Thanks to Luca Russo for contributing to this article.
On December 5, 2020, the Italian Data Protection Authority (hereinafter “Garante”) published a FAQ on video surveillance (“FAQ”). These clarifications were needed as Regulation 2016/679 (GDPR) entered into force, as the 2010 decision on video surveillance (“2010 Decision”) published by the Garante was largely outdated and not in compliance with the GDPR. Moreover, in drafting this recent FAQ, the Garante also considered the EDPB Guidelines 3/2019 on video surveillance.
The Garante clarifies that video surveillance must be implemented in conformity with the principles of accountability and data minimization. The new FAQ highlights the fact that no prior authorization or prior assessment (verifica preliminare) from the Garante is needed to implement video surveillance systems – as required by the 2010 Decision – but the relevant controller must assess the lawfulness and the proportionality of the processing, as well as whether there is a need to carry out a DPIA.
Further, while the 2010 Decision established a limited period of time to store a recording (i.e., 24 hours, to be extended under certain conditions or on the basis of a prior assessment from the Garante), the FAQ provides that recorded images may be stored as long as is necessary for the purpose(s) of the processing on the basis of a proper assessment carried out by the data controller. The Garante set a 72-hour threshold: the longer the intended storage period (especially if it exceeds that threshold), the more firmly grounded the analysis must be as to the lawfulness of the purpose and the need for storage.
In line with the 2010 Decision, data subjects must be informed, pursuant to Art. 13 GDPR, of the presence of a video surveillance system by means, for instance, of several signs on the perimeter of the area subject to video surveillance. Information shall be provided in two layers: a “simplified” set of information presented on the signs, and more detailed information offered on paper or via digital means. Moreover, the FAQ also establishes the following:
- video surveillance in the workplace is permitted if in compliance with laws aimed at protecting employees;
- private video surveillance (g., smart cameras) is allowed (though placing cameras in places like bathrooms is to be avoided), but workers, such as babysitters, must be duly informed;
- video surveillance can be implemented on private property, but cameras must be placed so that solely an area that is on the private property is recorded; otherwise the controller may be found to be in breach of criminal provisions.
Lastly, none of the abovementioned measures nor the current privacy regulation apply to video surveillance and recording that do not allow data subjects recorded to be identified (e.g., recordings carried out by means of a drone at a certain height).
