The Italian authority sanctions a company for incomplete video surveillance signage, reminding that the identity of the data controller and the retention period are essential first-level information.

Facts and context

The Italian data protection authority (Garante) has today published a sanction decision against the company Automania s.r.l. (including the imposition of an 800 € fine) for failures related to the information provided to individuals filmed by a video surveillance system.

The case originates from a report by the local police of Bari, transmitted to the authority, noting irregularities in the video surveillance signage of a car rental agency.

Reasons for the decision

• Obligation of information and transparency (Article 5(1)(a) of the GDPR and Article 13 of the GDPR): During an inspection, it was found that the video surveillance system's information panel did not indicate the identity of the data controller nor the retention period of the images, and no detailed information notice was available. The authority recalls that the principle of transparency, expressed through the obligation of information, requires providing data subjects with the essential elements of the processing. It relies on the European Data Protection Board (EDPB) Guidelines No. 3/2019 which specify that the most important information, such as the identity of the controller, must appear on the warning panel (first level of information) to enable individuals to exercise their rights. The absence of these mentions constitutes a violation of these obligations.

Authority's decision

Consequently, the authority imposed a fine of 800 € on Automania s.r.l.

Furthermore, the authority ordered the publication of its decision on its website.

Lessons learned

This decision reminds that:

• Information to individuals via video surveillance signage must follow the two-level model recommended by the EDPB, with the first level (the panel) necessarily containing the most important information.
• The identity of the data controller and the retention period of the images are indispensable mentions on the first-level information panel.
• Indicating the data controller on the signage is an essential condition to enable data subjects to effectively exercise their rights under Articles 15 and following of the GDPR.