29 Apr Video surveillance: the decision by the Italian Court of Cassation

Main background information

“The defensive use of video surveillance by the employer if directed to ascertain illegal behavior and damage to assets and corporate image are exempt from the scope of application of art. 4 l. n. 300/1970, and do not require compliance with the guarantees provided by that law, especially when the video surveillance is arranged after a crime is committed, so as to disregard the mere supervision on the execution of work performance (see Criminal Cassation section III, 14/12/2020, n. 3255)“.

This is the principle that the Italian Criminal Court of Cassation has expressed and that deserves to be contextualized and interpreted correctly in order not to fall into the misunderstanding of believing that one can install a video surveillance system in the workplace sic et simplicter without incurring any criminal sanctions.

The case submitted for examination by the Court of Cassation concerned the installation of a video surveillance system by the owner of a retail business in the absence of a prior agreement with the company’s trade union representatives or the authorization of the Labor Inspectorate. The employer, in particular, had installed this system because of some shortages (e.g., products were missing) in the employer’s warehouse. The system was therefore installed to protect the company’s assets. In this case, the cameras pointed exclusively on the shelves and towards the tills.

Main topic

The question that arises in the case under analysis requires verification of whether and when the crime pursuant to article 171 of Legislative Decree no. 196/2003 (“Personal Data Protection Code”) can be committed, which is inferred from the combined provisions of articles 4 and 38 of Law no. 300 of May 20, 1970 (the so-called “Workers’ Statute”). Pursuant to the aforementioned provisions, the offence occurs whenever audiovisual equipment or other instruments that may be used to remotely monitor the activities of employees are installed – in the absence of an agreement with trade union representatives or without authorization from the (Territorial or National) Labour Inspectorate (hereinafter, for the sake of simplicity, only the “Conditions”) and, therefore, in breach of the regulations set out in art. 4, paragraph 1 of the Workers’ Statute.

It should be pointed out that, following the successive reforms that have taken place over time, art. 4 paragraph 1[1] of the Workers’ Statute has[2], on the one hand, maintained its main rationale of prohibiting the installation of equipment designed to remotely monitor a worker’s activities in the absence of the Conditions. On the other, however, it has “strengthened” the provision of specific exceptions aimed at protecting the company’s assets, exceptions that we will analyze in greater detail below and on which the judgment under review is based.

The development of jurisprudence over time, in fact, has taken into account, in some pronouncements, the exceptions of art. 4, paragraph 1 of the Statute, not always deeming the case under art. 171 of the Personal Data Protection Code to be integrated in absence of the Conditions.

In particular, the Supreme Court of Cassation has shown an ambivalent attitude on the subject, considering in some pronouncements even the mere installation of a video surveillance system by the employer as unlawful conduct, even where a “fake” camera or when a camera is not actually used, in the absence of the Conditions (see, in particular, Sect. 3, no. 45198 of 07/04/2016, Luzi, Rv. 268342-01, and Sect. 3, no. 4331 of 12/11/2013, dep. 2014, Pezzoli, Rv. 258690-01). In others it has expressed a principle of law which is more favorable to the employer, considering legitimate the so-called hidden defensive controls of the employer aimed at ascertaining unlawful conduct of the employee (thus, in motivation, Sect. 3, no. 8042 15/12/2006, Fischnaller, Rv. 236077-01, which also cites, as a further precedent, “Cass. 16/06/2002, no. 8388”). In these last sentences, in the event of concrete evidence of unlawful acts by employees to the detriment of the company’s assets, hidden surveillance by the employer in the workplace has been deemed admissible in order to dispel doubts as to the existence or otherwise of such conduct, even in the absence of the Conditions.

This principle has also been embraced by the Strasbourg Court[3], which has deemed legitimate the hidden surveillance carried out by the employer in the workplace even in the absence of the Conditions, provided that the surveillance activity respects the criterion of proportionality, which exists in the hypothesis of:

• • serious and concrete indications that the employee is committing wrongdoing[4];
  • surveillance limited to the sole purpose of ascertaining the wrongdoing being committed by the employee, and in a manner proportionate to that sole purpose[5]; and
  • discontinuation of covert surveillance once the investigation of the case has been completed.

