. 10 of the Presidential Decree n. 15 of 15.01.2018, which distinguishes different periods for different types of crime (moreover, even in the case of ascertained administrative offenses, the images must be kept after the 7-day term referred to above, as they enter another procedure). Among other things, it should be noted that the applicable discipline is that of administrative sanctions pursuant to Law no. 689/1981, which in mind of art. 14 regulates the term of ninety days to propose the appeal which runs from the date of the detection / ascertainment of the data, as extrapolated and stored until the definition of the procedure to allow the right of defense in the cross-examination between the parties ";

"In consideration of the storage times dictated by art. 10 of the Presidential Decree n. 15 of 15.01.2018 [...], as well as the 90 days to propose the appeal provided for by art. 14 of Law no. 689/1981 […] it is possible to state that the retention times of both cases are higher than the 82 days contested [by the Guarantor] ”;

“With City Council Resolution no. XX of the XX, the Entity provided for the obligation to provide specific information [, it being understood that] in the course of investigations by p.g. who make use of the use of camera traps, the information can be omitted [...] ";

the complainant ", as already claimed in the XXth notes, referred to the Office of the Justice of the Peace to challenge the report against the administrative sanction, calling it" Appeal against administrative sanction "without any mention of the matter of privacy";

"The mention" for violation of the privacy rules "(Sentences n.XX and n.XX) constitutes the reconstruction of the requests [of the appellant] reported in the part dedicated to the fact, since then, and what is more relevant, in the dedicated part to the law, which belongs to the magistrate, there is no mention of the matter of privacy, given that the judgment could not absolutely “touch data protection issues”;

"The mere fact that in the judgments in question [the complainant] had raised objections regarding compliance with the legislation on the protection of personal data does not in any way lead to a situation of conflict of interest [of the DPO]";

"The Entity has taken steps to examine the entire context and the elements available and in the light of the incorrect approach of the then appellant, has proceeded to appoint the lawyer […] For the purposes of legal representation so that reasons relating to the inadmissibility may arise […] ”;

"[...] the inadmissibility of the appeal, we read in the three Sentences, concerns the incorrect application [...] of the legislation relating [to] the administrative sanctions referred to in Law no. concerning the matter of the protection of personal data […] The inadmissibility of the appeals already presented at first reading was all too evident […] ”;

"Attorney [...] obtained a favorable ruling of inadmissibility but this does not mean that the same, as a DPO, would not have hesitated to bring the issues relating [to] any violations in privacy matters to the attention of the data controller if they were manifested ".
On the 20th, the hearing required pursuant to art. 166, paragraph 6, of the Code, during which the Municipality declared, in particular, the following:

"The Administration has acted at the service of the territory and the defense of the environment, to counteract the phenomenon of illegal waste abandonment, using the so-called camera traps as a deterrent. The Administration has therefore acted in absolute good faith for the pursuit of the public interest, as well as to protect the reputation of the Body itself, whose image is harmed by the phenomenon of illegal waste abandonment ";

"The choice to give a mandate to the DPO to represent the Municipality in court was also dictated by the need to optimize the Administration's resources, believing in good faith [...] that this choice could not give rise to a conflict of interest. This is because, otherwise, the Municipality would have had to appoint a third party, with a further increase in costs ";

"The defense of the Entity was set upstream by the Administration itself (or by the Local Police Command and by the officials and managers in charge). The attorney in charge, as an external, limited himself to representing this position in court [...] ";

"In any case, the Guidelines of the European Committee on the figure of the DPO assume a conflict of interest when, in the context of the defense in court, profiles regarding the protection of personal data are" touched ", a circumstance that does not exist in this case . Furthermore, there are no judicial decisions that have dealt with this specific type of conflict of interest ";

"With regard to the fulfillment of disclosure obligations, it should be noted that the Guidelines of the European Committee were published shortly before the facts of the complaint. In any case, it is reiterated that the local police acted by exercising their judicial police functions (despite not having received a specific assignment from the judicial authority) and, therefore, the information on the processing of personal data could also be of the all omitted ".

