The Italian data protection authority (Garante) sanctioned the municipality of Arvier for the use of a non-compliant video surveillance system. The main breaches concern the absence of a clear and specific legal basis for the administrative purposes invoked, the violation of the minimization principle by capturing a private residence without masking, as well as failures in transparency and conducting a data protection impact assessment within the required deadlines.

Facts and context

The Italian data protection authority today published a sanction decision against the municipality of Arvier (including the imposition of a fine of €20,000) for breaches related to the installation and management of its video surveillance system on public roads.

The case originated from a complaint by a resident who complained that a municipal camera was filming her private home.

Reasons for the decision

The authority found several GDPR violations, based on the following reasoning:

• Lawfulness obligation of processing (Article 5(1)(a) and Article 6 of the GDPR): The municipality justified the processing by various administrative purposes (territory management, road control, heritage protection) relying on general provisions of the Consolidated Law on the organization of local authorities and on a regional law relating to the financing of security projects. The authority deemed this legal basis insufficient, recalling that, pursuant to Article 6(3) of the GDPR and recital 41, the norm underpinning processing by a public authority must be clear, precise and foreseeable. The invoked texts, which attribute general administrative competences or govern financial aspects, do not meet this quality requirement and cannot constitute a valid legal basis for data processing by video surveillance, as also specified in Article 2-ter of the Italian Data Protection Code.
• Data minimization and data protection by design obligation (Article 5(1)(c) and Article 25 of the GDPR): The camera in question filmed the facade of the complainant's private residence. The authority noted that the municipality only implemented a permanent digital masking measure after the complaint was filed. The fact that this technical measure was available and was not applied from the installation constitutes a violation of the principles of minimization and data protection by design, as the processing was not limited to what was strictly necessary in view of the purposes pursued.
• Transparency obligation (Article 5(1)(a), Article 12 and Article 13 of the GDPR): The information provided to data subjects was deemed deficient. The number of first-level information signs was initially insufficient and the second-level information, supposed to be available on the municipality's website, was actually inaccessible due to a broken link, which prevented data subjects from effectively exercising their rights.
• Data protection impact assessment obligation (Article 35 of the GDPR): The municipality conducted a data protection impact assessment on 30 July 2018. The authority emphasized that for high-risk processing already ongoing on 25 May 2018, the GDPR's effective date, this assessment should have been carried out no later than that date. The delay in performing this formality therefore constitutes a breach.

Authority's decision

Consequently, the authority imposed a fine of €20,000 on the municipality of Arvier.

Lessons learned

This decision reminds that:

• A legal basis for processing by a public authority, such as video surveillance, must be provided by a clear, precise and foreseeable legal norm that specifically regulates the processing; legislative provisions attributing general administrative competences are not sufficient.
• The principle of data protection by design requires implementing technical measures, such as masking private areas, from the installation of a video surveillance system, and not afterwards in response to a complaint.
• For high-risk processing pre-existing the GDPR's effective date, a data protection impact assessment had to be carried out no later than that date (25 May 2018).