In two lines
Italian DPA, decision no. 619 of 3 September 2026 (doc. web no. 10294255): EUR 8,000 against the special agency running the City of Trento's sports facilities for breach of Arts. 5(1)(a) and (e), 6(1)(c) and (e), 12(1) and 13 GDPR, and Art. 2-ter of the Italian Privacy Code.
The cameras were in the changing rooms of the swimming pool at the Trento Nord sports centre, in Gardolo, and framed the locker area where users leave their belongings. They had been installed to stop thefts of wallets and phones, which the operator said had produced «insecurity and a consequent sense of unease among users». The system was covered by an agreement with the company's union representatives signed on 13 September 2007, under Art. 4 of Law no. 300/1970.
What did not hold
A changing room is a place of high expectation of privacy, and that does not depend on which portion of it falls within the frame. The processing was found to lack an adequate legal basis and to be contrary to the principles of lawfulness, fairness and transparency. Shortcomings emerged in the notices to users, and the one for the workers being filmed arrived only after the investigation had started: a notice produced in answer to an inspection is not a notice, it is a patch.
The seventy-two hours, and why they concern every system
The operator declared a retention of seventy-two hours. The authority does not argue that this is too long: it argues that it was not accompanied by a specific assessment showing it was necessary. That is the difference between choosing a period and adopting one. Anyone running a CCTV system has a number of hours or days in their notice: the question is not whether that number is defensible in the abstract, but whether a document exists explaining why it is that number and not half of it. During the proceedings the operator reduced the retention times, besides switching off and removing the changing-room cameras and updating signage and notices.
What to check on every system you oversee
1) Ask for the floor plan with each camera's field of view, not the wiring diagram: the difference between those two documents is where the fines are. 2) Ask for the document that justifies the retention period. If it does not exist, the number in the notice is an unfounded statement, and that is what cost money here. 3) Check that the notice to workers exists and is dated before the system was switched on, not after. 4) Remember that the union agreement under Art. 4 of the Workers' Statute legitimises remote monitoring in employment law, but does not by itself supply the legal basis for the processing: here the 2007 agreement existed, and the fine came anyway.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