3. Outcome of the preliminary investigation.

3.1 The correctness and transparency of the processing: the information.

The processing of personal data by means of video surveillance systems by public subjects is generally allowed if it is necessary to fulfill a legal obligation to which the data controller is subject or for the execution of a task of public interest or connected to the exercise. of public powers vested in the same (art. 6, par. 1, lett. c) and e), and 3, of the Regulation, as well as 2-ter of the Code; cf. par. 41 of the "Guidelines 3/2019 on the processing of personal data through video devices", adopted by the European Data Protection Committee on XX). In this context, it is noted that waste management is one of the institutional activities entrusted to local authorities.

The data controller is, in any case, required to comply with the principles of data protection pursuant to art. 5 of the Regulation, including that of "lawfulness, correctness and transparency" (Article 5, paragraph 1, letter a), of the Regulation), according to which the data controller must take appropriate measures to provide interested all the information referred to in Articles. 13 and 14 of the Regulations in a concise, transparent, intelligible and easily accessible form, with simple and clear language (see Article 12 of the Regulations).

When video surveillance systems are used, the data controller, in addition to making the first level information, by affixing warning signs near the area subject to video surveillance, must also provide the interested parties with "second level information", which must "contain all the mandatory elements pursuant to Article 13 of the [Regulation]" and "be easily accessible for the interested party" ("Guidelines 3/2019 on the processing of personal data through video devices", cit., in particular par. 7; but see already the "Provision on video surveillance" of the Guarantor of 8 April 2010, web doc. n. 1712680, in particular par. 3.1; see also the FAQ n. 4 of the Guarantor regarding video surveillance, web doc. 9496574).

The first level information (warning sign) "should communicate the most important data, for example the purposes of the processing, the identity of the data controller and the existence of the rights of the data subject, together with information on the most significant impacts of the processing "(" Guidelines 3/2019 on the processing of personal data through video devices ", cit., par. 114). In addition, the signs must also contain information that may be unexpected for the person concerned. This could be, for example, the transmission of data to third parties, in particular if located outside the EU, and the retention period. If this information is not indicated, the interested party should be able to trust that there is only real-time surveillance (without any data recording or transmission to third parties) (ibidem, cit., Par. 115). The first level warning signs must also contain a clear reference to the second level of information, for example by indicating a website on which the text of the extended information can be consulted.

During the investigation, the Municipality stated that in the vicinity of the areas in which the so-called camera traps the information sign provided by the Municipal Council Resolution n. XX of the XX. This information sign takes up the model indicated by the Guarantor within the previous regulatory framework for the protection of personal data (see Annex 1 to the "Provision on video surveillance" of 8 April 2010, cit.).

In this regard, it should be noted that the reference, made in the cartel used by the Municipality (as well as in the information reported at the bottom of the report no. XX notified to the complainant), is incorrect - as it is no longer current - to art. . 13 of the Code, which was repealed by Legislative Decree 10 August 2018, n. 101.

Furthermore, this sign, which is, moreover, devoid of references to the rights of the interested parties, does not indicate the ways in which the interested parties (i.e. not only the subjects to whom an administrative violation is contested, but all the natural persons who enter the action of camera traps) can receive complete information on second-level processing (see par. 117-119 of the "Guidelines 3/2019 on the processing of personal data through video devices), cit.).

Nor does it emerge from the documents that the Municipality has drawn up this second level information and brought it to the attention of the interested parties, for example by publishing it on the institutional website of the Municipality.

