By Order No 8375 of 23 March 2023, the Italian Court of Cassation confirmed that footage from video surveillance systems installed for security purposes may be used to prove an employee’s disciplinary breach.
The facts of the case and the first and second instance proceedings
The case arose from a disciplinary sanction of suspension from duty and pay for ten days imposed on a vocational teacher for forcibly grabbing a student by the shirt and, after releasing his grip, causing him to fall to the ground.
The teacher, moreover, ‘while the pupil […] communicated to his mother what had happened […]’ addressed the latter ‘in an ill-mannered way using decidedly heated tones’.
The event was filmed by means of the video surveillance system installed by the Authority – the educator’s employer – at the Authority’s premises, and the recordings used to make the disciplinary complaint.
The teacher, having received the disciplinary measure, in requesting its annulment challenged, among other things, the use of the video surveillance system footage for disciplinary purposes.
In the proceedings on the merits, the Court of Appeal rejected the request to annul the sanction and, upholding the appeal lodged by the teacher, reformed the first instance judgment by redetermining the sanction as a fine of three hours.
The teacher appealed before the Italian Court of Cassation and the Authority filed a counter-appeal.
The decision of the Italian Supreme Court
The Italian Court of Cassation – in confirming the ruling on the merits – affirmed the lawfulness of the use of video surveillance system footage for the purpose of making a complaint based on an employee’s disciplinary breach.
Noting the lack of defects in (i) the explanation of the factual and legal reasons on which the decision on the merits was based or (ii) the explanation of the logical / legal path followed by the Court of Appeal, the Court of Cassation confirmed the correctness of the assessment by the second instance judges in assessing the video surveillance system footage on the basis of the ‘argument for the usability [of the footage], in conjunction with the other investigative elements considered’.
The full version can be accessed at MAG de Legalcommunity
On 5 December last, the Data Protection Supervisory Authority (the “Authority”) developed FAQ (“Frequently Asked Questions”) on personal data processing carried out by public and private entities using video surveillance systems.
The Authority’s clarifications take account of what was introduced by Regulation (EU) 2016/679 on personal data protection (known as “GDPR”) and by the Guidelines adopted by the European Data Protection Board (“EDPB”) on the point.
The FAQ clarify, firstly, that (i) processing carried out using video surveillance systems must be performed in respect of the principle of minimisation, in relation to the choice of recording methods and the positioning of the system, and (ii) the data processed must be pertinent and not excessive with respect to the purposes pursued.
Based upon the principle of accountability, it is the duty of each Controller to carry out assessments of the lawfulness and proportionality of processing, considering the context and respective purposes, as well as the risk to the rights and freedoms of the data subjects.
In the Authority’s opinion, each Controller must assess if the requirements are in place to carry out a data protection impact assessment (“DPIA”) before commencing the processing.
In relation to the privacy notice to be provided to the data subjects, the FAQ specify that the simplified model (warning sign), developed by the EDPB and disseminated with its Guidelines, may be adopted. The sign must contain (i) contact details of the Controller and, where present, Data Protection Officer (DPO); (ii) storage period of information collected and (iii) purposes of processing carried out. The sign must be positioned before the surveilled area, so that the data subjects can see which area is covered by a video camera, and must refer to a complete privacy notice containing all information indicated in Article 13 of the GDPR, including indications on the methods of acknowledgement.
The Authority also reiterates that the recorded images should be erased after a few days (24/48 hours) and that the longer the storage period, the more detailed the analysis on the legitimacy of the purpose and the actual need for longer storage must be.
Finally, it is noted that video surveillance systems can only be installed in workplaces for organisational and production requirements, for workplace safety and protection of company property, in respect of the guarantees envisaged by Article 4 of Italian Law no. 300/1970.
◊◊◊◊
In conclusion, the FAQ, available on the Authority’s website (www.garanteprivacy.it), contain indications on the necessary requirements in order for personal data processing carried out using video surveillance systems to be lawful.
The FAQ supersede, albeit partially, the previous “Measure on video surveillance dated 8 April 2010”, adjusting the provisions contained therein to what was introduced by the GDPR and by the EDPB Guidelines.
