Naija Market International – €6,000 Fine (Italy, 2022)

Following a report received from the police on 15 July 2020, the Italian DPA sent two requests for information to the owner of Naija Market International, the controller, a company engaged in the grocery business in Modena. These requests sought further information regarding the installation of a video surveillance system on store premises. After the controller did not comply with the requests, the Italian DPA carried out an inspection at the controller's two operating sites, which revealed the presence of video surveillance cameras filming interior spaces of the establishments and therefore potentially suitable for monitoring the work activities of the controller's employees. The cameras were operating in the absence of the appropriate information signs, an alleged violation the Article 5(1)(a) GDPR principle of lawfulness, fairness, and transparency, and the transparency obligations in Article 13 GDPR. Furthermore, the surveillance system was installed without first obtaining permission from the territorially competent Labour Department, in violation of Italian Law. Responding to the allegations, the controller claimed to be unaware of the obligation to inform the Labour department and, because they are a foreign national, unable to understand the particularly technical data protection regulation. Moreover, the controller argued that the conduct involved only 3 employees, and therefore this was only a minor violation. The Italian DPA did not accept the controller's submissions, and held that the use of the video surveillance system constituted a processing of personal data which had to be carried out in accordance with the general principles contained in Article 5 GDPR, in particular the principle of transparency. In this case, the processing had not been signalled in any way and the controller failed to provide any information notice to its employees. According to the Italian DPA, the controller therefore violated Article 5(1)(a) and 13 GDPR. In addition, the Italian DPA held that the processing had also been carried out in violation of Article 114 of Legislative Decree No. 196/2003 (the Privacy Code). Article 114 Privacy Code introduces a special regime regarding the processing of employees' personal data, in line with the provisions of Article 88 GDPR; which allows for Member States to provide more specific rules to ensure the protection of data subject rights and freedoms in this context. Article 114 Privacy Code stipulates that in the case of processing that can result in remote monitoring of workers it is necessary to comply with Article 4, Law No. 300/1970 (Statute of Workers). Article 4 Statute of Workers stipulates that in such cases, video surveillance equipment can be used after entering into a collective agreement with the trade union representation or, where this is not possible, after obtaining prior authorisation from the competent work council. Given that the installation of the video surveillance system had not been previously authorised by the work council, the processing violated Article 114 Privacy Code. Lastly, by failing to reply to the Italian DPA's request within the prescribed time limit, the controller also breached the obligation to provide the information requested by the DPA under Article 157 Privacy Code. Therefore, the Italian DPA held that the controller had violated Articles 5(1)(a) and 13 GDPR, in addition to Articles 114 and 157 of the Privacy Code. Pursuant to Article 58(2)(i) GDPR and 83 GDPR, the DPA imposed an administrative fine of €6,000.00, and an order to affix the required information signs, to obtain to required permission from the Labour Department, and communicate the steps taken in this respect within 90 days from the date of notification of the order.