As for the defense proposed by the Municipality, on the basis of which the information on the processing of personal data is not in any case due, given that the treatments in question were carried out in the context of judicial police activities (with consequent application of Legislative Decree no. lgs. 18 May 2018, n. 51), it is noted that the Municipality has accused the complainant of certain administrative violations for "unlawful delivery of waste". It follows that the Municipality processes personal data, through video devices, "for the performance of a task of public interest or connected to the exercise of public authority vested in the data controller" (Article 6, paragraph 1, letter e) of the Regulation), or to ascertain conduct that is sanctioned primarily by administrative means (see articles 192, "abandonment ban", and 255, "abandonment of waste", of Legislative Decree 3 April 2006, 152; article 13 of the law of 24 November 1981, no. 689).

These treatments are, therefore, completely unrelated to the activities of public security and judicial police, which the local police can carry out, in any case, only in a limited form and under certain conditions (see articles 3 and 5 of the law 7 March 1986, no. 65). Therefore, they fully fall within the scope of application of the Regulations and the Code, also with regard to the obligation for the data controller to provide data subjects with information on the processing of personal data.

On the other hand, as stated by the Municipality at the hearing, the same had not received any assignment from the judicial authority, preventing this circumstance in itself from tracing the processing of personal data in question to the scope of police activities. judicial.

In light of the foregoing considerations, the Municipality has processed personal data through video devices, providing data subjects with an unsuitable information on the processing of first-level personal data and failing to provide information on the processing of second-level personal data, in a manner that does not comply with the principle of "lawfulness, correctness and transparency" and in violation of Articles 5, par. 1, lett. a), 12 and 13 of the Regulation.

3.2 The principles of "conservation limitation" and "accountability".

Pursuant to art. 5, par. 1, lett. e), of the Regulation, personal data must be "stored in a form that allows identification of the data subjects for a period of time not exceeding the achievement of the purposes for which they are processed" ("conservation limitation") ".

On the basis of the principle of accountability (articles 5, paragraph 2, and 24 of the Regulation), it is up to the data controller to identify the retention times of the images, taking into account the context and purposes of the processing, as well as the risk for rights. and the freedoms of individuals; this unless specific legal provisions expressly provide for specific data retention times.

Even with regard to the processing of personal data carried out by means of video surveillance systems, the recorded images cannot be kept longer than necessary for the purposes for which they were acquired. In particular, “personal data should be - in most cases (for example if video surveillance is used to detect vandalism) - deleted after a few days, preferably through automatic mechanisms. The longer the envisaged retention period (especially if it exceeds 72 hours), the more reasoned must be the analysis referring to the legitimacy of the purpose and the need for conservation "(FAQ n. 5 of the Guarantor on video surveillance, cit ., which incorporates the information provided in the "Guidelines 3/2019 on the processing of personal data through video devices", cit., par. 121).

During the investigation, it emerged that the Municipality has not set the maximum retention times for the images taken through the so-called camera traps for the purpose of combating the phenomenon of illegal waste abandonment and, consequently, with regard to the case subject to the complaint, it proceeded to ascertain administrative violations in more than two months from the date of registration of the images.

Also in relation to this profile, the Municipality argued that the processing of personal data carried out by it would be attributable to judicial police activities, with the consequent application of Legislative Decree 18 May 2018, n. 51. These theses cannot, however, be accepted, as the above considerations regarding the full application of the provisions of the Regulation and the Code to the processing of personal data carried out by the Municipality for the purpose of ascertaining administrative violations are valid. in environmental matters.

Consequently, in view of the principle of accountability and in compliance with the conservation limitation principle, the Municipality should have defined the maximum retention terms for video surveillance images for each processing purpose pursued, adequately motivating the choices made in this regard.

Therefore, the Municipality has processed personal data through video devices in a manner that does not comply with the principles of "conservation limitation" and "accountability", in violation of Articles 5, par. 1, lett. e), and par. 2 (in conjunction with art. 24) of the Regulation.

3.3 The conflict of interest of the Data Protection Officer.

With regard to the figure of the DPO, the legislation on data protection provides that the designation of the same is always due by public entities (Article 37, paragraph 1, letter a), of the Regulation).

