Italian DPA Fines Swimming Pool Operator €8,000 for Unlawful Dressing Room Surveillance
The Special Company for the Management of Sports Facilities of the Municipality of Trento installed surveillance cameras in changing rooms without establishing a valid legal basis, violating core GDPR principles of necessity and proportionality. Dressing rooms represent spaces with an exceptionally high expectation of privacy, making unjustified surveillance particularly egregious under data protection law. Compounding the violation, the organisation failed to provide adequate signage to inform individuals that they were being recorded. This case demonstrates that deploying monitoring or data-collection technology — even with ostensibly legitimate goals like security — requires documented lawful grounds, a proportionality assessment, and transparent communication to data subjects.
Tactical Insight
Immediate actions
- Conduct an urgent audit of all existing surveillance systems to verify each camera has a documented lawful basis and proportionality justification.
- Remove or relocate any cameras positioned in high-privacy areas (changing rooms, toilets, medical rooms) that lack explicit legal authorisation.
- Review and update all CCTV signage to ensure it clearly identifies the data controller, purpose, and retention period in compliance with GDPR Article 13.
Policy & governance improvements
- Establish a mandatory Data Protection Impact Assessment (DPIA) process under GDPR Article 35 before deploying any new surveillance or monitoring technology.
- Create and enforce a Surveillance and Monitoring Policy that defines approved locations, lawful bases, retention limits, and access controls for all camera footage.
- Appoint or engage a qualified Data Protection Officer (DPO) to review surveillance deployments and advise on compliance before implementation.
Training & awareness measures
- Train facility managers and procurement staff on GDPR principles — particularly necessity, proportionality, and data minimisation — so compliance is considered before technology is purchased.
- Run annual refresher training for staff responsible for physical security decisions to reinforce the legal boundaries of employee and visitor surveillance.