[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUpqc-U6FDIQ5Hril3Lu16MjidKCCLgrbTyl_zlnfRdE":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7a36cd24-8857-4fe1-9643-56f81ebf72f0","Garante per la protezione dei dati personali (Italy) - 619\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-619-2026-56dcf3","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=619\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10294255 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","Italy's Garante per la protezione dei dati personali has fined the Special Company for the Management of Sports Facilities of the Municipality of Trento €8,000. The fine was issued because surveillance cameras were installed in the dressing rooms of a public swimming pool without a proper legal basis, violating GDPR principles. The Garante found that the company failed to demonstrate the necessity and proportionality of the surveillance, and that the signage provided was inadequate, especially for an area with a high expectation of privacy.","Italy's Garante fines a sports facility €8,000 for installing surveillance cameras in pool dressing rooms.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_619\u002F2026&diff=53006&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-14T12:18:07+00:00","2026-09-14T14:00:18.621214+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"surveillance cameras","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":68},"italian-dpa-fines-swimming-pool-operator-8000-for-unlawful-dressing-room-surveillance","Italian DPA Fines Swimming Pool Operator €8,000 for Unlawful Dressing Room Surveillance","The Special Company for the Management of Sports Facilities of the Municipality of Trento installed surveillance cameras in changing rooms without establishing a valid legal basis, violating core GDPR principles of necessity and proportionality. Dressing rooms represent spaces with an exceptionally high expectation of privacy, making unjustified surveillance particularly egregious under data protection law. Compounding the violation, the organisation failed to provide adequate signage to inform individuals that they were being recorded. This case demonstrates that deploying monitoring or data-collection technology — even with ostensibly legitimate goals like security — requires documented lawful grounds, a proportionality assessment, and transparent communication to data subjects.",[56,57,58,59,60,61,62,63,64,65,66,67],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 6 – Lawful basis for processing","GDPR Article 13 – Information to be provided to data subjects","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","EDPB Guidelines 3\u002F2019 on processing of personal data through video devices","NIST SP 800-53 AC-2 (Account Management) – Physical access monitoring controls","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 7.4 – Physical security monitoring","ITIL Service Design – Privacy and legal compliance in service planning",{}]