Comune di Trento – €50,000 Fine (Italy, 2024)

The Italian DPA received the news about a new AI-driven surveillance system implemented by the municipality of Trento, the controller, with the support of FBK, a research foundation. In the context of a social experiment, the controller allowed the deployment of three projects, “Marvel” and “Protector”, concluded by now, and “Precrisis” still to be activated, using AI systems that were developed by the foundation in order to collect data from public areas in the municipality by means of videocameras and microphones that could serve the aim of preventing potential situations of danger to the public. Upon learning about these facts, the DPA initiated an investigation into the processing operations related to the above mentioned projects by the controller and asked it to provide further information. Among other things, the controller specified that the projects were EU-funded and provided details about the technical functioning of each of them. In particular, “Marvel” is aimed at developing an automated system analysing real-time audiovisual scenes in order to detect urban security issues. The foundation has access to the recordings of the public cameras in the municipality, which are instantly anonymized and analysed in the workstations of the foundation. The “Protector” project instead is aimed at improving security around places of worship, especially against the risk of hate crimes and terror attacks. The platform acquires video data from cameras present in the areas around places of worship and textual data derived from social media hate comments which are then elaborated by an AI system in order to detect possible relevant risks. Here too, the foundation has real-time access to the recordings which are instantly anonymized. Lastly, as regards the “Precrisis” project, the controller submitted that this has not been implemented yet but will be activated soon, upon adopting the necessary measures for ensuring compliance with the GDPR. Further, the controller submitted, with regard to all three projects, that the legal basis for such processing is Article 6(1)(e) GDPR and the controller referred to [https://www.parlamento.it/parlam/leggi/09038l.htm Italian Law n. 38/2009] that grants competence to municipalities to adopt video-surveillance systems to improve urban security and to [https://www.astrid-online.it/static/upload/regi/regione-trentino2.pdf Regional Law of 3 May 2018], granting the municipality generic competence on the development of social, cultural and economic projects. Further, the controller claimed that since the projects are still in their development stage, the provisions of the GDPR would only start applying when these are activated. Moreover, the controller added that such research projects would also be carried out in line with the provision in Article 89 GDPR. Last, the controller submitted that it nominated the research foundation as a processor under Article 28 GDPR for the future processing of personal data that will take place once the projects are activated. The DPA responded to these and further submissions by the controller stating that it would start proceedings aimed at the adoption of corrective measures against the controller for unlawful processing activities. Following an extensive investigation, the DPA came to its conclusions regarding the processing of personal data by the controller. The DPA found, with respect to the first two projects, that, even though the projects were experimental and no data was being used for actual crime prevention purposes, the controller was still carrying out processing of personal data relating to criminal conviction and offences under Article 10 GDPR. In fact, the algorithms were trained on data collected from the cameras already present in the territory of the municipality with the aim of detecting and documenting criminal activity and might thus include the processing of videos recording criminal activities. Further, the DPA did not believe that the controller could claim in good faith that no actual processing was being carried out yet because the projects were still experimental, as the controller itself indicated the roles, purposes and legal basis for such processing. The DPA also confirmed the municipality's role as a controller and the fact that it may be subject to the imposition of a fine, even if certain activities were carried out by a processor on its behalf, making reference to C-683/21. The DPA then assessed the anonymization techniques in place. The controller submitted that it adopted anonymization techniques right after collecting the data: the alteration of voice sounds in the voice recordings and the blurring of people’s faces in the videos. The DPA found these techniques to be inadequate as they did not guarantee a full anonymization of the personal data collected. Also, with respect to the data collected from social media platforms, the data were merely pseudonymysed and did not anonymized, as the controller claimed, hence their processing had to be compliant with the GDPR. Furthermore, the DPA found that the data was being processed contrary to the principles of lawfulness, fairness and transparency under Article 5(1)(a) GDPR. As regards the principle of lawfulness, the DPA considered that the [https://www.astrid-online.it/static/upload/regi/regione-trentino2.pdf Regional Law] granting the municipality generic competence on the development of social, cultural and economic projects identified by the controller cannot constitute a valid legal basis in line with Article 6(1)(e) GDPR, Article 6(2) and (3) GDPR nor with Article 9(2)(g) GDPR. Making reference to case law of the CJEU and of the ECtHR and taking into account [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 52(1) CFREU], the DPA held that, for processing to be based on a law, the law itself must provide for specific rules on the scope and limits to the processing operations and the processing must be reasonably expected by the data subjects. Similarly, the DPA held that the controller could not justify the processing on the basis of [https://www.parlamento.it/parlam/leggi/09038l.htm Law n. 38/2009 on urban security] which allows the use of cameras for the sole purpose of contrasting and preventing crime and could not be relied on for further processing. Also with respect to the controller’s defence that Article 89 GDPR could apply to the processing operations, the DPA held that the controller as a municipality failed to prove that it is to be considered a research institute. In light of this, the DPA also considered that the sharing of poorly anonymized or pseudonymized personal data to the processor occurred in violation of Article 5(1)(a) GDPR and lacked a legal basis. Hence, so the DPA, the controller acted in violation of Articles 5, 6, 9 and 10 GDPR. As regards transparency, the DPA held that the controller violated Article 13(1)(c) and (e) GDPR, Article 13(2)(a), (b) and (d) and Article 14 GDPR as it failed to properly provide information about the processing operations. Lastly, the DPA also held that the controller violated Article 35 GDPR as it failed to properly carry out a DPIA and it should have also considered consulting the DPA prior to processing according to Article 36 GDPR, as the case involved large scale public surveillance. In light of the above findings and considering the provision in Article 83(2) and (3) GDPR, the DPA held that it was appropriate to impose a fine in the amount of €50,000 on the controller.