Video surveillance systems are now among the most widely used tools by companies to protect the safety of property and people. However, their installation and use are not unrestricted, but governed by a complex regulatory framework aimed at balancing the employer's security needs with workers' right to privacy and dignity. In Italy, the two fundamental pieces of legislation to consider when installing a video surveillance system in a company are:
- Article 4 of the Workers' Statute (Law 300/1970);
- The General Data Protection Regulation (GDPR – EU Reg. 2016/679).
Installing a video surveillance system without strict compliance with the rules in force exposes the company to heavy penalties: administrative ones under the GDPR, and criminal ones for breach of Article 4 of the Workers' Statute. The obligations, however, are not the same for everyone.
- Companies without employees: must comply with the GDPR only.
- Companies with at least one employee: in addition to the GDPR, must fully apply the Workers' Statute and its authorization procedure.
Companies with employees: compliant installation
The first step towards a compliant installation is to identify the purposes of the system. Article 4 of the Statute allows video surveillance systems to be used exclusively for:
- Organizational and production needs
- Workplace safety
- Protection of company assets
At the same time, the law expressly prohibits installing cameras for the purpose of remotely monitoring employees' work, their diligence or their performance. It is also essential to stress that installing cameras is strictly prohibited, even if declared necessary for security or asset protection reasons, in areas reserved for employees’ private use, such as restrooms, where their privacy and dignity must be protected, such as restrooms, changing rooms, recreation areas or personal lockers. Likewise, installing "fake" or non-working cameras is unlawful, as these too can infringe workers' dignity by creating an unjustified sense of being watched without pursuing any legitimate purpose.
The installation of audiovisual systems and other tools that make it possible to monitor workers' activity remotely is subject to prior agreement with the RSA/RSU (workplace union representatives) or, in their absence, with the most representative trade unions at national level, through their local branches; failing agreement, specific authorization from the competent local office of the National Labour Inspectorate (INL) is required (art. 4, Law 300/1970).
Installing a GDPR-compliant video surveillance system
Once the purposes have been defined and the union agreement or Labour Inspectorate authorization obtained (to repeat, only for companies with at least one employee), the processing of images must comply with the fundamental principles of the GDPR:
Lawfulness, fairness and transparency
Processing must always have a clear legal basis and data subjects must be informed in an understandable way.
Purpose limitation
Images must be collected only for specific, declared purposes, and not subsequently used for other purposes.
Data minimization
Only the images strictly necessary to achieve the stated objectives may be captured.
Storage limitation
Recordings must be kept only for the time strictly necessary. Generally no more than 24–48 hours; however, a maximum retention period must be defined and documented. Only in exceptional cases (public holidays, company closure, documented security needs) may this period be extended.
Integrity and confidentiality
Images must be protected from unauthorized access and properly stored. It is mandatory to formally appoint in writing a limited number of specifically authorized persons (persons authorized to process the data) to view the images, trained on the regulations and internal procedures, restricting access to when it is strictly necessary for the purposes pursued.
Before installing video surveillance systems, two types of privacy notice must be prepared for everyone who might be filmed – employees and visitors:
- Information signs (short notice)
- They must be placed in a clearly visible position at the entrance to and inside the monitored areas.
- Their text and graphics must be drafted in accordance with the EDPB Guidelines 3/2019 on processing of personal data through video devices, ensuring immediate comprehensibility and clarity on the purposes of the processing.
- Extended notice (full document)
- It must describe in detail the legal basis, purposes, retention period and how to exercise rights (access, rectification, erasure, objection).
- It must be easily accessible, for example via an intranet link, a QR code on the signs or a paper copy handed to data subjects.
Another essential step, before installing a video surveillance system, is the Data Protection Impact Assessment (DPIA).
The DPIA analyzes:
- the necessity and proportionality of the system,
- the risks to the rights and freedoms of data subjects,
- the technical and organizational measures adopted to mitigate them.
Only after completing the DPIA and defining signs and notices compliant with the EDPB guidelines can the equipment be installed.
In conclusion, adopting a company video surveillance system is a strategic choice to increase workplace security and protect assets, while safeguarding the privacy of everyone concerned – employees, visitors and suppliers. Complying with the GDPR is not just a legal obligation, but a sign of transparency and accountability towards anyone who passes through or works within the company.
Given the complexity of the procedures and the risk of penalties in case of non-compliance, Argo Business Solutions offers specialist support that guides the organization through every operational phase. From the preliminary analysis and preparation of the Data Protection Impact Assessment (DPIA), to drafting the notices – short ones, prepared according to the EDPB Guidelines, and full ones – through to setting image retention periods, documented and calibrated to actual business needs. We also handle all the formalities needed to submit the authorization request to the local office of the National Labour Inspectorate, ensuring compliance with regulatory requirements. We complete the service with technical assistance for installing and configuring the systems and with staff training, so that the system is fully operational and GDPR-compliant from day one.
Would you like more information on how we can help your company comply with the rules on video surveillance systems? Write to us using the contact form or send an email to info@argobs.com.