Other insights related:
EDPB: Preliminary version of Guidelines 3/2019 on video surveillance
On 6 September 2019, the European Data Protection Board (“EDPB“) completed its public consultation on the document containing the draft of the forthcoming Guidelines 3/2019 concerning video surveillance (“Guidelines 3/2019 on processing of personal data through video devices“).
The images and audio tracks that are processed through the use of video surveillance systems, fall under the definition of “personal data” as they enable individuals to be identified, be it directly or indirectly. The processing of such information must therefore fully comply with EU Regulation 2016/679 – GDPR – on the protection of personal data and (in accordance with Italian law) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 containing the rules for adapting national legislation to the said Regulation.
The aim that the European Committee intends to achieve with the issuance of these new Guidelines, is to ensure a uniform application of the legislation on video surveillance within all Member States of the European Union.
In view of the foregoing, it
must first be made clear that the clarifications given in the draft concerning
the legal basis on which the installation of the system is based are of
fundamental importance.
In principle, it is possible that all the conditions for lawfulness set forth
in Article 6, paragraph 1), of the GDPR
are met, even if those most applied in practice are the legitimate interest
that the Data Controller needs to pursue (Article. 6, paragraph 1),
section f), GDPR) or the performance of a task in the public interest (Article
6, paragraph 1), section e), GDPR).
The European Committee clarifies that the Data Controller must specify in detail both the legal basis on which the data processing carried out is based and the detail of the purposes pursued. A system based on “security” in its simplest and most general sense is no longer a sufficiently detailed purpose.
Another important clarification concerns filming based on legitimate interest. Data processing is considered lawful only if this legal basis remains real, current and demonstrable at all times.
The Italian Data Protection Authority has, on several occasions, recommended that Data Controllers use the video surveillance tool in a proportionate and non-excessive manner and this approach can be found in the draft of the forthcoming Guidelines. Before proceeding with the installation of such systems, in fact, the Data Controller must use other tools (such as, for example, support by appropriate security staff, the provision of remote-controlled gates or adequate lighting) and demonstrate the effective need for the adoption of a video surveillance system. This, paying particular attention to limiting and defining, both temporally and geographically, filming in order to constantly respect the principle of minimisation of personal data pursuant to Article 5, point 1, section c) of the GDPR.
Each Data Controller is required to balance the interests involved by analysing, on a case-by-case basis, the legitimate interests of the Data Controller, on the one hand, and the fundamental rights and freedoms of the data subjects on the other.
In view of the above, the EDPB is awaiting the publication of the final text of the Guidelines, which are not only the first document to apply the principles of the GDPR to data processing carried out by video filming, but also, by national law, the first new document on the subject after the “Provision on video surveillance” issued by the Italian Data Protection Authority on 8 April 2010.
The National Labour Inspectorate, with Circular Letter no. 1881 of 25 February 2019, has clarified aspects concerning the application of Article 4, Workers’ Statute, in the event of occurrence – following changes in the company ownership structure (mergers, transfers, incorporations, leases of company or business lines) – of a change of ownership of a company that has installed video surveillance systems or other systems allowing remote monitoring of work activities.
More specifically, the Inspectorate was asked if in these cases it is necessary to repeat the procedure with the trade unions or the authorization procedures or if instead it is enough that the occurred change of ownership be formally notified to the competent office of the Inspectorate.
Reference Regulations
Article 4 of the Workers’ Statute, which was amended in 2015, sets forth (par 1) that the audio-visual systems and other tools allowing remote control of workers’ activities, can be used exclusively for:
Moreover, even if the above conditions are met, it is necessary that:
The indications of the Inspectorate
The Inspectorate clarified that in the event of a mere “take-over” of a company’s facilities previously equipped with the aforementioned tools/systems, it not necessary to “replicate” the procedures (trade union agreement / administrative authorization) set forth in Article 4 of the Workers’ Statute. This is so provided that changes have not occurred with regard to (i) the requirements of legitimization (production and organizational needs, safety at work and protection of company assets) and (ii) the operational arrangements of the systems (framing, angles of coverage, etc.).
However, according to the Inspectorate, it is necessary that the company taking over the facilities:
In any case, the Inspectorate has clarified that any type of use of the devices other than the authorized uses is forbidden, under penalty of the obligation to repeat the described authorization procedures, just like in the event of a change of the requirements of legitimization.
Other News:
Remote control of workers: additional operating provisions from the Labour Inspectorate
