TL;DR
With decision no. 636 of 23 September 2026, announced on 8 October, the Italian Garante fined the municipality of Arvier (Aosta Valley, about 800 inhabitants) €4,000. The system, active since 2011-2012 and later extended, served several purposes without a clear legal basis; one camera filmed the façade, windows and balconies of a private home; masking was added only after the investigation started; signs and the DPIA were inadequate. The municipality must now put the whole system in order.
The facts
The case began with a complaint from a resident: a municipal camera had a field of view that also covered her home. The inquiry found a system used for traffic and parking control, number-plate reading, environmental protection and civil protection, without the municipality having identified a clear and adequate legal basis for each purpose.
The infringements
- LEGAL BASIS. Several overlapping purposes, with no legal basis precisely identified for each.
- PROPORTIONALITY. Filming the façade, windows and balconies was not necessary for the stated purposes: a disproportionate intrusion into private life.
- PRIVACY BY DESIGN. The 'privacy masking' introduced after the investigation began is not enough: it should have been built in from the design and first configuration of the system.
- TRANSPARENCY. The signs referred generically to 'security', without the information required by the GDPR.
- DPIA. The impact assessment drawn up by the municipality was found insufficient.
Masking is designed, not patched
The most useful point of the decision is this: blacking out a private area after the complaint does not cure the infringement, because the Article 25 obligation applies when the system is designed and configured. A camera that filmed a home for years remains an infringement even if that part of the image is black today.
What the municipality must do
- Survey every camera installed in the area.
- Identify precisely the purposes and legal basis of each.
- Check and correct the fields of view, excluding private homes, with masking or blurring where needed.
- Carry out a complete impact assessment and rewrite the notices to residents.
What it means for the DPO
One: keep an inventory of the systems with, for each camera, location, purpose, legal basis and a snapshot of the field of view. Two: check the field of view at every installation and every move, documenting masked zones. Three: a first-layer notice (the sign) with controller, purposes and a pointer to the full text, as per EDPB Guidelines 3/2019. Four: a DPIA covering every purpose, including number-plate reading. Five: review everything when the system is extended, which is when these errors arise.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
