La Combricola dei Birichini di Betty – €10,000 Fine (Italy, 2025)

The controller for the case is a private children's daycare. A parent filed a complaint with the DPA after finding that the controller published pictures of children online, including invasive pictures of rather delicate moments of their daily lives. During the investigation the DPA found that the controller implemented invasive CCTV surveillance on its premises and did not carry out a DPIA with regards to the system. The DPA held that the controller violated Articles 5(1)(a), 6, 7, 12(1), 13, 35, 37(7) and 38(6) GDPR as well as Article 2-ter of Italy’s “Privacy Code” (d. lgs. 196/2003). The DPA issued a €10,000 fine. The DPA also ordered the controller to stop publishing children’s pictures, erase all the pictures still available online, and delete any pictures it stored. In determining the fine, the DPA considered that by the time of the decision, the controller had removed (most of) the pictures, had appointed a new DPO, and had taken other steps towards compliance. = The DPA found that many pictures of the children in the controller’s care, were publicly available on the controller’s website as well as on its Google Maps business profile. Some of the pictures included rather delicate moments of the children’s daily lives. The controller pointed out that during enrolment, parents signed a consent form that covered the publication of children’s pictures for education purposes and for advertising the controller’s activities. On this basis, the controller claimed that it lawfully published the pictures under the legal basis of consent. The DPA rejected the argument, for several reasons. The DPA clarified that parental consent must be exercised in the pursuit of the child’s best interestWith regards to the centrality of the best interest of the child, the decision refers to WP29 guidance on the protection of children's data: see WP29, 'Working Document 1/2008 on the protection of children's personal data (General guidelines and the special case of schools)', 19 February 2008 (available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2008/wp147_en.pdf here]).. The DPA then held that in the case at hand, the publication of children’s picture was radically against their best interest and exposed them to very serious risks. On these grounds, the DPA concluded that in the case at hand, parental consent was not a legal basis for publishing the pictures. Secondarily, the DPA clarified that the publishing of children’s picture (when at all admissible) requires the consent of both parents. The controller also noted that the controller failed to collect consent from both parents. Finally, the DPA found several issues with the consent form signed by parents: * the purposes of the processing were only described vaguely. In particular, the form did not explain that very delicate pictures of children would be published. On these grounds, the DPA held that consent was not informed. * Parents signed a single consent covering a number of distinct purposes for processing data. Therefore, their consent was not granular. * The DPA held that consent was not freely given because the controller’s consent form incorrectly stated that refusing consent was grounds for non-admission of a child. On these grounds, the DPA held that the controller unlawfully published the pictures, in violation of Articles 5(1)(a), 6 and 7(2) GDPR as well as Article 2-ter of d. lgs. 196/2003 (Italy's so-called "Privacy Code"). = With regards to the CCTV system, the controller stated that the purpose of the processing was to ensure the safety of the children and to ensure that the controller’s staff did not commit any crime. The controller also stated that the CCTV system was installed based on a local lawRegione Lombardia, l. r. 18/2018 (available [https://normelombardia.consiglio.regione.lombardia.it/NormeLombardia/Accessibile/main.aspx?iddoc=lr002018120600018&view=showdoc here]) that provided financing for educational institutions implementing such systems. The controller claimed that the use of CCTV was authorized under this law. The controller also claimed that a DPIA was unnecessary, as the legislator had already carried out the balancing of the relevant interests in adopting the law. The DPA rejected the controller’s arguments. The DPA pointed out that employment law only allows for remote surveillance on the workplace for specific and exhaustively listed purposes. In particular, employment lawLaw 300/1970 is particularly relevant here. See the comments for more information about the DPA's reasoning on the relationship between employment and data protection law. does not allow employers to carry out direct surveillance of workers for the purpose of finding out whether they committed any crimes on the workplace. The DPA clarified that such a purpose falls outside the competence of employers and is reserved to law enforcement authorities. The DPA also clarified that the local law invoked by the controller, merely financed the installation of CCTV. Contrary to the controller’s claims, the law did not authorize the processing of personal data and did not exempt the controller from carrying out a DPIA. On these grounds, the DPA held that the controller violated the general principles of Article 5(1)(a) GDPR as well as Article 6 GDPR and 144 d. lgs. 196/2003. = During the investigation, the DPA found that the controller appointed the headmaster as the DPO. The DPA held that the headmaster was unsuitable for the role because they were not impartial and because they lacked the time to properly carry out a DPO’s obligations. On these grounds, the DPA held that the controller violated Article 38(6) GDPR. The DPA also held that the controller violated Article 37(7) GDPR by failing to communicate the DPO’s contact details to the DPA. = Finally, the DPA found a number of transparency violations relating to both the publications of children's pictures, and the use of the CCTV systems. All the notices relative to those data processing operations were vague, incomplete, and at times incorrect. Additionally, the controller failed to demonstrate that it provided the employees with a specific notice detailing the processing of their data via the CCTV system. On these grounds, the DPA found that the controller violated Articles 5(1)(a), 12 and 13 GDPR.