Garante per la protezione dei dati personali (Italy) - 619/2026

Summary

Italy's Garante per la protezione dei dati personali has fined a municipality €8,000 for installing surveillance cameras in the dressing rooms of a public swimming pool. The DPA found the camera placement disproportionate and a violation of GDPR principles regarding lawfulness, storage limitation, and transparency, especially as the cameras captured footage of employees as well as users.

Full text

Help Garante per la protezione dei dati personali (Italy) - 619/2026: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 14:00, 15 September 2026 view sourceLs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators421 editsTag: Visual edit← Older edit Latest revision as of 07:25, 16 September 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators71 editsmTag: Visual edit Line 115: Line 115: The controller explained that it had installed the cameras to record the lockers where personal items are stored. No recording of the changing rooms, showers or toilets was undertaken, and footage was stored for 72 hours. Also, only two individuals would access the footage at the request of judicial or public security authorities.The controller explained that it had installed the cameras to record the lockers where personal items are stored. No recording of the changing rooms, showers or toilets was undertaken, and footage was stored for 72 hours. Also, only two individuals would access the footage at the request of judicial or public security authorities. The DPA contacted the controller about the possible violation of the GDPR. Subsequently, the controller <u>deactivated the cameras</u> and the subsequent processing operations, revised the retention periods of the footage from 72 hours to 12/24 hours and updated the signage.The DPA contacted the controller about the possible violation of the GDPR. Subsequently, the controller revised the retention periods of the footage from 72 hours to 12/24 hours and updated the signage. === Holding ====== Holding === The DPA found that the matter related both to the processing of the swimming pool's users and of the employees, for which it qualified as work monitoring. The DPA found that the matter related both to the processing of the swimming pool's users and of the employees, for which it qualified as work monitoring. Latest revision as of 07:25, 16 September 2026 Garante per la protezione dei dati personali - 619/2026 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5(1)(a) GDPR Article 5(1)(e) GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 12 GDPR Article 13 GDPR Type: Investigation Outcome: Violation Found Started: Decided: Published: Fine: 8000.0 EUR Parties: Azienda Speciale per la Gestione degli Impianti Sportivi del Comune di Trento National Case Number/Name: 619/2026 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Italian Original Source: Garante per la protezione dei dati personali (in IT) Initial Contributor: sf The DPA fined a municipality €8,000 for installing surveillance cameras inside dressing rooms of a swimming pool for theft prevention. The placement of cameras was found disproportionate, in violation of the lawfulness, storage limitation and transparency principles. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The DPA investigated the Special Company for the Management of Sports Facilities of the Municipality of Trento (the controller) after press reports revealed the implementation and use of surveillance cameras in the dressing room of a public swimming pool since 2007. The investigation showed that the controller installed surveillance cameras after repeated incidents of wallet and phone theft of individuals using the pool. The controller disclosed the use of camera surveillance through signage at the entrance of the pool, and on their website. The controller explained that it had installed the cameras to record the lockers where personal items are stored. No recording of the changing rooms, showers or toilets was undertaken, and footage was stored for 72 hours. Also, only two individuals would access the footage at the request of judicial or public security authorities. The DPA contacted the controller about the possible violation of the GDPR. Subsequently, the controller revised the retention periods of the footage from 72 hours to 12/24 hours and updated the signage. Holding The DPA found that the matter related both to the processing of the swimming pool's users and of the employees, for which it qualified as work monitoring. For both categories of data subjects, the controller’s purpose of protecting the assets of individuals and the protection of fundamental rights and freedoms of data subjects does not justify the processing of the swimming pool user’s personal data. In particular, less intrusive methods could have been used to pursue the same purpose, like installing personal locker chains. The DPA also criticized the retention period and the disclosure of the camera surveillance on site. It found that the signage containing the general privacy notice found at the entrance of the controller’s premises does not achieve the necessary level of transparency. This is especially the case where the surveillance is being undertaken in areas such as dressing rooms where there is a greater legitimate expectation of confidentiality. Therefore, the DPA held that the controller violated Articles 5(1)(a), and (e), 6(1)(c) and (e), 12 and 13 GDPR and fined the controller €8,000. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details. SEE ALSO Newsletter of September 11, 2026 [Web Doc. No. 10294255] Decision of September 3, 2026 Register of Decisions No. 619 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the tasks and the exercise of the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Dr. Agostino Ghiglia; WHEREAS 1. Introduction. The Authority has learned from press reports and several complaints that video surveillance cameras were allegedly found inside a locker room, intended for use by users, at a swimming pool managed by the Special Agency for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S. — hereinafter, the “Agency”). 2. The Preliminary Investigation. In response to two requests for information made pursuant to Article 157 of the Code (see letters dated Octo

Entities