Video-surveillance and data protection: the Italian Data Protection Authority reaffirms transparency obligations

With Decision No. 167/2026 of 12 March 2026, the Italian Data Protection Authority (“Garante per la protezione dei dati personali”) once again addressed the issue of video surveillance, reaffirming certain fundamental principles relating to the processing of personal data and the remote monitoring of employees.

First of all, it should be recalled that the use of video surveillance systems constitutes, for all intents and purposes, the processing of personal data under the applicable legal framework. Consequently, the data controller is required to comply with the principles of lawfulness, fairness and transparency set out in Article 5 of Regulation (EU) 2016/679 (“GDPR”).

In the case examined by the Authority, several critical issues were identified, including:

• the absence of an adequate privacy notice addressed to data subjects,
• the lack of prior authorization from the Territorial Labour Inspectorate, required because the cameras enabled the remote monitoring of employees,
• the absence of individual credentials for accessing the recorded footage.

Particular emphasis was placed by the Authority on the breach of the transparency obligation, which was considered especially serious. Indeed, data subjects must be placed in a position to immediately understand that they are entering an area subject to video surveillance. To this end, appropriate information notices must be displayed through clearly visible signs positioned at eye level and easily readable.

The essential information to be included in the so-called “first-layer” notice includes:

• the purposes of the processing,
• the identity of the data controller,
• a reference to the rights granted to data subjects under the GDPR.

The Authority also refers to the EDPB Guidelines No. 3/2019, clarifying that additional mandatory information may be provided through supplementary means (“second-layer” information), provided that such information is easily accessible. By way of example, such information may be made available:

• at reception desks, information points or cash desks,
• through documents displayed in accessible areas,
• via QR codes,
• through a dedicated web link.

The purpose is to ensure that all data subjects receive information that is complete, clear and effectively accessible.

The decision also addresses the sensitive issue of the remote monitoring of employees. As is well known, pursuant to Article 4 of the Italian Workers’ Statute, audiovisual equipment and other tools from which the monitoring of employees’ activities may derive, even indirectly, may only be installed following either a trade union agreement or prior authorization from the Territorial Labour Inspectorate.

The decision confirms the increasing attention paid by supervisory authorities to video surveillance systems, particularly in publicly accessible environments and workplaces.

Accordingly, companies should ensure that they:

• verify the appropriate legal basis for the processing activities,
• implement multi-layer privacy notices compliant with the GDPR,
• install clearly visible signs containing the essential information,
• regulate access to recorded footage through individual credentials,
• assess whether trade union agreements or labour authority authorizations are required pursuant to Article 4 of the Italian Workers’ Statute.

Formal and substantive compliance of video surveillance systems has now become an essential safeguard not only from a data protection perspective, but also in relation to employment law and administrative sanctions.