Autonomous Province of Bolzano/Bozen – €32,000 Fine (Italy, 2025)

In 2019, the Province of Bolzano (the controller) installed a network of 124 cameras aimed at analysing traffic flows as a basis for mobility and infrastructure policies in a UNESCO protected area. These cameras automatically read license plates, and also collected a series of metadata, including an identifier of the camera, date, time, class of the vehicle, its nationality, KEMLER identifier if present (relates to dangerous goods), and speed of transit. The license number immediately went through a double pseudonymisation process, with the license number being deleted within 60 seconds of its acquisition. The metadata on the other hand was stored for 2 years. The processor, which was the company providing the technology, was the only entity with access to the raw data and to the algorithm used. The controller only had access to the final aggregated data. The Province stated that the level of pseudonymisation in use means that they were not dealing with data that could be classified as personal data anymore. The DPA came across the facts through news outlets, and opened an investigation ex-officio. The Italian DPA held first of all that license plates are to be classified as personal data, even if pseudonymised. In fact, anyone could connect them to a natural person by consulting the public vehicle registry. It is irrelevant that this is not the intention of the controller. Referring to the pseudonymisation process put in place by the controller, the DPA pointed out that pseudonymised data is still considered personal data, as they could still be attributable to a natural person when read in conjunction with supplementary information. For example, the stored metadata could be used in this regard. It is also irrelevant that the license number is only stored for 60 seconds, as the duration of processing has no influence on the assessment of its lawfulness. The province, through its processor, was thus processing personal data and needs to comply with GDPR obligations. The controller failed to provide a valid legal basis for the processing. In its defence, the Province invoked Article 6 GDPR(1)(c) and (e) GDPR as legal bases, i.e. legal obligations and public interest. In particular, the processing of personal data was necessary to fulfil the objective of ensuring safety in the Dolomites mountain passes, which the Province has been tasked with through a 2019 administrative act. Additionally, other national laws give the Province full autonomy over landscape and environmental matters. However, the DPA held that the controller has failed to provide a sufficiently specific national legal act that could be a suitable legal basis, as the texts mentioned do not define the categories of data, storage periods, the operations and procedures of the processing, and measures to guarantee lawfulness and correctness. In any case, the controller failed to demonstrate how the measures put in place pass the test of necessity and proportionality. In light of this, the Italian DPA found the Province in breach of the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR, and in breach of Article 6(1)(c)(e), 6(2), and 6(3) GDPR. Following from the controllers failure to characterise the information at hand as personal data the DPA further found additional violations of Article 12(1) GDPR, Article 13 GDPR, Article 21(4) GDPR, Article 26 GDPR, and Article 35 GDPR. Finally, the DPA imposed a fine of €32,000 on the controller.