[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy9s_ubGYOn_-XtSiEH8d_KbqZsoxlDFm-jK1PlHsMT4":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"2f5ffb78-b267-479b-b3f2-ef4d2b61f9fd","Garante per la protezione dei dati personali (Italy) - 619\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-619-2026-cd9547","← Older revision Revision as of 12:19, 14 September 2026 Line 118: Line 118: The DPA contacted the controller about the possible violation of the GDPR, and the controller implemented technical and organisational measures to comply with the instructions given. Particularly, the controller deactivated the cameras and the subsequent processing operations, revised the retention periods of the footage from 72 hrs to 12\u002F24hrs and updated the signage. The DPA contacted the controller about the possible violation of the GDPR, and the controller implemented technical and organisational measures to comply with the instructions given. Particularly, the controller deactivated the cameras and the subsequent processing operations, revised the retention periods of the footage from 72 hrs to 12\u002F24hrs and updated the signage. === Holding === === Holding === The DPA found that although the controller entered a union agreement, the controller’s purpose of protecting the assets of individuals and the protection of fundamental rights and freedoms of data subjects does not justify the processing of the swimming pool user’s personal data. Particularly, because data subjects are not able to regulate the matter themselves. The DPA found that although the controller entered a union agreement, the controller’s purpose of protecting the assets of individuals and the protection of fundamental rights and freedoms of data subjects does not justify the processing of the swimming pool user’s personal data. Particularly, because data subjects are not able to regulate the matter themselves. Line 127: Line 125: In addition to the above, the DPA found that the signage containing the general privacy notice found at the entrance of the controller’s premises does not achieve the necessary level of transparency. This is especially the case where the surveillance is being undertaken in areas such as dressing rooms where there is a greater legitimate expectation of confidentiality. In addition to the above, the DPA found that the signage containing the general privacy notice found at the entrance of the controller’s premises does not achieve the necessary level of transparency. This is especially the case where the surveillance is being undertaken in areas such as dressing rooms where there is a greater legitimate expectation of confidentiality. Therefore, the DPA held that the controller was in violation of Articles 5(1)(a), and (e), Article 6(1)(c) and (e), Article 12 and [[Article 13 GDPR|Article 13 GDPR]] and fined the controller €8,000. Therefore, the DPA held that the controller was in violation of [[Article 5 GDPR|Articles 5(1)(a), and (e)]], [[Article 6 GDPR|Article 6(1)(c) and (e)]], [[Article 12 GDPR|Article 12]] and [[Article 13 GDPR]] and fined the controller €8,000. == Comment == == Comment ==","Italy's Garante per la protezione dei dati personali has fined an entity managing sports facilities €8,000 for violating GDPR. The DPA found that the processing of swimming pool user data via camera surveillance was not justified, even with a union agreement, and lacked transparency, particularly in sensitive areas like dressing rooms. The controller has since deactivated cameras, revised retention periods, and updated signage.","Italian DPA fines swimming pool operator €8,000 for GDPR violations related to camera surveillance.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_619\u002F2026&diff=53007&oldid=53006","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-14T12:19:00+00:00","2026-09-14T14:00:18.621214+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":25,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":65},"italian-sports-facility-fined-8000-for-unlawful-cctv-surveillance-of-pool-users","Italian Sports Facility Fined €8,000 for Unlawful CCTV Surveillance of Pool Users","An Italian sports facility operator violated GDPR by deploying camera surveillance in and around swimming pool areas — including sensitive spaces like dressing rooms — without a lawful basis, adequate transparency, or proportionate data retention policies. A union agreement alone is insufficient to legitimise surveillance of data subjects who are not employees, and cameras in sensitive areas represent a significant privacy intrusion. This case highlights that organisations must conduct proper legal basis assessments before deploying surveillance technology, not after a regulator intervenes. Failing to display adequate signage compounds the violation by denying individuals their right to be informed about data processing activities.",[53,54,55,56,57,58,59,60,61,62,63,64],"GDPR Article 5 – Principles of data processing (lawfulness, fairness, transparency, data minimisation, storage limitation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 13 – Information to be provided to data subjects (transparency\u002Fsignage)","GDPR Article 30 – Records of processing activities","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 AU-3 – Content of audit records","NIST SP 800-53 PL-4 – Rules of behaviour","NIST Privacy Framework PR.PO-P1 – Policies, processes, and procedures for privacy","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 7.4 – Physical security monitoring","EDPB Guidelines 3\u002F2019 on Processing of Personal Data through Video Devices",{}]