Italian Sports Facility Fined €8,000 for Unlawful CCTV Surveillance of Pool Users
Written by AI from the linked story. Not reviewed by an editor. How this works
An Italian sports facility operator violated GDPR by deploying camera surveillance in and around swimming pool areas — including sensitive spaces like dressing rooms — without a lawful basis, adequate transparency, or proportionate data retention policies. A union agreement alone is insufficient to legitimise surveillance of data subjects who are not employees, and cameras in sensitive areas represent a significant privacy intrusion. This case highlights that organisations must conduct proper legal basis assessments before deploying surveillance technology, not after a regulator intervenes. Failing to display adequate signage compounds the violation by denying individuals their right to be informed about data processing activities.
Tactical Insight
Immediate actions
- Conduct a lawful basis review for all active surveillance systems to confirm each camera deployment is justified under GDPR Article 6 (and Article 9 for sensitive areas).
- Audit all camera locations and immediately deactivate any units placed in areas where a reasonable expectation of privacy exists (e.g., changing rooms, restrooms).
- Ensure prominent, GDPR-compliant signage is displayed at all entry points where surveillance is in operation.
Long-term improvements
- Establish a formal Data Protection Impact Assessment (DPIA) process — mandatory under GDPR Article 35 — before deploying any new surveillance or monitoring technology.
- Define and enforce documented data retention schedules for all surveillance footage, with automated deletion upon expiry.
- Appoint or consult a Data Protection Officer (DPO) to provide ongoing oversight of surveillance practices and privacy compliance.
Detection & governance measures
- Schedule periodic internal privacy audits to verify that surveillance deployments remain proportionate, necessary, and legally compliant.
- Maintain a Record of Processing Activities (RoPA) under GDPR Article 30 that includes all camera-based data collection, its purpose, retention period, and legal basis.
- Train facility managers and HR staff on GDPR obligations related to employee and customer monitoring to prevent recurrence.