The Italian supervisory authority sanctions a professional for installing a video surveillance system filming public areas and recording sound, in violation of the principles of lawfulness, data minimization, and transparency.

Facts and context

The Italian data protection authority (Garante) issued a sanction decision against a professional, including a fine of 1,000 €, for breaches related to the installation of a video surveillance system.

The case began following a report from law enforcement (Carabinieri) after an inspection revealed the installation of three cameras filming public spaces outside a professional office.

Grounds for the decision

The authority found several breaches by the data controller:

• Obligation of lawfulness of processing (Article 5(1)(a) and Article 6 of the GDPR): The authority ruled that systematic surveillance of public spaces by a private actor is unlawful, as this prerogative is reserved for public authorities for security missions. The data controller could not rely on legitimate interest to justify footage extending mainly over public areas beyond their property perimeter. The Court of Justice case law (case C-212/13, Ryneš) is cited to exclude the domestic exception when surveillance extends to public space.
• Obligation of data minimization (Article 5(1)(c) of the GDPR): The processing was deemed excessive regarding the purpose of property protection. The authority emphasized that both the camera angles, which mainly captured public areas, and the audio recording were disproportionate and unnecessary to achieve the stated security objective. It refers in this regard to the European Data Protection Board Guidelines No. 3/2019.
• Obligation of transparency (Article 5(1)(a) and Article 13 of the GDPR): The absence of visible information signs indicating the presence of the video surveillance system constituted a violation of the obligation to inform data subjects, breaching the transparency principle.

Authority's decision

Consequently, the authority imposed a fine of 1,000 € on the data controller.

Furthermore, the authority ordered the publication of its decision on its website, after anonymizing the personal data of the data controller.

Lessons learned

This decision reminds that:

• Surveillance by a private individual, even for legitimate security reasons, cannot extend to public areas, as this activity is reserved for competent authorities.
• Audio recording by a video surveillance system, in a property protection context, is considered excessive and irrelevant data collection, violating the minimization principle.
• A data controller's legitimate interest in protecting their property constitutes a valid legal basis only if footage is strictly limited to the immediate surroundings of their property.
• The absence of clear and visible information signs constitutes a direct violation of the transparency principle and the information obligation under Article 13 of the GDPR.
• Rapid compliance following an inspection (reorienting cameras, disabling audio, installing signs) is a mitigating factor considered in determining the sanction amount but does not erase the initial infringement.