Public Interest and Systemic Implications
The boundary between institutional physical security and the fundamental right to privacy is nowhere more fragile than inside educational facilities. When surveillance systems capture minors, teaching staff, and incidental visitors without statutory oversight, security infrastructure transforms into an unregulated mechanism of pervasive behavioral monitoring. This investigation examines the regulatory enforcement that established how an educational network operated digital video recording systems for years across school grounds without fulfilling mandatory impact assessments or statutory workplace protections.
The public interest in these findings reaches far beyond the boundaries of a single school compound. Educational institutions hold a heightened duty of care when handling data related to underage students, whose developmental privacy rights require rigorous administrative scrutiny before any recording equipment is activated. Unregulated monitoring in classrooms, corridors, and perimeter entrances normalizes constant digital oversight for formative populations, creating long-term democratic and psychological risks that modern data protection frameworks explicitly seek to prevent.
Furthermore, the presence of educational staff within recorded spaces triggers binding workplace safeguards designed to prevent covert performance monitoring and structural power imbalances. When an institution bypasses mandatory labor protocols while simultaneously recording children and third-party visitors, it dismantles the systemic checks established by domestic and European jurisprudence. The enforcement actions documented here provide a critical baseline for assessing institutional accountability across modern academic environments.
Historical and Regulatory Context
Over the past decade, the rapid commoditization of commercial closed-circuit television (CCTV) hardware has led many private and religious educational institutes to deploy extensive optical monitoring networks. What was once a costly, specialized security installation has become an off-the-shelf appliance, frequently installed without the requisite technical or legal vetting. This technological shift created widespread institutional friction with established legal norms governing public spaces, workplaces, and child protection.
In the Italian legal framework, the governance of video surveillance at work is firmly rooted in Article 4 of Law No. 300 of May 20, 1970, commonly known as the Workers’ Statute (Statuto dei Lavoratori). This statutory framework establishes an absolute procedural prerequisite: surveillance equipment capable of remote employee monitoring may only be installed pursuant to a prior collective agreement with internal trade union representatives, or, in the absence of an agreement, upon formal authorization from the relevant territorial labor inspectorate (Ispettorato Territoriale del Lavoro).
With the entry into force of the General Data Protection Regulation (EU) 2016/679 (GDPR), these historic labor protections were directly incorporated into European privacy architecture via Article 88, which allows Member States to maintain more specific rules regarding the processing of employees’ personal data in the employment context. This dual legal regime guarantees that national labor statutes operate as non-negotiable legal bases under Article 6(2) and Article 88(2) of the Regulation, establishing that any workplace monitoring devoid of statutory labor authorization is intrinsically unlawful.
The institutional timeline under review began in 2019, when a primary Digital Video Recorder unit (designated as DVR1) was deployed to manage a network of 10 CCTV cameras across an educational complex. The system was configured to record footage continuously, capturing the daily routines of students—many of them minors—alongside school personnel, administrative staff, visiting parents, suppliers, and external guests accommodated within on-site guesthouse facilities.
The technical deployment proceeded without an essential procedural pillar: the Data Protection Impact Assessment (DPIA) mandated by Article 35 of the GDPR. Given that school environments inherently combine vulnerable populations, systemic monitoring, and workplace hierarchies, European regulatory guidance has long classified comprehensive school CCTV systems as high-risk processing operations requiring prior documented impact assessments to determine necessity and proportionality.
Key Institutional Actors
The oversight and enforcement procedures involve several regulatory authorities, legal frameworks, and institutional entities:
Provincia della Congregazione dei Fratelli delle Suore Cristiane: The formal data controller responsible for the governance, administration, and physical infrastructure of the educational institute where the ten-camera CCTV network was deployed and maintained from 2019 onward.
[[Garante per la protezione dei dati personali|Q3758620]]: The Italian national supervisory authority responsible for monitoring GDPR compliance, executing administrative inquiries pursuant to Article 157 of the Privacy Code, and enforcing administrative sanctions and corrective orders under Article 58 and Article 83 of the European framework.
[[Court of Justice of the European Union|Q4951]]: The highest judicial body of the European Union, whose landmark jurisprudence—including judgment C-65/23 (K GmbH, Traitement de données personnelles des employés, December 19, 2024)—reaffirmed the strict necessity criteria and legal boundaries governing employee data processing across Member States.
[[European Data Protection Board|Q5412030]]: The independent European body that ensures consistent application of data protection rules, whose Guidelines 04/2022 on the calculation of administrative fines under the GDPR establish the standardized parameters for determining proportionate financial penalties based on infringement gravity and institutional turnover.
Critical Analysis of the Evidentiary Record
The evidentiary record established during the regulatory investigation exposes systemic structural deficiencies in how the surveillance infrastructure was conceived, installed, and operated. The primary technical asset, identified as DVR1, orchestrated ten separate camera feeds covering interior corridors, transit spaces, and perimeter sectors. The primary finding of fact confirms that from 2019 until regulatory intervention, this apparatus gathered continuous visual records without satisfying basic threshold criteria under European law.
