[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsnYv8OmIIIJasWG7nn-M0TQBUy4vhsd4tfYbv9tJusQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"cb66d491-acf6-4ac4-8abd-eb8f78fed1ca","italian-meteorological-institute-fined-for-unlawful-cctv-surveillance-without-dpia-or-employee-notic","4f71c554-111c-45dc-bd99-6d4db640dfa2","Italian Meteorological Institute Fined for Unlawful CCTV Surveillance Without DPIA or Employee Notice","The National Institute of Meteorological Research violated GDPR by deploying workplace CCTV systems without properly informing employees and third parties of the surveillance, and without conducting a mandatory Data Protection Impact Assessment (DPIA) beforehand. These are foundational legal obligations under GDPR — transparency ensures individuals know their data is being processed, while a DPIA helps identify and mitigate privacy risks before processing begins. Skipping these steps is not merely a procedural oversight; it exposes organizations to regulatory fines and erodes employee trust. This case highlights that even public research bodies must treat privacy compliance as a prerequisite to deploying monitoring technologies, not an afterthought.","**Immediate actions:**\n- Audit all existing surveillance systems (CCTV, access logs, monitoring tools) to verify GDPR-compliant notices are displayed and accessible to all affected individuals.\n- Conduct a retroactive DPIA for any high-risk processing activities already in operation to identify and remediate compliance gaps.\n\n**Long-term improvements:**\n- Establish a mandatory privacy-by-design review gate that requires a completed DPIA before any new data processing system — including surveillance — is approved for deployment.\n- Develop and maintain a data processing register (Article 30 record) that tracks all monitoring activities, legal bases, and associated impact assessments.\n- Create standardized employee and visitor notification templates for workplace monitoring that satisfy GDPR transparency requirements (Articles 13 & 14).\n\n**Governance & Training:**\n- Train HR, facilities, and IT teams on GDPR obligations specific to employee monitoring so that surveillance decisions are never made without DPO involvement.\n- Schedule annual compliance reviews of all monitoring technologies with the Data Protection Officer to ensure ongoing lawfulness and necessity assessments.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the context of employment","NIST SP 800-53 PT-1 (Privacy Policy and Procedures)","NIST SP 800-53 PT-3 (Personally Identifiable Information Processing Purposes)","NIST Privacy Framework PR.PO-P1 (Policies, Processes and Procedures)","CIS Control 3 – Data Protection","ISO\u002FIEC 29134 – Guidelines for Privacy Impact Assessment","ITIL Service Design – Information Security and Privacy Management",{},"published","2026-10-07T08:22:01.352321+00:00","2026-10-07T08:21:59.854+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10297167&diff=53317&oldid=53263","garante-per-la-protezione-dei-dati-personali-italy-10297167-adde0b","Garante per la protezione dei dati personali (Italy) - 10297167",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51],{"slug":52,"name":53,"problem":54},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]