Garante per la protezione dei dati personali (Italy) - 9815745

Garante per la protezione dei dati personali - 9815745

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 13 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	15.09.2022
Published:	15.09.2022
Fine:	2,000 EUR
Parties:	Immobiliare Riscostruzione Meloria s.r.l.
National Case Number/Name:	9815745
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la Protezione dei Dati Personali (in IT)
Initial Contributor:	Cmart

The Italian DPA fined a controller €2,000 for violating Articles 5(1)(a) and 13 GDPR by only using a sign featuring a figure of a stylised camera to inform data subjects of the use of CCTV cameras.

English Summary

Facts

The local police of Milan received a complaint about a video surveillance system installed in a building owned by Immobiliare Ricostruzione Meloria s.r.l. (controller). The police investigated the matter and drew up a report. Based on this report, the Italian DPA opened an investigation into the controller.

The controller allegedly installed the system at the request of some tenants of the building. The system consisted of four cameras: one filming the entrance, one the space in front of the lift, and two others facing the backyard, the cellars and a flat. The images taken by the cameras were displayed on a monitor and stored on a recording device, both located in the porter's lodge.

The only information concerning the video surveillance system which passer-bys received consisted of a sign with a figure of a stylised camera placed on the left-hand side of the entrance door to the building. No further information about the processing activity or the data controller was provided, not even on the premises of the porter's lodge.

Holding

The DPA held that the use of a video surveillance system may constitute a processing of personal data, depending on the positioning of the cameras and on the quality of the images taken. In the case at hand, this was the case. The DPA noted that any processing of personal data had to be carried out in accordance with the principles laid down in Article 5 GDPR, and in particular, the principle of transparency. The DPA stated that, with regard to the use of video surveillance systems, the principle of transparency could be respected by displaying information signs indicating the data controller and the purpose of the processing, so that data subjects were always aware that they were entering a video surveilled area. However, the mere display of the sign of the stylised camera at the entrance of the building did not sufficiently inform data subjects about the processing nor about their means to exercise their rights as required by Article 13 GDPR. As a result, the processing activity carried out through the use of the video surveillance system violated Article 5(1)(a) and Article 13 GDPR.

Consequently, the DPA ordered the Company to install proper information signs and imposed a fine of €2,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web n. 9815745]

Order injunction against Immobiliare Riscostruzione Meloria s.r.l. - September 15, 2022

Record of measures
n. 300 of 15 September 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 on "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";

GIVEN the note sent by the Municipal Police of the Municipality of Milan;

EXAMINED the documentation in deeds;

HAVING REGARD to the observations made by the Secretary General pursuant to art. 15 of the regulation of the Guarantor n. 1/2000;

SPEAKER Attorney Guido Scorza;

WHEREAS

1. Reporting and preliminary investigation.

With the note of 21 May 2020, the Municipal Police of the Municipality of Milan, following the outcome of the inspection carried out following a complaint, communicated to this Authority that a video surveillance system consisting of four cameras was functioning at the building in via Meloria 2, the installation of which, according to what was declared by the property manager, would have been arranged by the sole administrator of the company that owns the property, Immobiliare Ricostruzione Meloria srl (hereinafter the Company), at the request of some tenants.

On June 4, 2020, Mr. XX who complained about the installation of the aforementioned video surveillance system.

In order to acquire elements of evaluation in relation to what has been reported, with the request for information of 8 October 2021, formulated pursuant to art. 157 of Legislative Decree no. 196 of 2003, containing the Code regarding the protection of personal data, the special unit for the protection of privacy and technological fraud of the Guardia di Finanza was delegated to carry out the appropriate investigations.

With the note of 22 December 2021, the Unit sent the report of the operations carried out to the Office, drawn up as part of the delegated intervention, which revealed that, at the building located in Milan, via Meloria 2, a video surveillance system was in operation consisting of 4 cameras of which: one located near the door, which filmed the space in front of the entrance to the building; a post in the entrance hall of the building that takes up the space in front of the elevator; two placed on the wall in front of the courtyard at the rear of the building, which reflect the courtyard and the access ramps to the cellars and to an apartment located in the building.

