Public Interest and the Realities of Remote Surveillance
The boundary between commercial property security and covert employee surveillance is increasingly contested in the service sector. When hospitality venues deploy network-connected closed-circuit television systems capable of remote smartphone streaming, the constitutional and statutory rights of workers are directly placed under digital oversight. Regulatory scrutiny reveals that even small-scale installations trigger comprehensive data protection obligations that employers cannot circumvent through ex-post regularizations.
On August 15, 2024, an on-site operational check conducted at the catering premises of Hanako s.r.l. in Padua unmasked an active five-camera surveillance network operating without the mandatory statutory agreements or labor inspectorate clearances. The case encapsulates a systemic compliance deficit across the service economy, where digital equipment is deployed prior to securing statutory authorization. This regulatory intervention establishes that real-time visual streaming without local recording remains fully actionable under European and national privacy jurisprudence.
By dissecting the enforcement trajectory initiated by financial police investigators and concluded by regulatory injunction, this dossier examines the structural intersection between labor protection law and international privacy governance. The findings demonstrate that technological convenience cannot supersede explicit statutory safeguards designed to prevent the digital subordination of workers in everyday commercial environments.
Historical Context and Statutory Intersections
Italian labor jurisprudence has maintained strict protections against unilateral worker monitoring since the enactment of Law No. 300 of May 20, 1970, commonly known as the Workers’ Statute. Under Article 4 of this foundational statute, audiovisual installations and other technical instruments capable of remotely monitoring workers’ activities may only be installed following collective agreements with internal union representations or, failing that, explicit prior authorization from the competent territorial labor inspectorate.
The integration of the General Data Protection Regulation (EU) 2016/679 into Italian national law preserved these specific protections through Article 88 of the Regulation, which explicitly allows Member States to maintain or introduce more specific rules safeguarding employment rights. Italian legislators operationalized this mechanism through Article 114 of the national Privacy Code (Legislative Decree No. 196/2003), establishing that any processing of personal data in violation of Article 4 of Law No. 300/1970 constitutes an unlawful processing activity subject to both administrative and criminal sanctions under Article 171 of the Code.
The operational chronology began during a public holiday inspection on August 15, 2024, when officers from the Guardia di Finanza of Padua entered the restaurant operated by Hanako s.r.l. The inspecting officers identified five operational cameras: four monitoring external perimeter zones and one positioned internally, directly covering areas where employees performed their daily duties. At the moment of the inspection, the company lacked any union agreement or administrative authorization from the competent labor authority.
Following the inspection, Hanako s.r.l. sought to regularize its legal standing by obtaining authorization No. 40218 from the Territorial Labor Inspectorate of Padua-Rovigo on October 31, 2024. However, the transmission of the formal operational report by the Guardia di Finanza’s Rome-based Privacy and Technological Fraud Unit on February 25, 2025, consolidated the regulatory evidence base. The documentation established that the system had operated unlawfully during the period preceding the administrative clearance.
Institutional Actors and Corporate Entities
The regulatory procedure involves a distinct network of specialized public authorities, judicial bodies, and private commercial entities operating within the European regulatory matrix:
- Hanako s.r.l.: A private commercial entity operating in the catering sector in Padua, Italy, designated as the data controller responsible for the operational surveillance installation.
- Guardia di Finanza: The Italian militarized economic and financial police authority, acting through its local unit in Padua for field inspections and its specialized Privacy and Technological Fraud Unit (Nucleo privacy e frodi tecnologiche) in Rome for technical protocol transmissions.
- Garante per la protezione dei dati personali: The national supervisory authority for data protection in Italy, empowered under GDPR Article 58 to exercise corrective and sanctioning powers against non-compliant entities.
- Pasquale Stanzione: President of the Italian Data Protection Authority, signatory to the formal injunction order issued under collegiate authority.
