Public Interest and Regulatory Enforcement
The unauthorized deployment of surveillance cameras within commercial workplaces represents a critical friction point between digital monitoring capabilities and fundamental labor privacy rights. When employers utilize real-time camera feeds to monitor staff without statutory agreements or clear transparency notices, they bypass decades of established safeguards designed to prevent covert oversight.
This case demonstrates that technological simplicity—such as routing live feeds directly to personal mobile devices without digital recording—does not exempt commercial operators from European and national compliance frameworks. The regulatory response affirms that unrecorded visual tracking constitutes automated personal data processing subject to stringent transparency obligations and penal-backed labor codes.
By examining how local inspections and inter-agency inquiries coordinate across labor and privacy bodies, this dossier reconstructs the legal boundaries governing workplace monitoring. The findings clarify that operational oversight can never supersede mandatory collective agreements or administrative authorization procedures.
Regulatory Background and the Evolution of Workplace Surveillance Controls
The Italian legal system maintains an integrated architecture balancing employee dignity against managerial oversight, rooted fundamentally in Article 4 of Law No. 300 of May 20, 1970, commonly known as the Workers’ Statute (Statuto dei lavoratori). Historically, this statute established that audiovisual systems capable of remote employee supervision require prior agreement with internal trade union representatives or formal authorization from the competent territorial labor inspectorate.
With the integration of Regulation (EU) 2016/679 (GDPR), the European framework explicitly accommodated national protective provisions. Under Article 88 of the Regulation, Member States retain the authority to enact more specific rules ensuring the protection of employees’ rights and freedoms regarding workplace data processing. In the national legal architecture, Article 114 of the Italian Personal Data Protection Code (Legislative Decree No. 196/2003) links GDPR compliance directly to the requirements of Article 4 of Law 300/1970.
Longstanding administrative and judicial jurisprudence reinforces this standard. The national supervisory authority established as early as its official note of December 17, 1997 (doc. web n. 39849) that optical surveillance constitutes data processing. Furthermore, European jurisprudence, notably the Court of Justice of the European Union in Ryneš (Case C-212/13, judgment of December 11, 2014, paragraph 25), confirmed that continuous video monitoring falls under data protection provisions.
Crucially, domestic judicial precedent has resolved any ambiguity regarding whether systems that only display live footage escape statutory definitions. The Court of Cassation affirmed in judgment No. 17740 of September 2, 2015, that live collection and remote viewing of data via smartphones without permanent digital recording remains fully subject to regulatory limitations, as visual interception itself infringes upon the monitored individual’s personal sphere.
Identified Entities and Institutional Authorities
The enforcement dossier involves distinct institutional authorities and administrative actors operating within territorial and jurisdictional remits across Lombardy and national oversight frameworks:
- Garante per la protezione dei dati personali ([[Italian Data Protection Authority|Q3758364]]): The national supervisory body tasked with enforcing Regulation (EU) 2016/679 and Legislative Decree No. 196/2003 across public and private sectors, possessing corrective, investigatory, and sanctioning powers under Article 58 and Article 83 of the GDPR.
- Territorial Labor Inspectorate of Como, Lecco, and Sondrio: The inter-provincial administrative body responsible for labor standard compliance and issuing formal administrative authorizations for audiovisual installations under Article 4 of Law 300/1970.
- Commercial Establishment: A private retail and hospitality operator engaged in the preparation and service of food and beverages, acting as the formal data controller (titolare del trattamento) under Article 4(7) of the GDPR.
Critical Analysis of the Evidentiary Record
Visual Inspection and Technical Infrastructure
The administrative record originated from an on-site inspection that documented the installation of three surveillance cameras inside a commercial venue dedicated to food and beverage service. Technical verification confirmed that at least one of the three devices was fully operational and transmitting visual feeds. However, the venue completely lacked mandatory information signage detailing data processing purposes, data controller identities, and data subject rights.
The European Data Protection Board guidelines underline that transparency notices may be provided in combination with standardized icons under Article 12(7) of the GDPR to deliver an intelligible, clearly visible overview. In this instance, neither layered notices nor basic primary warning signs were displayed to patrons or employees entering the monitored areas.
