Immobiliare Riscostruzione Meloria s.r.l. – €2,000 Fine (Italy, 2022)

The local police of Milan received a complaint about a video surveillance system installed in a building owned by Immobiliare Ricostruzione Meloria s.r.l. (controller). The police investigated the matter and drew up a report. Based on this report, the Italian DPA opened an investigation into the controller. The controller allegedly installed the system at the request of some tenants of the building. The system consisted of four cameras: one filming the entrance, one the space in front of the lift, and two others facing the backyard, the cellars and a flat. The images taken by the cameras were displayed on a monitor and stored on a recording device, both located in the porter's lodge. The only information concerning the video surveillance system which passer-bys received consisted of a sign with a figure of a stylised camera placed on the left-hand side of the entrance door to the building. No further information about the processing activity or the data controller was provided, not even on the premises of the porter's lodge. The DPA held that the use of a video surveillance system may constitute a processing of personal data, depending on the positioning of the cameras and on the quality of the images taken. In the case at hand, this was the case. The DPA noted that any processing of personal data had to be carried out in accordance with the principles laid down in Article 5 GDPR, and in particular, the principle of transparency. The DPA stated that, with regard to the use of video surveillance systems, the principle of transparency could be respected by displaying information signs indicating the data controller and the purpose of the processing, so that data subjects were always aware that they were entering a video surveilled area. However, the mere display of the sign of the stylised camera at the entrance of the building did not sufficiently inform data subjects about the processing nor about their means to exercise their rights as required by Article 13 GDPR. As a result, the processing activity carried out through the use of the video surveillance system violated Article 5(1)(a) and Article 13 GDPR. Consequently, the DPA ordered the Company to install proper information signs and imposed a fine of €2,000.