[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFQoV9SU7x9FyhKqEm5f_vc16K8uqJY1fjfFApQXEYxo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"542fd009-99cd-4c9f-8885-ec4c59e789b1","italian-municipality-fined-8000-for-gdpr-violating-surveillance-cameras-in-pool-changing-rooms","4cdf0b50-6255-4c99-afa1-4b30ca53706b","Italian Municipality Fined €8,000 for GDPR-Violating Surveillance Cameras in Pool Changing Rooms","A municipality in Italy installed surveillance cameras inside swimming pool dressing rooms without legal basis, proportionality assessment, or proper transparency measures, resulting in a Garante enforcement action and an €8,000 fine. The root failure was a fundamental misunderstanding — or disregard — of GDPR principles, particularly lawfulness, purpose limitation, and data minimisation, applied to physical surveillance systems. Capturing footage of employees in private spaces compounds the violation by implicating workplace privacy rights alongside public user rights. This case illustrates that GDPR obligations extend beyond digital systems to any technology that processes personal data, including CCTV. Organisations that deploy surveillance without conducting a Data Protection Impact Assessment (DPIA) or establishing a legitimate legal basis face significant legal and reputational consequences.","**Immediate actions:**\n- Conduct an urgent audit of all existing surveillance camera placements to verify they do not cover private or sensitive areas such as changing rooms, toilets, or rest areas.\n- Remove or reposition any cameras found to be disproportionate, unlawful, or lacking a documented legal basis immediately.\n\n**Policy & compliance improvements:**\n- Require a mandatory Data Protection Impact Assessment (DPIA) before deploying any new surveillance system, per GDPR Article 35.\n- Establish a clear, documented surveillance policy that defines lawful purposes, retention periods, access controls, and transparency notices for all camera installations.\n- Ensure visible signage (informative notices) is placed at all monitored locations, clearly communicating the purpose, legal basis, and data controller contact details.\n\n**Training & governance measures:**\n- Train procurement, facilities, and management staff on GDPR requirements specifically relating to physical surveillance and employee privacy rights.\n- Assign a designated Data Protection Officer (DPO) or privacy lead to approve all surveillance decisions and periodically review compliance of existing installations.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5 – Principles relating to processing of personal data (lawfulness, purpose limitation, data minimisation, storage limitation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 13 – Transparency and information obligations","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the context of employment","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","NIST Privacy Framework PR.DS-P1 – Data minimisation","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management (PIMS)","EDPB Guidelines 3\u002F2019 on processing of personal data through video devices",{},"published","2026-09-16T09:20:52.607983+00:00","2026-09-16T09:20:52.348+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_619\u002F2026&diff=53067&oldid=53034","garante-per-la-protezione-dei-dati-personali-italy-619-2026-0bbcc6","Garante per la protezione dei dati personali (Italy) - 619\u002F2026",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]