- Ginevra Cerrina Feroni: Vice President and designated Relator within the regulatory proceeding, responsible for the legal evaluation of the evidentiary record.
- Ispettorato del Lavoro di Padova-Rovigo: The territorial public agency empowered to grant statutory administrative authorizations for workplace surveillance equipment under Statuto dei Lavoratori.
Critical Analysis of the Evidence
The central evidentiary finding in this case rests upon the operational state of the monitoring hardware during the August 2024 inspection. The regulatory findings established that five cameras were actively processing personal visual data while employees were stationed within the capture fields. The defense that data was not stored on physical hard drives, but merely streamed live to a mobile device, was dismissed as legally inconsequential under established precedent.
“The use of video surveillance systems constitutes processing of personal data under Article 4(1)(2) of the Regulation—even in cases where there is only collection of personal data and remote viewing via smartphone without recording, as declared in the case at issue.”
This statutory determination aligns directly with Italian Supreme Court case law (Cass. September 2, 2015, No. 17740), reinforcing that real-time surveillance represents an active processing operation. Transmitting a live stream over digital networks subjects workers to potential continuous oversight, thereby fulfilling all criteria of personal data processing under European law, regardless of whether a permanent digital archive is generated.
A second critical failure identified in the investigation concerns transparency and informative obligations under Article 13 of the GDPR. Hanako s.r.l. failed to display mandatory preliminary signage informing data subjects—both workers and patrons—of the monitoring system, the identity of the controller, and the specific purposes of the processing. The regulatory framework requires clear, multi-layered visual information, which may be paired with standard icons under Article 12(7) of the Regulation to ensure immediate intelligibility.
“Such information may be provided in combination with an icon to provide, in an easily visible, intelligible, and clearly legible manner, a meaningful overview of the intended processing.”
The evidence also demonstrates a total failure to document technical and organizational security measures under Article 32 of the GDPR. Transmitting unencrypted or inadequately managed remote video feeds to consumer smartphones creates structural vulnerabilities, exposing visual workplace data to unauthorized access and interception. The data controller failed to prove the existence of internal access controls, user credential auditing, or secure transmission protocols.
Crucially, the subsequent issuance of authorization No. 40218 by the Labor Inspectorate on October 31, 2024, did not cure the retroactive unlawfulness of the system. The Garante established that statutory protections under Article 4 of Law No. 300/1970 must precede system activation. Operating surveillance infrastructure prior to official authorization constitutes a complete statutory infraction that cannot be mitigated by post-factum administrative filings.
Evaluating the proportionality, dissuasiveness, and effectiveness criteria mandated by Article 83(1) of the GDPR, the Authority levied a pecuniary administrative sanction of €2,000.00 against Hanako s.r.l. for cumulative breaches of Articles 5(1)(a), 5(1)(f), 13, and 32 of the Regulation, in conjunction with Article 114 of the Italian Privacy Code.
Transparency, Legal Basis, and Institutional Traceability
The foundational documentation governing this investigation is rooted in official Italian administrative proceedings published in the public registry of the national supervisory authority. In accordance with Italian Law No. 633 of April 22, 1941, Article 5, official texts of the State and public administration acts are not subject to copyright restrictions and reside in the public domain, ensuring full civic and journalistic scrutiny.
The authoritative instrument underlying this dossier is the formal Injunction Order (Ordinanza Ingiunzione) issued on March 12, 2026, cataloged under Document Card No. 10240451 by the Garante per la protezione dei dati personali. The instrument carries the institutional signatures of President Pasquale Stanzione, Relator Ginevra Cerrina Feroni, and Vice Secretary General Filippi. Judicial appeal against the ruling is preserved under GDPR Article 78, Article 152 of the Privacy Code, and Article 10 of Legislative Decree No. 150/2011, open within thirty days before the ordinary judicial authorities.
Primary document reference: Provvedimento del 12 marzo 2026 [10240451] - Garante per la protezione dei dati personali.