[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fndIgfBtt1WzK9SLzwi1VZhvbApLPXvOEJBnMxWtMozc":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"efb1a0cf-9aac-4756-9264-eef1c930869c","Garante per la protezione dei dati personali (Italy) - 10297167","garante-per-la-protezione-dei-dati-personali-italy-10297167-ed54f6","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10297167 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10297167 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","The Italian Garante per la protezione dei dati personali has fined the National Institute of Meteorological Research €10,000 for implementing workplace video surveillance without adequately informing employees and third parties. The institute also failed to conduct a Data Protection Impact Assessment (DPIA) before installing additional cameras and altering their locations, which was deemed incompatible with their trade agreement.","Italian DPA fines research institute €10,000 for workplace surveillance violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10297167&diff=53263&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-10-01T12:13:08+00:00","2026-10-01T14:00:16.726048+00:00",7,[17,20,23],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"video surveillance","product",{"name":24,"type":19},"National Institute of Meteorological Research","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,21],{"controls":51,"vendors":52},[],[],{"slug":54,"title":55,"body":56,"framework_refs":57,"framework_notes":66},"italian-research-institute-fined-for-unlawful-video-surveillance-of-employees","Italian Research Institute Fined for Unlawful Video Surveillance of Employees","The National Institute of Meteorological Research failed to meet basic GDPR obligations by deploying workplace video surveillance without properly informing employees and third parties of its existence or purpose. Compounding the violation, the institute expanded and relocated cameras without conducting a mandatory Data Protection Impact Assessment (DPIA), a critical safeguard required when processing activities pose high risks to individuals' rights. This case highlights how physical security measures are not exempt from data protection law and must follow the same compliance lifecycle as digital data processing. Organizations that treat surveillance as a purely operational decision—rather than a legal and privacy matter—expose themselves to regulatory fines and reputational harm.",[58,59,60,61,62,63,64,65],"GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the context of employment","NIST SP 800-53 IP-1: Individual Consent","NIST SP 800-53 AR-1: Governance and Privacy Program","CIS Control 3: Data Protection","ISO\u002FIEC 27701 Section 7.2.3 – Privacy Impact Assessment","ITIL Service Design – Compliance and Legal Requirements",{"CIS Control 3: Data Protection":67,"NIST SP 800-53 IP-1: Individual Consent":68,"NIST SP 800-53 AR-1: Governance and Privacy Program":69,"ISO\u002FIEC 27701 Section 7.2.3 – Privacy Impact Assessment":70,"ITIL Service Design – Compliance and Legal Requirements":71,"GDPR Article 88 – Processing in the context of employment":72,"GDPR Article 35 – Data Protection Impact Assessment (DPIA)":73,"GDPR Article 13 – Information to be provided where personal data are collected from the data subject":74},"Data protection controls cover knowing what personal data, such as CCTV footage, is collected and why.","Requires informing individuals or obtaining consent where needed, here letting staff know about the cameras.","Requires a privacy programme with governance, which would have triggered notices and a DPIA for camera changes.","Requires privacy impact assessments, which the institute skipped when expanding surveillance.","Building legal requirements into service design would have flagged the need for notices and a DPIA.","Allows specific rules on employee monitoring, which in Italy require safeguards for workplace cameras.","A DPIA was required before expanding and relocating cameras, and was not carried out.","Requires informing employees and visitors about video surveillance and its purpose, which the institute failed to do."]