The Italian data protection authority sanctions a small business for the absence of video surveillance signage, reminding that rapid compliance, although a mitigating factor, does not erase the initial violation of the transparency principle.

Facts and context

The Italian data protection authority (Garante) has today published a sanction decision against the company Rosetta Trastevere s.r.l.s. (including the imposition of a fine of €700) for breaches related to informing individuals about a video surveillance system.

The case originated from a report by the Rome police, who found during an inspection on October 10, 2025, the absence of any signage informing of the presence of cameras in a commercial establishment.

Reasons for the decision

• Obligation of transparency and information (Article 5(1)(a) of the GDPR and Article 13 of the GDPR): The authority found that the establishment's video surveillance system was active and operational without any signage informing the data subjects. This absence violates the transparency principle, which requires the controller to inform individuals that they are about to enter a video-monitored area. The authority relies on its own previous decisions (provv. 8 April 2010) and on the European Data Protection Board (EDPB) Guidelines No. 3/2019, which detail the obligation to provide first-level information via a visible warning sign before entering the covered area.

Authority's decision

Consequently, the authority imposed a fine of €700 on the company Rosetta Trastevere s.r.l.s.

Furthermore, the authority ordered the company to bring its simplified signage into compliance by including the minimum required information, notably the identity of the controller, in accordance with the EDPB guidelines.

Lessons learned

This decision reminds that:

• The presence of signage informing of a video surveillance system is a fundamental and non-negotiable obligation to comply with the transparency principle.
• Rapid compliance after detecting a breach, while considered a mitigating factor, does not cancel the initial violation nor avoid a sanction.
• First-level signage must contain minimum information, such as the identity of the controller and the purpose, as specified by the EDPB guidelines; a simple pictogram is insufficient.
• When determining the amount of the fine, the authority takes into account the economic situation of the controller to ensure the proportionality of the sanction.
• Information signs must be positioned so that the data subject can become aware of the surveillance before entering the area covered by the cameras.