Garante per la protezione dei dati personali (Italy) - 10297167
Italian DPA fines employer €10,000 for unlawful workplace surveillance.
Italy's Garante per la protezione dei dati personali has fined the National Institute of Meteorological Research €10,000 for implementing CCTV surveillance in the workplace without adequately informing employees and interested third parties. The authority also found that the controller failed to conduct a Data Protection Impact Assessment (DPIA) before initiating the processing, violating GDPR articles related to transparency, data processing impact assessments, and employee data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe National Institute of Meteorological Research violated GDPR by deploying workplace CCTV systems without properly informing employees and third parties of the surveillance, and without conducting a mandatory Data Protection Impact Assessment (DPIA) beforehand. These are foundational legal obligations under GDPR — transparency ensures individuals know their data is being processed, while a DPIA helps identify and mitigate privacy risks before processing begins. Skipping these steps is not merely a procedural oversight; it exposes organizations to regulatory fines and erodes employee trust. This case highlights that even public research bodies must treat privacy compliance as a prerequisite to deploying monitoring technologies, not an afterthought.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.