Obviously, this cannot allow the employer to carry out generalized and indiscriminate surveillance.

The case under examination follows exactly these hermeneutical principles, as it states that for the purposes of the admissibility of the installation of the system in the absence of Conditions, it is necessary that this “is strictly functional to the protection of corporate assets, provided, however, that its use does not imply a significant control on the ordinary course of work of employees, or must remain necessarily ‘confidential’ to allow the detection of serious misconduct of the same”.

This interpretation, according to the Court, is consistent with the regulatory provisions, as art. 4 of the Workers’ Statute requires prior agreement when the installation of the system is functional to the control, even potential, of the working activity of the employees and not when, exceptionally and occasionally, it is set up for the sole purpose of controlling the activity of a single worker in order to protect the company’s assets and in the presence of certain circumstances and protections in the field of confidentiality and the protection of personal data[6].

Conclusions and practical implications

As seen from the brief notes above, the installation of a video surveillance system is not permitted in the absence of protections for the worker, but it is necessary to verify how to proceed on a case-by-case basis, according to the principle of proportionality. In particular, the interpretation of art. 4 of the Workers’ Statute requires a fair and reasonable balance between the constitutional provisions. First of all, on one hand, the right to dignity and freedom of the worker in the exercise of its services and the right of the citizen to respect for his or her person must be guaranteed (Articles 1, 3, 35 and 38 of the Constitution), and the free exercise of the activities of the company). At the same time, on the other hand, the free exercise of entrepreneurial activities must be guaranteed (art. 41 Constitution), with the further consideration that “it would not respond to any logical-systematic criterion to guarantee the worker – in the presence of unlawful conduct punishable criminally or with the expulsion sanction – a protection to his ‘person’ greater than that recognized to third parties unrelated to the company” (so, verbatim, in the grounds, Civ. Sec. Lab. No. 10636 of 2017).

In order to comply with the above principle, the employer must therefore equip itself with management and control systems that are adequate and proportionate to the type of machinery and system installed and integrated with the various applicable regulations, including the protection of personal data and the rights enshrined in labor law, in order to adequately weigh the risks to be prevented and provide appropriate protection measures identified on the basis of a risk-based approach.

In other words, even in the exceptional cases mentioned above, all necessary requirements should be followed in order to make the video surveillance system compliant with the various applicable regulations so that the employee can be monitored in the absence of the Conditions. Among the precautions to be taken into consideration with a view of achieving maximum compliance with the principle of proportionality referred to above, one cannot forget (1) the limitation of the visual angle subject to video surveillance and (2) the temporal limitation of filming what is strictly necessary in relation to the exceptional purposes pursued.

Exceptions will therefore have to be assessed on a case-by-case basis, bearing in mind in any case the importance of protecting workers by strengthening their internal management and control systems to safeguard personal data and the guarantees provided for by employment law.

To this end, from the point of view of accountability[7] and with a view to the maximum protection of the employer, it is suggested that a specific procedure be drawn up detailing the employer’s methods of action, both in the event of so-called “defensive” controls and in the event of any other type of control. Finally, it is suggested that a specific procedure is drawn up detailing the action to be taken by the employer, both in the case of so-called “defensive” controls and in all cases where it is necessary to access video surveillance images, in order to respect the principle of data minimization and the opposing needs (protection of assets and respect for the freedom of workers) at stake, adequately examining the needs of the company from the point of view of labor law, data protection, and criminal law (which may be relevant both from the point of view of the Personal Data Protection Code and pursuant to Legislative Decree 231/2001).

In all other cases, the following points should be noted:

1. 1. it is necessary to prepare a prior trade union agreement with the company trade union representatives or, alternatively, to request authorization from the Territorial Labor Inspectorate;
   2. it is necessary to follow the indications of the European Data Protection Board expressed in the Guidelines 3/2019 on the processing of personal data through video devices, in addition to the principles expressed by the Italian Supervisory Authority[8] on the subject;
   3. to carry out a data protection impact assessment pursuant to Article 35 of the European Regulation 2016/679 (“GDPR”)[9],
   4. Draft a privacy policy/information notice (both short and extended versions) pursuant to Article 13 of the GDPR and following the above-mentioned prescription,
   5. to carry out a legitimate interest assessment (Article 6(1)(f) of the GDPR).

