The activation of a video surveillance system, even in a testing phase and without recording, constitutes processing of personal data that must comply with all the obligations of the GDPR, notably the legal basis and transparency.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) has today published a sanction decision against the National Institute of Metrological Research (INRIM) (including the imposition of a fine of €20,000) for breaches related to the installation and activation in the testing phase of a video surveillance system at the workplace.

The case originated from complaints by two employees concerning the activation of a video surveillance system in violation of the union agreement and without prior information to the data subjects.

Grounds for the decision

• Lawfulness obligation of processing (Article 5(1)(a), Article 6(1)(c) and Article 88 of the GDPR): The authority recalls that the processing of employees' personal data by video surveillance must be based on a valid legal basis, which, under Italian law, is conditioned on compliance with Article 4 of Law No. 300/1970 (Workers' Statute). This provision, which constitutes a more specific measure within the meaning of Article 88 of the GDPR, requires a prior collective agreement. In this case, although an agreement was signed on 16 May 2025 for the installation of 10 perimeter cameras, the institute installed 18 and changed their location, which constitutes an alteration of the viewing zones prohibited by the agreement itself. The activation of the system, even in the testing phase without recording but with real-time viewing during working hours, constituted processing of personal data not compliant with the modalities provided by the agreement, and therefore lacked a legal basis. The authority relies on the Guidelines 3/2019 of the European Data Protection Board (EDPB), Opinion 2/2017 of the Article 29 Working Party, and the case law of the European Court of Human Rights (Antovic and Mirković v. Montenegro case).
• Transparency obligation (Article 12(1) and Article 13 of the GDPR): The institute acknowledged not having provided information on data processing to the staff before activating the system in the testing phase, considering that it was not yet in "operation." The authority judged that processing began from the first activation, on 31 October 2025, making prior information to the data subjects mandatory. The posting of a first-level signage on 17 November 2025 was therefore late and insufficient to meet the transparency requirement from the start of processing.
• Obligation to carry out a data protection impact assessment (Article 35 of the GDPR): The institute admitted having postponed the impact assessment until the finalization of the technical and organizational configuration of the system, but before its official commissioning. The authority concluded that this assessment must be conducted *before* the start of processing, i.e., before the activation of the system, even in the testing phase. Its purpose is precisely to assess and mitigate risks upstream of any processing operation, which was not done.

Authority's decision

Consequently, the authority imposed a fine of €20,000 on the National Institute of Metrological Research (INRIM).

Lessons learned

This decision reminds that:

• The testing phase of a processing device, such as video surveillance, constitutes full personal data processing and must, as such, comply with all GDPR obligations from its commencement.
• The legal basis for monitoring employees at the workplace relies on strict compliance with conditions set by specific national provisions (collective agreement or administrative authorization); any substantial modification not provided for by these frameworks renders the processing unlawful.
• The data protection impact assessment and information to data subjects are prior obligations that must be fulfilled before any system activation, including for calibration or technical verification phases.