Italian Municipality Fined for GDPR Violations in Traffic Camera Data Collection
Written by AI from the linked story. Not reviewed by an editor. How this works
The Municipality of Vasto violated the GDPR data minimisation principle by capturing more personal data than necessary through its traffic camera system, going beyond the intended purpose of recording license plates. Additionally, the municipality failed to conduct a Data Protection Impact Assessment (DPIA) prior to deploying a high-risk processing activity, a mandatory requirement under GDPR Article 35. This case highlights how public sector bodies often underestimate the privacy implications of surveillance technologies. Non-compliance not only results in financial penalties but also erodes public trust in how governments handle citizen data.
Tactical Insight
Immediate actions
- Audit all active data collection systems to verify that only the minimum necessary personal data is being captured and retained.
- Conduct or update DPIAs for any existing processing activities that involve surveillance, biometrics, or large-scale personal data before continuing operations.
Long-term improvements
- Embed a 'privacy by design and by default' process into all procurement and deployment workflows for new technologies, including cameras and sensors.
- Establish a mandatory DPIA review gate for any new public-facing data processing project before project sign-off.
- Train all staff involved in technology procurement and deployment on GDPR obligations, particularly data minimisation and DPIA requirements.
Governance & oversight measures
- Appoint or empower a qualified Data Protection Officer (DPO) to review and approve all data collection initiatives involving public spaces.
- Implement a regular compliance calendar that schedules periodic reviews of data processing activities, data subject notices, and existing DPIAs.