“Nello stesso veniva attestata la presenza, all’interno del menzionato esercizio commerciale, di un impianto di videosorveglianza − composto da tre telecamere, una delle quali regolarmente funzionante − installato in assenza di cartelli riportanti l’informativa di cui all’art. 13 del Regolamento.”
The absence of Article 13 signage deprived workers and customers of any awareness regarding the ongoing collection of their image data. Under Article 5(1)(a) of the GDPR, personal data must be processed lawfully, fairly, and in a transparent manner. Installing functional optical sensors without visible notices directly breaches foundational transparency guarantees.
The Purpose and Mechanics of Workplace Oversight
Photographic evidence and official inspection minutes confirmed that the camera installation was primarily aimed at monitoring staff members assigned to food and beverage preparation and service. Despite the defensive claim that no permanent storage mechanism was active and that feeds were solely accessed remotely via smartphone, regulatory standards treat real-time streaming as processing under Article 4(1)(2) of the GDPR.
“Infatti, sulla base del menzionato verbale di accertamento e della relativa documentazione fotografica, è emerso che l’impianto di videosorveglianza in parola, risultato sprovvisto della necessaria autorizzazione dell’Ispettorato del Lavoro in violazione dell’art. 4, l. n. 300/1970, era prevalentemente finalizzato al ‘controllo dei dipendenti addetti alla somministrazione di cibo e bevande’.”
To verify the legality of the setup, the supervisory authority formally contacted the Territorial Labor Inspectorate of Como, Lecco, and Sondrio on August 26, 2025. The inquiry sought to ascertain whether any administrative authorization had ever been requested or granted for the operational equipment. The inspection confirmed that no authorization existed, rendering the installation illegitimate under Article 4 of Law 300/1970 and Article 114 of the Code.
Statutory Violations and Sanction Structure
Because Article 88 of the GDPR integrates national protective standards, a breach of Article 4 of the Workers’ Statute constitutes a simultaneous violation of European data processing rules. This statutory connection triggers administrative financial penalties under Article 83(5)(d) of the GDPR, while concurrently maintaining penal relevance under Article 171 of the Italian Personal Data Protection Code.
Consequently, the authority issued an injunction under Article 58(2)(i) and Article 83 of the Regulation, ordering the data controller to pay an administrative pecuniary fine of 8,000 euros. Under Article 166(7) of the Code and Article 16(1) of Garante Regulation No. 1/2019, the injunction was ordered to be published on the authority’s public website as a transparency and deterrence measure.
“ORDINA al titolare del trattamento di pagare la somma di euro 8.000 (ottomila) a titolo di sanzione amministrativa pecuniaria per la violazione indicata in motivazione; INGIUNGE al medesimo titolare del trattamento di pagare la somma di euro 8.000 (ottomila)… entro 30 giorni dalla notifica del presente provvedimento.”
Under Article 166(8) of the Code, the offender retains the option to settle the dispute by paying a reduced amount equal to half the fine (4,000 euros) within the deadline established for lodging an appeal. Judicial review remains accessible under Article 78 of the GDPR, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, requiring appeals before ordinary civil courts within 30 days of notification (or 60 days for foreign residents).
Unresolved Questions and Operational Gaps
While the evidentiary record clearly demonstrates administrative non-compliance, key questions remain unaddressed regarding the operational lifespan and data dissemination of the system. The documentation does not establish how long the active camera operated prior to inspection, nor does it specify whether visual streaming was accessible across multiple external handheld devices or restricted to a single executive terminal.
Furthermore, the record does not detail whether any potential security logs or network traffic analyses were performed to identify third-party access vulnerabilities in the smartphone connection. These unresolved aspects highlight the inherent challenges of auditing informal, off-the-shelf surveillance systems within small and medium commercial operations.
Legal Ground and Documentation Transparency
This dossier is constructed from official public enforcement documentation issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on September 11, 2025, registered under document web number 10183820.
Under Article 5 of Italian Law No. 633 of April 22, 1941, official texts of state acts and public administrative proceedings are exempt from copyright and belong to the public domain. The complete administrative text is accessible via the authority’s registry at garanteprivacy.it (Doc-Web 10183820).