Workplace video surveillance: Garante fine and lessons for Luxembourg

Verifiable fact — On 26 March 2026, Italy’s Garante fined a shop €2,000 for operating video surveillance without displaying notice and without prior labor‑inspection authorization while employees were present. Decision: Doc. web No. 10246082; corrective measures ordered (signage within 30 days; ban on activation during opening hours until authorization is obtained). Official source: 26/03/2026 decision.

Takeaway for Luxembourg — The CNPD and Article L.261‑1 of the Labour Code require proportionality, visible two‑layer information, and often a DPIA before go‑live.

The case

The Garante found breaches of Articles 5(1)(a) and 13 GDPR (transparency/information) and Article 88 GDPR, linked to Article 4 of Italian Law No. 300/1970. Decision: Provvedimento of 26 March 2026 (Doc. web 10246082). The EDPB Guidelines 3/2019 on video devices (two‑layer information) are expressly cited: EDPB 3/2019.

Legal reasoning

• Lawful basis and transparency (Arts. 5(1)(a), 6, 13 GDPR): filming staff and customers is processing that needs a lawful basis (often legitimate interests, Art. 6(1)(f)) and clear notice before entering the monitored area. EDPB 3/2019 requires a first‑layer sign (controller, purpose, basis, key rights, DPO/contact) and an easily accessible second layer. See the GDPR obligations.
• Employment context (Art. 88 GDPR): in Italy, Law 300/1970 Art. 4 requires a union agreement or labor‑inspection authorization for any device enabling indirect monitoring of employees; otherwise processing is unlawful. The Garante based the fine on this combined framework.
• Luxembourg transposition: in Luxembourg, Article L.261‑1 strictly governs surveillance in employment: prior collective information of staff representatives (or staff), the option to seek CNPD’s opinion within 15 days, and compliance with GDPR obligations (Arts. 12–13 information, Art. 30 records, Art. 35 DPIA).
• Retention periods: the CNPD considers retention “in principle” up to 8 days, unless duly justified; beyond 30 days is generally disproportionate.

What this changes in practice

• Filming employees without the labor framework makes processing unlawful, even for “security” purposes. In Luxembourg, L.261‑1 steps and robust documentation are non‑negotiable; a certified DPO mandate can help operationalize compliance.
• Signage is not cosmetic: missing signs = Article 13 breach. Signs must be visible before entry, contain key elements, and point to a full notice (QR code, URL, reception). Reference: EDPB 3/2019.
• No “wild activation”: in Italy, activation was limited to closing hours until authorization was granted. In Luxembourg, a project not aligned with L.261‑1 risks CNPD complaints and corrective orders; aim for CNPD compliance in Luxembourg before go‑live.
• DPIA is near‑systematic: workplace video surveillance typically triggers a DPIA (systematic monitoring, power imbalance, public‑area coverage). See EDPB’s DPIA page.
• Short, justified retention: set 8 days by default, log any justified extension (confirmed incident), and avoid disciplinary use without a clear basis and prior notice.

Immediate application examples

• Shops, banks, industrial sites: launch L.261‑1 steps (inform staff reps; possible CNPD opinion) before installation, post signs at entry, and run a solid DPIA (necessity, masking, schedules, purging).
• Multi‑tenant offices: avoid continuous filming of workstations; prefer perimeter protection and masking; document legitimate interests and balancing.
• “Smart” camera networks (people counting, behavioral analytics): higher risk; require an in‑depth DPIA, strict minimization, and prior consultation with CNPD if residual high risk (Art. 36 GDPR). Reference: EDPB 3/2019.

Official sources

• Garante — 26/03/2026 decision (Doc. web 10246082): link.
• EDPB — Guidelines 3/2019 on video devices: link.
• CNPD Luxembourg — “Video surveillance” file: link.
• CNPD — Retention limitation (8 days “in principle”): link.
• CNPD — Labour Code Article L.261‑1: link.
• Guichet.lu/ITM — Information and co‑decision: link.
• EDPB — DPIA: link.

Need a quick review or second opinion before deployment? Feel free to contact us.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.