Garante per la protezione dei dati personali (Italy) - 10297167
Italian DPA fines research institute €10,000 for workplace surveillance violations.
The Italian Garante per la protezione dei dati personali has fined the National Institute of Meteorological Research €10,000 for implementing workplace video surveillance without adequately informing employees and third parties. The institute also failed to conduct a Data Protection Impact Assessment (DPIA) before installing additional cameras and altering their locations, which was deemed incompatible with their trade agreement.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe National Institute of Meteorological Research failed to meet basic GDPR obligations by deploying workplace video surveillance without properly informing employees and third parties of its existence or purpose. Compounding the violation, the institute expanded and relocated cameras without conducting a mandatory Data Protection Impact Assessment (DPIA), a critical safeguard required when processing activities pose high risks to individuals' rights. This case highlights how physical security measures are not exempt from data protection law and must follow the same compliance lifecycle as digital data processing. Organizations that treat surveillance as a purely operational decision—rather than a legal and privacy matter—expose themselves to regulatory fines and reputational harm.