Mrs XX - natural person – Violation Found (Italy, 2023)

On 6 July 2021, a station of the Italian Carabinieri reported to the DPA that the private party in this proceeding (the controller), installed a surveillance system on the external wall of her property. Reportedly, the surveillance system in question was recording the public area in front of the controller’s property, including a nearby playground and a public square. Pursuant to [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 157 of the Italian Privacy Code], the DPA opened a preliminary investigation. During the investigation carried out on 2 March 2023, the DPA noted that the video surveillance system was made up of two recording devices. The first camera, a 360-degree camera, was active and could record images as well as audio and speak through the microphone. The camera was positioned right above the entrance door, and the controller controlled the camera through a smartphone application. The second camera was connected but not active, and it was looking over the driveway that leads to the entrance of the building. In relation to the viewing angle of the cameras, the controller declared that the first camera, due to its characteristics, could also frame part of the nearby playground, although it was not in her interest to do so. She further clarified that the video surveillance had been installed due to incidents of damage or explicit threats received and that she wanted to utilise the footage for the purpose of lodging complaints. On 15 June 2023, the controller took measures to replace the first camera with a fixed camera model pointed only towards the entrance of her property to bring the processing in compliance with the GDPR. In the outcome of the investigation, the DPA first considered whether the GDPR applied to the data processing carried out by the controller. In principle, under Article 2(2)(c) GDPR, the use of video surveillance systems by natural persons in their private property for domestic purposes falls outside of the material scope of the GDPR. However, in order for the exemption to apply, the processing must not exceed the controller's domestic sphere, the images are not shared with third parties and there is no processing of public areas, communal areas or third parties' private property. The DPA also noted that in situations of actual risk, the controller may, on the basis of a legitimate interest, extend the area covered by cameras to areas outside its exclusive domain, provided that this is adequately justified and supported. In the present situation, however, the DPA believed that the controller had not demonstrated the existence of such an interest. Thus, the DPA held that up to 15 June 2023, when corrective measures were implemented, the controller had carried out processing of personal data not compliant with the GDPR. In particular, the processing of personal data was not compliant with the principles of lawfulness and data minimization. Therefore, the controller violated Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 6(1) GDPR considering that the first camera was also framing part of the playground in front of the controller's property. Taking into consideration that the controller replaced the camera in question, the DPA only issued a warning pursuant to Article 58(2)(b) GDPR.