Comune di Orte (data controller) – €20,000 Fine (Italy, 2022)

A citizen of Orte filed a complaint against their municipality. The municipality of Orte is the controller and the citizen is the data subject. The controller installed photo-traps to prevent and punish illegal garbage disposal. The data subject submitted a request to the municipality under law 241/1990 for access to the surveillance system's administrative documents. The controller only gave him the supplier's (the urban cleaning company) technical offer. The data subject then filed a complaint with the DPA alleging that that (1) the municipality neglected to publish any information in the Municipal Notice Board (Albo Pretorio) and (2) he had been recorded several times. The controller claimed that the photo-traps were installed as part of an adjudication procedure for the urban cleaning service. The controller admitted that it adopted none of the administrative acts required by Italian law in order to lawfully operate the photo-traps. A municipal regulation on camera surveillance had been drafted, but not approved, according to the controller. Furthermore, the controller admitted it had not informed the citizens of the surveillance system's installation. Moreover, no agreement relating to the processing of the data collected by the cameras was concluded with the supplier. The controller later stated (past the deadline) that it only operated the photo-traps for a short time in order to verify their functionality. Some cameras were also installed for deterrence purposes. These cameras were not activated and did not collect data at that time. The controller eventually removed all of the cameras. The municipality claimed that they never processed any personal data aside from those collected in the testing phase, and that they never sanctioned any citizen based on the data collected through the surveillance system. During the preliminary investigation, the DPA also found that the contact information for the municipality’s DPO were the same as the contact information for the municipality itself. The DPA held that the controller failed to adopt a privacy policy and to implement technical and organizational measures to ensure compliance with the GDPR before installing the surveillance system. By doing so, the controller violated the principles of lawfulness, fairness and transparency, storage limitation and accountability of Article 5(1) GDPR, Article 24 and Article 25. The DPA clarified that information on video surveillance systems should be provided to the data subject through a layered approach. On this point the DPA referenced the EDPB GuidelinesEDPB Guidelines 3/2019 on processing of personal data through video devices', 29 January 2020 (version 2.0). available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en/ here] as well as its own guidelines.Provvedimento in materia di videosorveglianza - 8 April 2010 [1712680], par. 3.1, available [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1712680/ here] The DPA also held that the controller violated its duties of information under Article 12(1) and Article 13 by neglecting to inform the data subjects about the surveillance system, and to provide any information required under Article 13 at all. Additionally, the DPA held that the controller violated Article 37(7), as it did not provide the DPA with direct contact information of their DPO. The DPA stated that supervisory authorities must be able to contact the DPO directly. The contact information must be specific to their DPO and distinct from the controller's. In this regard, the DPA referenced the Working Party 29 Guidelines'Guidelines on Data Protection Officers', 16/EN WP 243 rev.01, 13 Dec 2016, par. 2.6. available [https://ec.europa.eu/newsroom/article29/items/612048/ here] (as well as their own guidelines on DPOs in the public sector).Provvedimento del 29 aprile 2021 - Documento di indirizzo su designazione, posizione e compiti del Responsabile della protezione dei dati (RPD) in ambito pubblico [9589104] (RPD) in ambito pubblico”, [9589104]. available [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9589104/ here] The DPA fined the controller for €20,000 and ordered it to provide new and direct contact information of their DPO.