Lead: The Public Stakes of Municipal Function Creep
When public surveillance infrastructure established to protect civic assets is repurposed to monitor municipal employees, fundamental privacy safeguards and statutory employment protections collapse simultaneously. The regulatory enforcement action against the local administration of Curtarolo exposes how public bodies risk abusing automated monitoring tools in the absence of stringent oversight mechanisms.
This case establishes an essential precedent regarding the limits of administrative authority in the digital era, underscoring that public security justifications cannot serve as an open-ended pretext for workplace disciplinary monitoring. The systematic diversion of municipal cameras highlights critical vulnerabilities in municipal compliance frameworks and individual labor rights across the European Union.
Context: The Creep of Municipal Surveillance Infrastructure
Over the past two decades, local administrative bodies across Italy have deployed automated video surveillance networks to address traffic management, environmental dumping, and public property preservation. In the Camposampierese district, regulatory guidelines for collective camera oversight were articulated in joint governance documents, creating shared operational standards among affiliated administrations.
Under Italian data protection frameworks and European regulations, automated video monitoring by public entities requires strict adherence to defined statutory baselines. Administrations frequently invoke Legislative Decree 51/2018 for law enforcement activities or Article 6(1)(e) of the General Data Protection Regulation (GDPR) for administrative police and asset security duties. However, these separate operational tracks are legally distinct and strictly non-interchangeable.
The administrative timeline began when a former municipal employee, designated in official records as Sig.ra XX, became the target of internal disciplinary proceedings. These sanctions relied directly on video recordings and photographic evidence captured across multiple dates. The affected worker challenged the legitimacy of the evidentiary material by lodging a formal complaint under Article 77 of the GDPR.
The regulatory inquiry revealed that the municipal administration had expanded its camera operations without executing a prior Data Protection Impact Assessment (DPIA) under Article 35 of the GDPR. Furthermore, the mandatory secondary privacy notice—embodied in the local surveillance regulation of the Camposampierese municipalities—was uploaded to the official website only after supervisory inquiries had already been formally initiated.
This sequence illustrates a widespread governance deficit where digital surveillance mechanisms are deployed prior to completing legal assessments, leading to retrospective compliance attempts once external investigations commence. The administrative trajectory reveals how institutional oversight can erode when technological capability precedes procedural rigor.
Key Actors and Regulatory Entities
The regulatory confrontation involves four key entities and administrative organs operating within distinct legal mandates:
- [[Curtarolo|Q34419]] (Comune di Curtarolo): The local government administration acting as data controller, responsible for managing municipal surveillance assets, municipal staff, and internal disciplinary procedures.
- [[Garante per la protezione dei dati personali|Q3758310]]: The national supervisory authority tasked with monitoring compliance with the GDPR, Legislative Decree 196/2003 (Privacy Code), and sectoral labor privacy protections.
- Sig.ra XX: The former civil servant of the municipality whose complaint triggered the formal investigation into unauthorized workplace monitoring and evidentiary misuse.
- [[Tribunale di Padova|Q115801323]]: The judicial tribunal whose trial records provided decisive proof that the Mayor initiated legal proceedings via an executive criminal complaint rather than an autonomous judicial police communication.
Critical Analysis of Evidence: Function Creep and Procedural Evasion
The central evidentiary contradiction in the Curtarolo case lies in the defense advanced by the municipal administration regarding its lawful basis for processing. The controller initially maintained that its camera recordings fell under judicial police activity governed by Article 5 of Legislative Decree 51/2018, claiming the material constituted evidence compiled under Article 347 of the Italian Code of Criminal Procedure.
This argument collapsed under judicial scrutiny. Evidence from the Tribunale di Padova established that the proceeding originated exclusively from a private complaint (denuncia-querela) lodged directly by the Mayor (Sindaco), rather than an autonomous judicial police referral generated through official investigative channels:
“Come, infatti, emerge dalla sentenza del Tribunale di Padova, in atti, il procedimento è stato avviato a seguito di ‘atto di denuncia-querela presentat[a] [dal …] Sindaco’ e non già a seguito di comunicazione di notizia di reato ex art. 347 c.p.p. nell’ambito di attività di polizia giudiziaria.”
By attempting to retroactively classify executive complaints as judicial police investigations, the administration sought to bypass the structural limitations of administrative law. The surveillance system had originally been authorized under Article 6(1)(e) of the GDPR for road safety, environmental protection, and asset defense. Diverting those feeds into internal employment discipline directly violated the purpose limitation principle set out in Article 5(1)(b) of the GDPR.
This functional deviation contradicts established European standards, specifically the Article 29 Working Party Opinion 03/2013 (WP 203) on purpose limitation, which bars the conversion of general security systems into covert workplace monitoring apparatuses. The supervisory authority confirmed this structural breach:
“Deve, pertanto, concludersi che il Comune ha trattato i filmati di videosorveglianza in questione per una finalità di trattamento incompatibile con quella originaria, in maniera non conforme al principio di ‘limitazione della finalità’.”
A second severe breach involved the complete omission of statutory labor safeguards established by Article 4 of Law 300/1970 (Workers’ Statute). Technological tools capable of indirect or direct employee surveillance require either trade union co-determination agreements or public labor inspectorate authorization. The municipality secured neither, failing also to provide workers with the mandatory operational notice required by Article 4(3) of Law 300/1970 and Articles 12 and 13 of the GDPR.
Compounding these systemic infractions, the municipality utilized an additional, separate video recording device to capture employee activities. This supplementary deployment breached Article 88 of the GDPR and Article 113 of the Privacy Code, which reinforce the absolute prohibition against unauthorized workplace monitoring under Article 8 of Law 300/1970.
In assessing financial liability, the supervisory authority applied the absorption principle articulated in Article 83(3) of the GDPR. Under this framework, where a data controller commits multiple concurrent violations across linked processing operations, the total monetary penalty cannot exceed the maximum legal amount specified for the gravest single infraction.
Legal Basis, Transparency, and Document Provenance
The underlying evidentiary basis of this dossier rests upon official public regulatory enforcement records issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali). The definitive document, registered under Provvedimento del 23 ottobre 2025 [doc. web n. 10196164], documents the full procedural history, municipal defensive hearings under Article 166 of the Privacy Code, and subsequent legal determinations.
Under Article 5 of Italian Law 633/1941, official acts and judicial decisions of state and administrative bodies belong to the public domain, free of copyright restrictions. The findings link to prior supervisory precedents, including Provision No. 234 of April 11, 2024 (doc. web 10013356) and Provision No. 805 of December 19, 2024 (doc. web 10107263), establishing a permanent evidentiary record of surveillance overreach in local government administration.