Video surveillance in the workplace: employer’s obligations

General framework

The installation of video surveillance systems in workplaces is subject to compliance with the labour law regulations set forth in Article 4 of the Workers' Statute and the privacy requirements enshrined in the GDPR and individual reference disciplines.

Indeed, there are very particular areas where video surveillance is regulated by individual measures based on the specificity of the sector. However, as far as the labour relationship is concerned, the approach provided by Article 4 of the Workers' Statute applies.

The first paragraph of Article 4 of the Workers' Statute stipulates that two elements are required to install video surveillance systems: the existence of legitimate work safety, organizational and production needs, and protection of company assets. In the absence of legitimacy, there can be no justification for installation. In fact, in the Italian legal system, it is not possible to install a video surveillance system solely for the purpose of monitoring workers' activities.

The second provision in the analyzed norm is that a prior check is to be carried out by the trade unions or, in the absence of unions in the company, by an administrative body identified for the purpose. In Italy, this task is reserved for the territorial labour Inspectorate. Once the analysis of the video surveillance system that the employer intends to install has been carried out, they can proceed with an agreement between the employer and trade unions, or a specific authorization by the territorially competent Labour Inspectorate. In the case of enterprises with several production units located in different provinces of the same region or in more than one region, such an agreement may be concluded by the comparatively most representative trade union at the national level. In the absence of an agreement, the systems may be installed subject to the authorization of the territorial headquarters of the National Labour Inspectorate. In the case of enterprises with production units located in the areas under the jurisdiction of more than one territorial headquarters, the systems may be installed subject to the authorization of the National Labour Inspectorate.

Article 4 of the Workers' Statute, in its third paragraph, states that information collected through video surveillance systems may be used for purposes related to the employment relationship provided that the worker is given specific information on how the video surveillance system is to be used and how the monitoring is to be implemented. Finally, Article 4 recalls the application of the Privacy Code by definitively establishing the link between the regulations on remote control and those on personal data protection.

Requirements to be observed

Firstly, installation must be carried out in compliance with the requirements of Article 5 of the GDPR. Indeed, the principle of pertinence and necessity takes over as general criteria.

These criteria can be found in the information provided both by the Data Protection Authority and the National Labour Inspectorate.

Cameras should never be installed in such a way as to directly film the activities of workers. Constant and direct monitoring remains prohibited. The camera's range of action must, therefore, be aimed at the property to be monitored for the purpose of responding to one of the legitimating factors provided for in Article 4 Workers' Statute: safety at work; organizational and production needs; protection of company assets.

Each camera must be highlighted by specific signage that makes it known to workers that the area is being monitored. Such signage must include certain mandatory information such as the name of the data controller; the reasons for the filming; the appointment of the data protection officer, if any; and how to exercise the rights recognized by Articles 16 et seq. of the GDPR. The board must then include a link, QR code, or indication of where to access the full information regarding the processing of data resulting from the installation of video surveillance.

Particular attention must be paid to the retention time, which must be determined by following the principle of retention limitation contemplated in Article 5 of the GDPR. In practice, the time limit does not exceed 24 hours; however, longer time limits may be provided by the company in case of special needs.

Images can be viewed remotely through specific applications; however, such activity must be the subject of union agreement or administrative authorization. In such a case, the Labour Inspectorate has sanctioned that it is necessary to have a specific registry that records the logical access of those who have access and that is equipped with special security measures. As for security measures, these must be applied to the entire system. As a reminder, Article 32 of the GDPR requires the adoption of technical security measures and organizational security measures. Included in the first group are those related to system security at the IT level. Security measures must always be guaranteed to prevent the occurrence of incidents that could adversely affect the system's security.

Organizational security measures, on the other hand, concern the people involved in processing activities. In this case, it will be necessary to prepare specific contractual appointments with respect to the internal and external individuals who participate in processing: for example, appointing the System Administrator as provided for in the Provision of the Data Protection Authority; appointing any external parties in accordance with Article 28 of the GDPR (such as security companies that have access to the system for security reasons); and identifying and instructing internal parties through specific appointments as authorized processors.

Treatment activities must be reported in the Records of processing activities; the same must be updated punctually in the event of changes affecting processing activities.

Finally, there is an impact assessment requirement for monitoring activities under Article 35 of the GDPR.

Regarding the obligation of providing information, we would like to remind you of the above-mentioned points.

Pursuant to Article 4, par. 3 of the Workers' Statute, is necessary to implement an information system to make the worker aware of how the instrument is used and how it is controlled. On a practical level, this fulfillment translates into the need for the adoption of specific policies that are clearly drafted so that the worker can have full knowledge of the data processing activities concerning them.