The Italian Data Protection Authority imposed a fine of three thousand euros on the Municipality of Madignano for using the images recorded by a camera placed near the employee attendance detection systems in order to charge an employee with non-compliance with working hours and the violation of her official duties.
Following this complaint, the employee submitted a report to the Data Protection Authority pursuant to art. 144 of the Privacy Code considering that the surveillance system had been installed: i) in the absence of an adequate Information on the methods and purposes of processing the recorded images; ii) in the absence of the guarantees provided for by the Workers’ Statute (trade union agreement or authorization from the competent territorial office).
After receiving the employee’s report, the Data Protection Authority sent a request for information to the Municipality and, subsequently, proceeded to notify it of the initiation of the procedure for the adoption of the appropriate measure.
The Municipality of Madignano defended itself by declaring that the installation of the camera had been authorized by the Territorial Labor Inspectorate. In addition, the Municipality initially stated that the purpose of the processing of the data collected through the video surveillance system was to protect its assets and the safety of employees, then with defensive briefs the Municipality stated that it corresponded instead to the protection of public safety, the prevention and detection of crimes considering that the video surveillance system had been installed precisely following an assault against a social assistant and the assessor in the buildings of the Municipality. Therefore, the municipal administration considered that the interested parties were not public employees but the whole community and, consequently, the Workers’ Statute was not applicable.
The Data Protection Authority noted that the Municipality, during the course of the investigation, had argued contradictory theories regarding the processing purposes pursued with the installation of the system and that, in this data processing, art. 4 of Law no. 300/1970 is applicable as “video surveillance in work contexts, both private and public, can only be justified in compliance with the guarantees provided for by the applicable national law, in the absence of which it constitutes an unlawful interference in the private life of the employee, pursuant to art. 8(2) of the European Convention on Human Rights“.
In addition, the Authority objected to the absence of an information on the processing of personal data relating to the video surveillance system to be provided to the interested parties (that are workers and visitors to the offices of the Municipality) which contained the essential information elements pursuant to art. 13 of the GDPR.
In conclusion, the Data Protection Authority ordered the Municipality to pay an amount of three thousand euros for unlawful processing of personal data, both for the lack of appropriate guarantees relating to the video surveillance system and for the lack of an adequate information. This reminds us, once again, how a correct management of privacy and labor law obligations is essential, especially in the field of video surveillance.
DISCLAIMER: This article merely provides general information and does not constitute legal advice of any kind from Macchi di Cellere Gangemi which assumes no liability whatsoever for the content and correctness of the newsletter. The author or your contact in the firm will be happy to answer any questions you may have.