As regards the position of the DPO, art. 38, par. 6, of the Regulation provides that the same "[may] perform other tasks and functions", it being understood that "the data controller [must ensure] that such tasks and functions do not give rise to a conflict of interest".

With regard to this profile, the "Guidelines on data protection officers", adopted by the European Data Protection Committee on 13 December 2016, as amended and adopted on 5 April 2017, highlight that "a conflict of interests if, for example, an external DPO is asked to represent the owner or manager in a judgment that touches on data protection issues "(par. 3.5).

In the present case, the complainant stated that he had "filed three distinct judgments before the Office of the Justice of the Peace (R.G. XX; XX and XX), with which, opposing the sanctions imposed, he contested the unlawful acquisition and use of personal data and requested that the Administration be sentenced to pay damages […] ”.

From sentence no. XX of the XX of the Office of the Justice of the Peace of Pisticci, on record, it emerges that "with an appeal filed on XX [the complainant] lodged an opposition against the report no. XX drawn up on XX by the Local Police of the Municipality of Policoro and notified on XX [...] ", asking" [the judicial authority] the annulment of the contested report with the victory of expenses; the condemnation of the defendant to the reimbursement of the damages suffered in the amount of € […], or of that smaller or greater sum deemed to be of justice, for violation of the rules on privacy ".

Similarly, from sentence no. XX, in the records, it appears that "the appellant disputes the report [as the same] is lacking in essential data, [and as there is] violation of the rules on privacy, illegitimate adoption of video surveillance".

In the judgments in question, originating from appeals in which exceptions were raised also regarding compliance with the legislation on the protection of personal data, the Municipality was, therefore, represented and defended by a lawyer who held the role of DPO of the Entity .

This, as clarified by the European Committee for the protection of personal data in the "Guidelines on data protection officers", cited above, has given rise to a situation of conflict of interest.

The circumstance that, as declared by the Municipality, the judicial authority has declared the appeals inadmissible, due to lack of jurisdiction, is not, in this regard, conclusive, given that the Municipality was, in any case, represented by its DPO in judgments. within which the complainant had raised exceptions regarding compliance with the legislation on the protection of personal data. In this regard, it must be considered that, when the Municipality entrusted its defense to the DPO, it could not predict the outcome of the trial, being, therefore, abstractly possible for the judge to declare his competence and to pronounce in the merit, even incidentally, on issues relating to the protection of personal data.

Furthermore, given that the DPO, as the Entity's lawyer, shared with the latter the interest in obtaining the rejection of the appeals, he was to be considered, from the date of the assignment of the assignment to defend the Entity, in a position of conflict of interest. In fact, in the performance of their duties, and in particular the task of "supervising [...] the [...] Regulation, other provisions or of the Union or of the Member States relating to data protection as well as the policies of the owner of the processing [...] regarding the protection of personal data "(Article 39, paragraph 1, letter b) of the Regulation), with specific reference to the processing of personal data carried out through the video devices in question, the DPO had detected violations of the legislation on data protection, he could not have brought the same to the attention of the data controller without, at the same time, prejudicing the procedural position of the Entity and its own interest, as legal, to obtain a favorable ruling by the court appointed by the complainant. Conversely, any assessments made by the same subject, as legal, in order to support the lawfulness of the processing in court, could have compromised the autonomy of judgment and the position of independence that the same, as a DPO, is required to ensure.

Precisely in light of these considerations, the Guarantor, in the "Guidance document on the designation, position and duties of the Data Protection Officer (RPD) in the public sphere", attached to the provision. 29 April 2021, n. 186, doc. web n. 9589104, has expressly drawn the attention of public subjects "to the fact that it is difficult to predict a priori that a legal dispute cannot also involve personal data protection profiles", inviting them "to designate a DPO who, at the same time, does not carry out for them the role of defender in court "(par. 10.3).

