The Italian authority sanctions a restaurateur for non-compliant video surveillance signage, reminding that the primary level information must mandatorily include the identity of the data controller and the purposes, and cannot be limited to a simple pictogram.

Facts and context

The Italian data protection authority (Garante) has today published a sanction decision against the company Ristorante Carlo Menta s.r.l. (including the imposition of a €1,400 fine) for breaches related to the information provided to individuals filmed by its video surveillance system.

The case originated from a report by the Rome police prefecture which, during an inspection on 24 October 2025, found the absence of signs informing about the presence of an active video surveillance system recording images inside and outside the establishment.

Reasons for the decision

• Obligation of transparency and information (Article 5(1)(a) of the GDPR and Article 13 of the GDPR): The authority found that the restaurateur had not implemented signage informing customers and employees of the presence of the video surveillance system. It dismissed the company's argument that a sticker existed but was temporarily covered, considering it not credible and contradicted by the official report. Above all, the authority judged that even if this sticker had been present, it would have been non-compliant as it contained only a pictogram, without the minimal primary level information required by the European Data Protection Board (EDPB) Guidelines No. 3/2019, such as the identity of the data controller and the purposes pursued.

Authority's decision

Consequently, the authority imposed a €1,400 fine on Ristorante Carlo Menta s.r.l..

Furthermore, the authority ordered the company to bring its signage into compliance by including the required minimal information (notably the identity of the data controller and the purposes), and to position it so that it is clearly visible to data subjects before entering the monitored areas.

Lessons learned

This decision reminds that:

• Primary level video surveillance signage cannot be limited to a simple pictogram; it must mandatorily contain essential information, notably the identity of the data controller and the purposes of the surveillance.
• Information signs must be positioned so that any person can become aware of the surveillance before entering the filmed area, thus allowing them to adapt their behavior.
• Factual findings established in an official report by a public authority during an inspection prevail over subsequent statements by the data controller that were not made at the time of the inspection.
• The implementation of corrective measures after the finding of a breach, even if still imperfect, can be considered a mitigating factor in determining the amount of the sanction.