“Nel caso di specie, il Titolare ha, invece, trattato i dati personali dei propri lavoratori e degli studenti, nonché di terze persone, mediante il sistema di videosorveglianza in questione, in assenza di una preliminare valutazione di impatto sulla protezione dei dati e, pertanto, in violazione dell’art. 35 del Regolamento.”
The omission of a prior Data Protection Impact Assessment represents a critical compliance failure rather than a mere clerical oversight. Under Article 35(7)(b) of the GDPR, a DPIA serves as the indispensable evidentiary mechanism through which a data controller must articulate, evaluate, and justify the necessity and proportionality of each camera angle against stated security objectives. By foregoing this assessment, the controller operated the surveillance apparatus without establishing whether less intrusive security measures could achieve equivalent protective outcomes.
A critical examination of the external camera feeds reveals a persistent failure to delimit optical angles. Regulatory guidance governing academic spaces explicitly dictates that perimeter surveillance must strictly frame designated entry points and boundaries, actively masking public thoroughfares and adjacent non-institutional properties:
“Se le riprese riguardano l’esterno della scuola, l’angolo visuale delle telecamere deve essere opportunamente delimitato.”
The failure to calibrate these visual boundaries meant that members of the general public, parents dropping off students, delivery drivers, and unrelated pedestrians were swept into the school’s digital recording perimeter without notice or legal justification. This indiscriminate spatial overreach compromised the core principle of data minimization enshrined in Article 5(1)(c) of the GDPR.
Equally severe was the total absence of statutory labor safeguards under Article 4 of Law No. 300/1970. Because the ten CCTV cameras continuously monitored areas where educational and administrative personnel performed their daily vocational duties, the processing fell directly within the scope of domestic employment protection laws referenced by Article 88 of the Regulation. The controller obtained neither an agreement with workplace union representatives nor a public authorization from the territorial labor inspectorate.
During the formal inquiry initiated under Article 157 of the Privacy Code, the controller engaged legal counsel, submitted written defense briefs, and requested an oral hearing pursuant to Article 166(6) of the Code and Article 18(1) of Law No. 689/1981. In its formal representations, the administration confirmed it had executed the complete deactivation of all connected recording devices (lo spegnimento di tutte le telecamere).
This shutdown led the supervisory authority to conclude that the physical infringement had ceased operating, thereby removing the necessity for coercive corrective orders under Article 58(2) of the GDPR to halt active processing. However, cessation of active recording does not erase past non-compliance. The Garante declared the entire multi-year processing operation unlawful under Article 57(1)(f) of the GDPR, finding simultaneous violations of Articles 5(1)(a)-(b), 6, 12(1), 13, 35, and 88 of the Regulation, alongside Articles 2-ter and 114 of the domestic Privacy Code.
In establishing the pecuniary sanction under Article 83(2), Article 83(3), and Article 83(5) of the GDPR, the regulator applied the quantitative methodology formulated by the European Data Protection Board in Guidelines 04/2022. The final decision mandated the formal publication of the injunction order on the supervisory authority’s institutional website pursuant to Article 166(7) of the Code and Articles 16 and 17 of Garante Regulation No. 1/2019, ensuring public record transparency.
Open Questions and Systemic Deficits
While the administrative proceeding definitively established the statutory violations and penalized the historic operation of DVR1, several operational questions remain unaddressed in the evidentiary record. The archival findings do not detail the exact physical retention schedule used between 2019 and the date of deactivation, leaving open the question of how many months of historical footage may have been stored on local hard drives or whether third-party contractors ever accessed unencrypted raw archives.
Moreover, the case exposes a broader systemic problem across the independent educational sector: the persistent disconnect between facility management decisions and specialized privacy governance. When physical security upgrades are procured through commercial vendors without institutional data protection officers conducting rigorous pre-deployment reviews, academic entities repeatedly drift into unlawful workplace surveillance and unauthorized monitoring of vulnerable minors.
Transparency, Provenance, and Legal Basis
This investigative dossier is constructed entirely from official administrative records issued by the national supervisory authority, specifically the formal injunction and decision adopted on January 29, 2026 (Register Document Web No. 10222864). The primary proceedings evaluate compliance under European Regulation (EU) 2016/679, Italian Legislative Decree No. 196/2003 (as amended by Legislative Decree No. 101/2018), and Law No. 300 of May 20, 1970.
The publication and archival analysis of these administrative acts operate under Article 5 of Italian Law No. 633 of April 22, 1941 (Legge sul diritto d’autore), which expressly provides that official acts and texts issued by the State and public administrative bodies are not covered by copyright and reside in the public domain. The complete, unedited regulatory record can be accessed directly through the official repository of the Garante per la protezione dei dati personali.