Notes

[1] “Audio-visual equipment and other instruments that may also be used to remotely monitor workers’ activities may only be used for organisational and production requirements, for work safety and for the protection of company assets, and may be installed following a collective agreement stipulated by the unitary trade union representation or by the company’s trade union representatives. Alternatively, in the case of companies with production units located in different provinces of the same region or in more than one region, such agreement may be stipulated by the most representative trade unions at national level. In the absence of an agreement, the equipment and instruments referred to in the first sentence may be installed subject to authorization by the territorial headquarters of the National Labour Inspectorate or, alternatively, in the case of companies with production units located in the areas of competence of more than one territorial headquarters, by the central headquarters of the National Labour Inspectorate. The measures of which to the third period are definitive“.

[2] Introduced first by Legislative Decree No. 151, September 14, 2016, Article 23, paragraph 1, and then by Legislative Decree No. 185, September 24, 2016, Article 5, paragraph 2.

[3] See the Lopez Ribalda case of 17 October 2019. In the same sense, another ruling of the European Court of Strasbourg according to which, the hermeneutic solution functional to consider the so-called “defensive controls” admissible is consistent with the principles dictated by art.  8 of the European Charter of Human Rights, since in the use of the instruments of control, a fair balance must be struck between the opposing rights on the basis of the principles of “reasonableness” and “proportionality” (see EDU Court, 12/01/2016, Barbulescu v. Romania, according to which the instrument of control must be limited in scope and, therefore, proportionate).

[4] The cases submitted to the examination of the Strasbourg Court concerned the hypotheses in which, in retail companies, thefts had occurred and the employer had suspected the employees to be at fault. To this end, it was considered legitimate to install cameras in the areas where the thefts had occurred in order to discover the perpetrator of the offence.

[5] Therefore, cameras installed only to film circumscribed areas and for the time strictly necessary to identify the perpetrator of the offence have been deemed to meet the criterion of proportionality.

[6] In order to protect confidentiality, precautions such as limiting the angle of view of the cameras and positioning them so as to film only the areas subject to theft are considered necessary even in the presence of the so-called defensive cameras. In other words, indiscriminate filming of workers’ activities is not possible.

[7] Accountability in the perspective of the GDPR indicates all those measures taken by the data controller in order to allow maximum respect and protection of personal data that is to be processed in the performance of its activities. This means using a risk-based approach to verify the risks associated with a particular processing activity and in a perspective of privacy by design and by default, taking all necessary measures to prevent those risks.

[8] See the Provision of the Italian Supervisory Authority on video surveillance of 8 April 2010. In particular, the Italian Supervisory Authority in section 3.1 of this provision clarified that “The interested parties must always be informed that they are about to access a video-surveilled area; this also applies to events and public performances (e.g., concerts, sporting events).

To this end, the Italian Supervisory Authority believes that you can use the same simplified “minimum” information notice model, indicating the Data Controller and the intended purpose, already identified pursuant to art. 13, paragraph 3 of the Code in the provision of 2004 and reported facsimile in Annex 1 to this measure.

The [information notice] model is obviously adaptable to various circumstances. In the presence of more than one camera, in relation to the size of the area to be surveyed and the methods of filming, more signs may be installed“.

Similarly, the above-mentioned Guidelines of the European Data Protection Board clarify the need to adequately inform the data subject, by means of appropriate signs and through extensive information provision. In the same sense, see the FAQ of the Italian Supervisory Authority which specifies “The data subjects must always be informed (ex art. 13 of the Regulation) that they are about to access a video surveillance area, even during public events and shows (for example, concerts, sporting events) and regardless of whether the person processing the data is a public or a private entity“.

[9] The need to carry out the impact assessment derives both from the Guidelines 3/2019 on the processing of personal data through video devices, but also because of what is provided in the blacklist of the Italian Supervisory Authority whose list, at point no. 5 refers precisely “to processing carried out within the framework of the employment relationship by means of technological systems (also with regard to video-surveillance and geolocation systems) from which it is possible to carry out remote monitoring of employees’ activities“.