[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8DgQC5-9pCCcXrfhM9xLyrSMU0ObTsYy38o2DSRHsgU":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":70},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"4f71c554-111c-45dc-bd99-6d4db640dfa2","Garante per la protezione dei dati personali (Italy) - 10297167","garante-per-la-protezione-dei-dati-personali-italy-10297167-adde0b","← Older revision Revision as of 06:18, 7 October 2026 Line 100: Line 100: }} }} The DPA fined a controller €10,000 for implementing surveillance in the workplace without the necessary information being provided to its employees and interested third parties, and in absence of a DPIA. The DPA fined an employer €10,000 for implementing CCTV workplace surveillance without informing its employees. Further, the DPA held that the controller failed to perform a DPIA prior to the processing. == English Summary == == English Summary == Line 121: Line 121: The DPA further emphasised that the controller failed to inform its staff and interested parties sufficiently of the surveillance practices, neither of the associated personal data processing happening, prior to its implementation. The DPA held that the lack of information and the fact that the signage was affixed after the processing had already taken place was insufficient. The DPA further emphasised that the controller failed to inform its staff and interested parties sufficiently of the surveillance practices, neither of the associated personal data processing happening, prior to its implementation. The DPA held that the lack of information and the fact that the signage was affixed after the processing had already taken place was insufficient. Finally, the DPA found that the controller implemented the video surveillance in its workplace, which considered of the processing of personal data of its employees, in absence of the necessary data protection impact assessment, contrary to [[Article 35 GDPR|Article 35 GDPR]]. Finally, the DPA found that the controller implemented the video surveillance in its workplace, which considered of the processing of personal data of its employees, in absence of the necessary data protection impact assessment, contrary to [[Article 35 GDPR]]. In light of the foregoing the DPA fined the controller €10,000 for violations of Articles 5(1)(a), 12, 13, 35 and 88 GDPR. In light of the foregoing the DPA fined the controller €10,000 for violations of Articles 5(1)(a), 12, 13, 35 and 88 GDPR.","Italy's Garante per la protezione dei dati personali has fined the National Institute of Meteorological Research €10,000 for implementing CCTV surveillance in the workplace without adequately informing employees and interested third parties. The authority also found that the controller failed to conduct a Data Protection Impact Assessment (DPIA) before initiating the processing, violating GDPR articles related to transparency, data processing impact assessments, and employee data.","Italian DPA fines employer €10,000 for unlawful workplace surveillance.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10297167&diff=53317&oldid=53263","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-10-07T06:18:27+00:00","2026-10-07T08:00:26.457889+00:00",7,[17,20,23],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"CCTV","product",{"name":24,"type":19},"National Institute of Meteorological Research","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,21],{"controls":51,"vendors":69},[52],{"slug":53,"name":54,"problem":55,"products":56},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[57,63],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":58,"product_name":59,"url":61,"description":62},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":64,"product_name":65,"url":67,"description":68},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":71,"title":72,"body":73,"framework_refs":74,"framework_notes":85},"italian-meteorological-institute-fined-for-unlawful-cctv-surveillance-without-dpia-or-employee-notic","Italian Meteorological Institute Fined for Unlawful CCTV Surveillance Without DPIA or Employee Notice","The National Institute of Meteorological Research violated GDPR by deploying workplace CCTV systems without properly informing employees and third parties of the surveillance, and without conducting a mandatory Data Protection Impact Assessment (DPIA) beforehand. These are foundational legal obligations under GDPR — transparency ensures individuals know their data is being processed, while a DPIA helps identify and mitigate privacy risks before processing begins. Skipping these steps is not merely a procedural oversight; it exposes organizations to regulatory fines and erodes employee trust. This case highlights that even public research bodies must treat privacy compliance as a prerequisite to deploying monitoring technologies, not an afterthought.",[75,76,77,78,79,80,81,82,83,84],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the context of employment","NIST SP 800-53 PT-1 (Privacy Policy and Procedures)","NIST SP 800-53 PT-3 (Personally Identifiable Information Processing Purposes)","NIST Privacy Framework PR.PO-P1 (Policies, Processes and Procedures)","CIS Control 3 – Data Protection","ISO\u002FIEC 29134 – Guidelines for Privacy Impact Assessment","ITIL Service Design – Information Security and Privacy Management",{}]