[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo3r1cJoln0DL_JlyLFQZl9Q-HqfUa8E7HypzvuCRTKE":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":66},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"677b6651-6365-4184-934e-b65ccff569f1","Garante per la protezione dei dati personali (Italy) - 457\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-457-2026-53a425","Holding ← Older revision Revision as of 19:45, 21 July 2026 Line 89: Line 89: The DPA also found a violation of [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]], as the controller failed to comply with the principle of data minimisation. The DPA stated that the controller had failed to ensure that the cameras only captured the vehicles’ license plates, and had therefore processed more data than necessary. The DPA also found a violation of [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]], as the controller failed to comply with the principle of data minimisation. The DPA stated that the controller had failed to ensure that the cameras only captured the vehicles’ license plates, and had therefore processed more data than necessary. Finally, the DPA found a violation of Article 35, as the controller had prepared a data protection impact assessment (DPIA) after the processing activities began. The DPA noted that the DPIA was also not specific enough. Finally, the DPA found a violation of [[Article 35 GDPR]], as the controller had prepared a data protection impact assessment (DPIA) only after the processing activities began. The DPA noted that the DPIA was also not specific enough. The DPA fined the controller €5,000. In addition, the DPA ordered the controller to adopt appropriate measures to provide data subjects with adequate information and update its DPIA. The DPA fined the controller €5,000. In addition, the DPA ordered the controller to adopt appropriate measures to provide data subjects with adequate information and update its DPIA.","The Italian Data Protection Authority (Garante per la protezione dei dati personali) fined the Municipality of Vasto €5,000 for violating GDPR. The violations included processing more data than necessary by capturing more than just license plates with traffic cameras and failing to conduct a proper Data Protection Impact Assessment (DPIA) before processing began. The DPA also ordered the municipality to improve data subject information and update its DPIA.","Italian DPA fines Municipality of Vasto €5,000 for GDPR violations related to traffic cameras.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_457\u002F2026&diff=52430&oldid=52427","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-07-21T19:45:07+00:00","2026-07-21T20:00:19.024144+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"traffic cameras","product","53f9c4b6-8bc6-4964-9169-d09e5cd41d72",{"id":23,"icon":25,"name":26,"slug":27},null,"Compliance","compliance",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":65},[48],{"slug":49,"name":50,"problem":51,"products":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[53,59],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":54,"product_name":55,"url":57,"description":58},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":60,"product_name":61,"url":63,"description":64},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":67,"title":68,"body":69,"framework_refs":70,"framework_notes":79},"italian-municipality-fined-for-gdpr-violations-in-traffic-camera-data-collection","Italian Municipality Fined for GDPR Violations in Traffic Camera Data Collection","The Municipality of Vasto violated the GDPR data minimisation principle by capturing more personal data than necessary through its traffic camera system, going beyond the intended purpose of recording license plates. Additionally, the municipality failed to conduct a Data Protection Impact Assessment (DPIA) prior to deploying a high-risk processing activity, a mandatory requirement under GDPR Article 35. This case highlights how public sector bodies often underestimate the privacy implications of surveillance technologies. Non-compliance not only results in financial penalties but also erodes public trust in how governments handle citizen data.",[71,72,73,74,75,76,77,78],"GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 35 – Data Protection Impact Assessment","GDPR Article 13 – Information to be provided to data subjects","NIST Privacy Framework PR.DS-P1 – Data Processing Ecosystem Management","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection","ISO\u002FIEC 29134 – Guidelines for Privacy Impact Assessment",{}]