It should also be noted that the complainant, from his perspective, as a consequence of the mandate received from the DPO, was no longer able to contact him (see Article 13, paragraph 1, letter b) of the Regulation), trusting in his impartiality in the performance of their duties, as the provision pursuant to art. 38, par. 4, of the Regulation, according to which interested parties can contact the DPO for all matters relating to the processing of their personal data and for the exercise of their rights such as, for example, those of access, cancellation or limitation (respectively, articles 15 , 17 and 18 of the Regulation). Also in relation to this profile, the Guarantor pointed out that "in the eyes of the interested party who wants to contact the DPO, the fact that he is also the legal defender of the entity at the same time undermines his independence. Therefore, regardless of the circumstances that may actually arise - such as, for example, as to exclude that the judgment involved issues of protection of personal data - all public administrations have been invited to designate a DPO who, at the same time, does not carry out for them the role of defender in court "(" Guidance document on the designation, position and duties of the Data Protection Officer (DPO) in the public sphere ", cit., par. 10.3).

By reason of the above, the Municipality, entrusting the DPO designated by it with its defense in the judgments in question, has placed the same in a position of conflict of interest, in violation of art. 38, par. 6, of the Regulation.

4. Conclusions.

In light of the aforementioned assessments, it is noted that the statements made by the data controller in the defensive writings ˗ the truthfulness of which one may be called to answer pursuant to art. 168 of the Code ˗ although deserving of consideration, they do not allow to overcome the findings notified by the Office with the act of initiation of the procedure and are insufficient to allow the filing of this procedure, however, none of the cases provided for by the art. 11 of the Guarantor Regulation n. 1/2019.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by the Municipality is noted, for having carried out processing of personal data through video devices in a manner that does not comply with the principles of "lawfulness, correctness and transparency "," retention limitation "and" accountability ", providing information on the processing of first-level personal data that is not suitable and failing to provide information on the processing of second-level personal data, as well as putting one's DPO in a position of conflict of interest, in violation of art. 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulation.

The violation of the aforementioned provisions makes the administrative sanction provided for by art. 83, par. 5, of the Regulation, pursuant to art. 58, par. 2, lett. i), and 83, par. 3, of the same Regulation.

5. Corrective measures (art. 58, par. 2, letter d), of the Regulation).

The unlawful conduct carried out by the Municipality has not completely exhausted its effects, as, to date, the same has not demonstrated that it has provided the interested parties with appropriate information on the processing of first-level personal data and information on the processing of second-level personal data, as well as having set the maximum retention times for images shot using video devices.

It is therefore considered necessary, pursuant to art. 58, par. 2, lett. d), of the Regulations, to order the Municipality, within thirty days of notification of this provision, to:

identify the maximum retention times of the images on the basis of the purposes pursued with the aforementioned video surveillance system (Article 5, paragraph 1, letter e), and par. 2, in conjunction with art. 24, of the Regulation);

provide interested parties with appropriate information on the processing of first-level personal data and information on the processing of second-level personal data (Articles 5, paragraph 1, letter a), 12 and 13 of the Regulation).

Pursuant to art. 157 of the Code, the Municipality will have to communicate to this Authority what initiatives have been undertaken in order to implement the provisions of this provision, and in any case to provide adequately documented feedback, within thirty days of notification of this provision.

6. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (articles 58, par. 2, lett. I and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The Guarantor, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations as well as art. 166 of the Code, has the power to "inflict a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or instead of such measures, depending on the circumstances of each single case "and, in this context," the College [of the Guarantor] adopts the injunction order, with which it also disposes with regard to the application of the ancillary administrative sanction of its publication, in whole or in excerpt, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code "(Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).

In this regard, taking into account art. 83, par. 3, of the Regulation, in the present case - also considering the reference contained in art. 166, paragraph 2, of the Code - the violation of the aforementioned provisions is subject to the application of the same administrative fine provided for by art. 83, par. 5, of the Regulation.