The images taken by the cameras were displayed on a monitor and stored on a recording device, both located in the concierge.

During the inspection it was also verified that, on the left side of the entrance door to the building, there was a sign showing the figure of a stylized camera, but without information relating to the owner and the purposes of the processing.

On the basis of the inspection carried out and of the declarations acquired in the documents, the presence of further signs, nor the availability of a complete information text, at the concierge rooms emerged.

2. The outcome of the investigation and the sanctioning procedure.

The Office, based on the findings of the investigations carried out, with the note of 25 March 2022 notified the Company of the act of initiating the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of the general principles on the protection of personal data pursuant to art. 5, par. 1, lett. a) and art. 13 of the Regulation.

Upon the outcome of the verification activities carried out and the subsequent assessments carried out by the Office, it is ascertained that the Company has carried out a processing of personal data, by means of a video surveillance system in the absence of suitable information, in violation of the general principles on the subject of protection of personal data pursuant to art. 5, par. 1, lett. a) and in defiance of the provisions of art. 13 of the Regulation.

The use of video surveillance systems may result in the processing of personal data in relation to the positioning of the cameras and the quality of the images recorded.

This treatment must be carried out in compliance with the general principles contained in art. 5 of the Regulation and, in particular, of the principle of transparency which presupposes that "interested parties must always be informed that they are about to enter a video surveillance area".

For this purpose, therefore, the data controller must affix suitable information signs indicating the owner and the purposes of the processing, according to the indications contained in point 3.1. of the provision on video surveillance - April 8, 2010 [1712680] (in this sense also the Faq on video surveillance, published on the Authority's website).

Similarly, the Guidelines no. 3/2019 of the European Data Protection Committee on the processing of personal data through video devices, point 7) specify that "With regard to video surveillance, the most important information must be indicated [by the owner] on the warning sign itself (first level), while the additional mandatory details can be provided by other means (second level) ".

The Guidelines also provide that "This information may be provided in combination with an icon to give, in a clearly visible, intelligible and clearly legible way, an overview of the treatment envisaged (Article 12, paragraph 7, of the RGPD) . The format of the information will have to adapt to the various locations ”.

The information should be positioned in such a way as to allow the data subject to easily recognize the circumstances of the surveillance, before entering the monitored area (approximately at eye level) "to allow the data subject to estimate which area is covered by a camera in so as to avoid surveillance or adapt one's behavior, where necessary ".

In the present case, the mere affixing at the entrance to the building of a sign showing the image of a stylized camera, without any reference to the data controller and its purposes, does not allow interested parties to know the essential elements of the processing and to know who to contact to exercise their rights.

Although the act of initiating the procedure is duly notified via certified e-mail to the Company's address, no briefs or defensive writings have been received (Article 18 of Law no. 689 of 1981).

3. Conclusions: declaration of illegality of the treatment. Corrective measures pursuant to art. 58, par. 2, Regulations.

The processing of personal data carried out by the Company is therefore illegal, in the terms set out above, in relation to articles 5, par. 1, lett. a) (principle of transparency) and 13 (disclosure) of the Regulation.

The violation ascertained in the terms mentioned in the motivation cannot be considered "minor", taking into account the nature, gravity and duration of the violation, the degree of responsibility and the manner in which the supervisory authority has become aware of the violation ( see cons. 148 of the Regulation).

In consideration of the fact that the Company, after the investigations and in any case following the notification of the violation, has not sent elements from which it can be noted that it has placed suitable information in relation to the treatment subject to this proceeding, given the corrective powers attributed by art. 58, par. 2 of the Regulation, it is considered necessary:

order the holder to conform the processing carried out through the video surveillance system by installing suitable information signs according to the indications set out in point 2 of this decision, (Article 58, paragraph 2, letter d) of the Regulation);

apply a pecuniary administrative sanction pursuant to art. 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i) of the Regulation).

4. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulations; art. 166, paragraph 7, of the Code).

The Guarantor, pursuant to art. 58, par. 2, lett. i) of the Regulations and art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (Article 18. Law of 24 November 1981 n. 689), in relation to the processing of personal data carried out by the party through the video surveillance system, in violation of art. . 5, par. 1, lett. a) and art. 13 of the Regulation.

With reference to the elements listed in art. 83, par. 2, of the Regulations for the purposes of applying the pecuniary administrative sanction and its quantification, taking into account that the sanction must be "in each individual case effective, proportionate and dissuasive" (Article 83, par. 1 of the Regulations), that, in the present case, the following circumstances were taken into consideration:

with regard to the nature, gravity and duration of the violation, the negligent conduct of the data controller was taken into consideration;

the absence of specific precedents against the party relating to violations of the regulations on the protection of personal data;

the circumstance that the party did not cooperate with the Authority in the course of the proceedings, by not sending its own defensive writings.

It is also believed that they assume relevance, in the present case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness to which the Authority must comply in determining the amount of the sanction (Article 83, paragraph 1, of the Regulation), the economic conditions of the offender, determined with reference to the financial statements for the year 2020.

Due to the aforementioned elements, assessed as a whole, it is believed to determine the amount of the financial penalty in the amount of € 2,000.00 (two thousand) for the violation of art. 5, par. 1, lett. a) and art. 13 of the Regulation.

In this context, also in consideration of the type of violation ascertained, it is believed that, pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the regulation of the Guarantor n. 1/2019, this provision should be published on the Guarantor's website.

Finally, it is believed that the conditions set out in art. 17 of regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

WHEREAS, THE GUARANTOR

pursuant to art. 57, par. 1, lett. a) and 83 of the Regulations, declares the unlawfulness of the processing carried out by Immobiliare Riscostruzione Meloria srl, with registered office in Via Gonzaga, 2 (MI), in the terms set out in the motivation, for the violation of Articles 5, par. 1, lett. a) and 13 of the Regulations;

ORDER

pursuant to art. 58, par. 2, lett. i) of the Regulations to Immobiliare Riscostruzione Meloria s.r.l., to pay the sum of € 2,000.00 (two thousand) as a fine for the violation of Articles 5, par. 1, lett. a) and 13 of the Regulations;

INJUNCES

to Immobiliare Riscostruzione Meloria s.r.l., pursuant to art. 58, par. 2, lett. d) and i) of the Regulations of:

a) pay the sum of € 2,000.00 (two thousand), according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of the l. n. 689/1981. It is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, again in the manner indicated in the annex, of an amount equal to half of the sanction imposed within the term referred to in art. 10, paragraph 3, of the legislative decree n. 150 of 2011;

b) conform the treatments carried out through the video surveillance system, installing suitable information signs according to the indications given in point 2 of this decision. In relation to this point, the Company is invited, pursuant to art. 157 of the Code, to send, within thirty days of notification of the provision, a documented confirmation of the initiatives taken to comply with the prescription.

HAS

the publication of this provision on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code and by art. 16, paragraph 1, of the Guarantor Regulation n. 1/2019, as well as the annotation of violations in the internal register of the Authority pursuant to art. 17 of the Guarantor Regulation n. 1/2019.

Pursuant to art. 78 of the Regulations, as well as articles 152 of the Code and 10 of Legislative Decree no. 150/2011, an opposition to the ordinary judicial authority may be proposed against this provision, with an appeal filed with the ordinary court of the place identified in the same art. 10, within thirty days from the date of communication of the provision itself, or sixty days if the applicant resides abroad.

Rome, September 15, 2022

PRESIDENT
Stanzione

THE RAPPORTEUR
Peel

THE SECRETARY GENERAL
Mattei