The Italian data protection authority (GPDP) has issued a sanction decision against the Special Company for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S.) for breaches related to the installation of video surveillance cameras in the changing rooms of a swimming pool.

Facts and context

The case began following press articles and reports concerning the presence of cameras in a changing room intended for users of a swimming pool managed by the company.

Grounds for the decision

• Obligation of lawfulness, fairness and transparency of processing (Article 5(1)(a) of the GDPR) and to have a valid legal basis (Article 6(1)(c) and (e) of the GDPR): The authority found that the company had installed cameras filming lockers in the changing rooms to prevent theft. It deemed this processing unlawful, as changing rooms are places where the expectation of confidentiality is particularly high, making the surveillance excessively intrusive and disproportionate to the purpose of protecting property. The authority emphasized that a union agreement, although concluded in 2007 in accordance with Italian labor law, cannot legitimize processing that contravenes the principles of necessity and proportionality of the GDPR, as confirmed by the case law of the Court of Justice of the European Union (judgment C-65/23). Furthermore, the company did not demonstrate having assessed less invasive alternative measures, such as the use of personal padlocks, as suggested by the European Data Protection Board (EDPB) Guidelines 3/2019.
• Obligation of transparency and information to data subjects (Article 12(1) and Article 13 of the GDPR): Information about video surveillance was provided by a single sign located at the entrance of the establishment. The authority considered this measure insufficient, referring to the EDPB Guidelines 3/2019 (paragraph 113), which specify that information must be positioned so that the data subject can understand the circumstances of the surveillance before entering the monitored area. A general notice at the entrance is not sufficient to adequately inform users of the presence of cameras in specific and sensitive areas such as changing rooms, where the expectation of privacy protection is highest.

Authority's decision

Consequently, the authority imposed a sanction on the Special Company for the Management of Sports Facilities of the Municipality of Trento (A.S.I.S.) amounting to 8000 euros.

Lessons learned

This decision reminds that:

• Video surveillance in places with a high expectation of confidentiality, such as changing rooms or toilets, is in principle considered excessively intrusive and disproportionate, even if aimed at protecting property.
• A collective labor agreement authorizing video surveillance at the workplace cannot legitimize data processing that violates the fundamental principles of the GDPR, notably those of necessity and proportionality.
• Information about video surveillance must be provided in a way that data subjects can know about the existence of the system before entering the monitored area; a single sign at the entrance of a large complex is insufficient for the specific and sensitive areas it contains.