[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f12FtC91T4lOmtJ6T5tGjs3oI0l-sRhbUBNGVSzEYZK0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"62b30391-2f2f-4fc9-a1cb-f48c9e0905e2","italian-sports-facility-fined-8000-for-unlawful-cctv-surveillance-of-pool-users","2f5ffb78-b267-479b-b3f2-ef4d2b61f9fd","Italian Sports Facility Fined €8,000 for Unlawful CCTV Surveillance of Pool Users","An Italian sports facility operator violated GDPR by deploying camera surveillance in and around swimming pool areas — including sensitive spaces like dressing rooms — without a lawful basis, adequate transparency, or proportionate data retention policies. A union agreement alone is insufficient to legitimise surveillance of data subjects who are not employees, and cameras in sensitive areas represent a significant privacy intrusion. This case highlights that organisations must conduct proper legal basis assessments before deploying surveillance technology, not after a regulator intervenes. Failing to display adequate signage compounds the violation by denying individuals their right to be informed about data processing activities.","**Immediate actions:**\n- Conduct a lawful basis review for all active surveillance systems to confirm each camera deployment is justified under GDPR Article 6 (and Article 9 for sensitive areas).\n- Audit all camera locations and immediately deactivate any units placed in areas where a reasonable expectation of privacy exists (e.g., changing rooms, restrooms).\n- Ensure prominent, GDPR-compliant signage is displayed at all entry points where surveillance is in operation.\n\n**Long-term improvements:**\n- Establish a formal Data Protection Impact Assessment (DPIA) process — mandatory under GDPR Article 35 — before deploying any new surveillance or monitoring technology.\n- Define and enforce documented data retention schedules for all surveillance footage, with automated deletion upon expiry.\n- Appoint or consult a Data Protection Officer (DPO) to provide ongoing oversight of surveillance practices and privacy compliance.\n\n**Detection & governance measures:**\n- Schedule periodic internal privacy audits to verify that surveillance deployments remain proportionate, necessary, and legally compliant.\n- Maintain a Record of Processing Activities (RoPA) under GDPR Article 30 that includes all camera-based data collection, its purpose, retention period, and legal basis.\n- Train facility managers and HR staff on GDPR obligations related to employee and customer monitoring to prevent recurrence.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5 – Principles of data processing (lawfulness, fairness, transparency, data minimisation, storage limitation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 13 – Information to be provided to data subjects (transparency\u002Fsignage)","GDPR Article 30 – Records of processing activities","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 AU-3 – Content of audit records","NIST SP 800-53 PL-4 – Rules of behaviour","NIST Privacy Framework PR.PO-P1 – Policies, processes, and procedures for privacy","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 7.4 – Physical security monitoring","EDPB Guidelines 3\u002F2019 on Processing of Personal Data through Video Devices",{},"published","2026-09-14T14:21:29.339895+00:00","2026-09-14T14:21:29.034+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_619\u002F2026&diff=53007&oldid=53006","garante-per-la-protezione-dei-dati-personali-italy-619-2026-cd9547","Garante per la protezione dei dati personali (Italy) - 619\u002F2026",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]