DPA case 9896808; – Violation Found (Italy, 2023)

A "ShareArt" project was implemented in the Municipal Art Collections of Palazzo D'Accursio in Bologna in order to obtain information on the characteristics of the visitors and on the ways in which they interacted with some works of art. The project followed a collaboration agreement between ENEA and the Bologna Museums Institution which is an instrumental body of the Municipality of Bologna (the “Municipality”). The information was collected with a system using a face detection algorithm (“ShareArt”) developed by the National Agency for New Technologies, Energy and Sustainable Economic Development (“ENEA”). The face detection algorithm was based on convolutional neural networks (CNN) to detect faces in the images. Visitors were informed about the system with a notice at the ticket office that stated, inter alia, that the algorithm "does not imply face recognition”. An Italian civil rights organisation (Hermes Center for Transparency and Digital Human Rights) submitted a report to the Italian DPA in relation to the used ShareArt system. The report stated, inter alia, that ShareArt, using a camera, automatically detected faces looking in the direction of art work, contextually acquiring a series of information relating to behaviour when observing works of art. The report highlighted that only very few signs were in place to indicate to the museum visitors that the system was used: small black cameras attached to the walls and a disclaimer at the ticket office. Following the report, the DPA launched an investigation and requested for information from the Municipality as well as ENEA. The parties argued, inter alia, that the system does not involve the collection and processing of data relating to identified or identifiable natural persons. Moreover, the Municipality viewed that it did not have any kind of role with regard to the data processing. Contrary to what was claimed by the controllers, the DPA found that the face detection algorithms process personal data