WORKPLACE VIDEO SURVEILLANCE: TESTING THE SYSTEM ALREADY CONSTITUTES DATA PROCESSING
By Decision No. 620 of 3 September 2026, the Italian Data Protection Authority examined the compliance requirements applicable during the testing phase of a workplace video surveillance system.
The case concerned a national research institute that had entered into a trade union agreement pursuant to Article 4 of the Italian Workers’ Statute for the installation of ten cameras aimed at protecting company assets. During the installation phase, however, the number of cameras was increased to eighteen and both their positioning and areas of coverage were modified compared with the layout agreed with the trade union representatives.
In particular, the system was activated in test mode for a few hours over four working days, with real-time viewing of images and no recording, despite the fact that no privacy notice had been provided to the data subjects and no data protection impact assessment had been carried out before the processing began.
According to the research institute, the system had not yet become operational and the requirements imposed by data protection legislation could therefore be fulfilled at a later stage. The Authority rejected this argument, clarifying that even the mere viewing of images constitutes personal data processing.
Particularly significant is the principle established by the Authority that the testing phase cannot be regarded as a “neutral” stage or as being exempt from the rules governing data protection and the remote monitoring of employees. Consequently, the requirements set out under both the Italian Workers’ Statute and the GDPR must be complied with before any activation of the system, even where no images are recorded and the system is used exclusively for testing or verification purposes.
For these reasons, the Authority found the processing unlawful and imposed an administrative fine of €10,000.
