The design and the installation of a video surveillance system in Italy is often carried out without complying with data protection regulations, thus exposing companies to fines that can amount to several million euros.
The most important rules on video surveillance are prescribed in general by the General Data Protection Regulation (EU Regulation 2016/679 or "GDPR"), the Privacy Code in particular, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and integrated by the guidelines provided by the Data Protection Authority ("Garante privacy").
The fulfilments concern the display of an information sign that shall indicate, in a clear and transparent way, the presence of cameras, in a given area, together with the indispensable information required by law (among these, data retention, data controller and purpose of processing).
In addition, in order to achieve an adequate level of compliance with the law provisions, it is advisable to have internal regulations, a compliant system and a suitable legal basis for the installation of a video surveillance system.
Unfortunately, reality often shows the complete absence of such signs or the presence of signs lacking the necessary details effectively depriving those concerned of the right to receive the minimum information required by law.
The importance of proper compliance of video-surveillance systems is evidenced by the intervention of the European Data Protection Board ('EDPB'), which issued guidelines 3/2019, and by the fact that more than 15% of privacy sanctions concern video-surveillance systems.
In conclusion, installing and operating a non-compliant video surveillance system exposes the various economic operators to considerable economic risks as well as reputational damage.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