The aforementioned administrative fine imposed, depending on the circumstances of each individual case, must be determined in the amount taking into account the elements provided for by art. 83, par. 2, of the Regulation.

In relation to the aforementioned elements, it was considered that since 2004 the Guarantor has provided information to the data controllers with regard to the need to duly inform the data subjects about the processing of personal data through video devices and the need to define the maximum retention times. of the recorded images (see the General Provision on video surveillance of 29 April 2004, web doc. n. 1003482, paragraphs 3.1 and 3.4). It was also considered that the processing of personal data in question affected not only the complainant, but all other citizens who have passed through the areas subject to video surveillance. As for the violation profiles that concerned the DPO, it was taken into account that, as declared by the Municipality, the defense in court of the Municipality was conferred on the DPO in order not to incur an "increase in costs", which would have resulted from assignment of the mandate to a third party (see Article 83, paragraph 2, letter k), of the Regulation).

On the other hand, it should be noted that there are no previous violations committed by the data controller or previous provisions pursuant to art. 58 of the Regulation.

Due to the aforementioned elements, assessed as a whole, and considering that the Municipality falls within the demographic dimension of less than 20,000 inhabitants, it is considered to determine the amount of the financial penalty, in the amount of 26,000 (twenty-six thousand) euros for the violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulations, as a pecuniary administrative sanction, pursuant to art. 83, par. 1, of the Regulation, effective, proportionate and dissuasive.

Taking into account that the Municipality has completely failed to provide the interested parties with an extended, second level information on the processing of personal data through video devices, it is also considered that the ancillary sanction of publication on the website of the Guarantor of the this provision, provided for by art. 166, paragraph 7 of the Code and art. 16 of the Guarantor Regulation n. 1/2019.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

WHEREAS, THE GUARANTOR

notes, pursuant to art. 57, par. 1, lett. f), the unlawfulness of the processing carried out by the Municipality of Policoro, for the violation of Articles 5, par. 1, lett. a) and e), and par. 2 (in conjunction with art. 24), 12, 13 and 38, par. 6, of the Regulations, within the terms set out in the motivation

ORDER

pursuant to art. 58, par. 2, lett. i), and 83 of the Regulations, as well as art. 166, paragraph 2, of the Code, to the Municipality of Policoro, in the person of the pro-tempore legal representative, with registered office in Piazza Aldo Moro, 1 - 75025 Policoro (MT), C.F. 00111210779, to pay the sum of € 26,000 (twenty-six thousand) as a pecuniary administrative sanction for the violations indicated in the motivation. It is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;

INJUNCES

to the Municipality of Policoro:

1. in case of non-settlement of the dispute, pursuant to art. 166, paragraph 8, of the Code, to pay the sum of € 26,000 (twenty-six thousand) according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the l. n. 689/1981;

2. pursuant to art. 58, par. 2, lett. d) of the Regulations, to conform the processing to the provisions of the Regulations, adopting the corrective measures indicated in paragraph 5 of this provision, no later than 30 days from the date of receipt of the same;

3. pursuant to art. 58, par. 1, lett. a), of the Regulation and 157 of the Code, to communicate to this Authority, providing an adequately documented feedback, within thirty days from the notification of this provision, the initiatives undertaken to ensure compliance of the treatment with the Regulation;

HAS

the publication of this provision on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code (see Article 16 of the Guarantor Regulation No. 1/2019);

the annotation of this provision in the internal register of the Authority, provided for by art. 57, par. 1, lett. u), of the Regulations, violations and measures adopted in compliance with art. 58, par. 2, of the Regulation (see Article 17 of the Guarantor Regulation no. 1/2019).

Pursuant to art. 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.

Rome, 9 June 2022

PRESIDENT
Stanzione

THE RAPPORTEUR
Peel

THE SECRETARY GENERAL
Mattei