Garante per la protezione dei dati personali (Italy) - 10297167

Summary

The Italian Garante per la protezione dei dati personali has fined the National Institute of Meteorological Research €10,000 for implementing workplace video surveillance without adequately informing employees and third parties. The institute also failed to conduct a Data Protection Impact Assessment (DPIA) before installing additional cameras and altering their locations, which was deemed incompatible with their trade agreement.

Full text

Help Garante per la protezione dei dati personali (Italy) - 10297167: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 12:13, 1 October 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators107 edits Tag: Decisions [1.0] (No difference) Latest revision as of 12:13, 1 October 2026 Garante per la protezione dei dati personali - 10297167 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5(1)(a) GDPR Article 12(1) GDPR Article 13 GDPR Article 32 GDPR Article 88 GDPR Type: Complaint Outcome: Upheld Started: Decided: Published: 01.10.2026 Fine: 10000.0 EUR Parties: Nazionale di Ricerca Metrologica National Case Number/Name: 10297167 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Italian Original Source: Garante per la protezione dei dati personali (in IT) Initial Contributor: sf The DPA fined a controller €10,000 for implementing surveillance in the workplace without the necessary information being provided to its employees and interested third parties, and in absence of a DPIA. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The DPA received two distinct but related complaints from employees (the data subjects) of the National Institute of Meteorological Research (the controller) concerning the transparency of the use of video surveillance. The controller clarified that the surveillance was subject to a trade agreement within which they were testing the use and coverage of 10 cameras. The cameras would only record when the alarm was activated, and excluded the possibility of recording areas which were subject to public access. Storage of the recordings was limited to 72 hours from the trigger of an alarm. The controller further explained that at the time the surveillance system was being tested without actually recording any images. Particularly, the controller sought to verify the technical and adequate functioning of the cameras and monitors as well as effective coverage of the security parameter. Due to insufficient and inadequate coverage of certain areas, which was deemed contrary to the purpose of the surveillance, the controller subsequently installed 8 additional cameras. The controller clarified that this was in line with the agreement which allowed for extraordinary maintenance. As a result of the surveillance being at the testing phase, the controller did not provide the data subjects and staff of the information regarding data processing. The controller emphasised that before its official operation this information would be provided. Holding The DPA held that the installed cameras were incompatible with the agreement as a result of increasing the number of cameras as well as the modification of their location and subsequent area being converted. Nonetheless, the DPA found that the extraordinary maintenance did not allow for the defined area being covered by the cameras to be altered. Therefore, although the purpose of surveillance activation was to test the system, personal data processing was still being undertaken. The DPA further emphasised that the controller failed to inform its staff and interested parties sufficiently of the surveillance practices, neither of the associated personal data processing happening, prior to its implementation. The DPA held that the lack of information and the fact that the signage was affixed after the processing had already taken place was insufficient. Finally, the DPA found that the controller implemented the video surveillance in its workplace, which considered of the processing of personal data of its employees, in absence of the necessary data protection impact assessment, contrary to Article 35 GDPR. In light of the foregoing the DPA fined the controller €10,000 for violations of Articles 5(1)(a), 12, 13, 35 and 88 GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details. [Web Doc. No. 10297167] Decision of September 3, 2026 Register of Decisions No. 620 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and functioning of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Dr. Agostino Ghiglia; PREAMBLE 1. Introduction. In separate but related complaints filed pursuant to Article 77 of the Regulation against the National Institute of Metrological Research—INRIM (hereinafter, the “Institute”), two employees of the Institute alleged a violation of the regulations governing data protection. Specifically, it was alleged that, after entering into an agreement with union representatives pursuant to Article 4 of Law No. 300 of May 20, 1970, regarding the use of a video surveillance system at the Institute’s Turin headquarters, said system was activated during a test phase without, however, ensuring the necessary transparency of the processing with respect to the data subjects (employees and individuals who visit the premises for various reasons), by subjecting areas not covered by the agreement to video surveillance, as well as by using monitoring screens located in areas potentially accessible even to unauthorized individuals. 2. The Preliminary Investigation. In response to a request for information (see XX), made pursuant to Article 157 of the Code, the Institute, in a letter dated XX (Ref. No. XX), as supplemented by a subsequent letter dated XX (Ref. No. XX), stated, in particular, that: - “the video surveillance system covered by the union agreement entered into on May 16, 2025, pursuant to Art. 4 of Law No. 300/1970 […] was installed at the INRiM headquarters in Turin”; - “The physical installation of the cameras, which began on May 19, 2025, was completed on October 30, 2025. A total of 18 cameras have been installed”; - “On October 31, 2025, the system was activated in test mode, a status that was maintained even during the subsequent holidays and days when the Institute was closed on November 1 and 2 […;] during the testing phase, only the viewing function was activated, with no recording of images”; - “On the following workdays, from November

Entities