Garante per la protezione dei dati personali (Italy) - 619/2026
Italian DPA fines swimming pool operator €8,000 for GDPR violations related to camera surveillance.
Italy's Garante per la protezione dei dati personali has fined an entity managing sports facilities €8,000 for violating GDPR. The DPA found that the processing of swimming pool user data via camera surveillance was not justified, even with a union agreement, and lacked transparency, particularly in sensitive areas like dressing rooms. The controller has since deactivated cameras, revised retention periods, and updated signage.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Italian sports facility operator violated GDPR by deploying camera surveillance in and around swimming pool areas — including sensitive spaces like dressing rooms — without a lawful basis, adequate transparency, or proportionate data retention policies. A union agreement alone is insufficient to legitimise surveillance of data subjects who are not employees, and cameras in sensitive areas represent a significant privacy intrusion. This case highlights that organisations must conduct proper legal basis assessments before deploying surveillance technology, not after a regulator intervenes. Failing to display adequate signage compounds the violation by denying individuals their right to be informed about data processing activities.