{"id":30591,"date":"2026-01-15T14:50:09","date_gmt":"2026-01-15T13:50:09","guid":{"rendered":"https:\/\/it.andersen.com\/?p=30591"},"modified":"2026-01-15T14:56:37","modified_gmt":"2026-01-15T13:56:37","slug":"compliance-risk-management-the-risks-associated-with-installing-a-video-surveillance-system","status":"publish","type":"post","link":"https:\/\/it.andersen.com\/en\/compliance-risk-management-the-risks-associated-with-installing-a-video-surveillance-system\/","title":{"rendered":"Compliance & Risk Management – The risks associated with installing a video surveillance system"},"content":{"rendered":"

In this fifth issue of the Compliance & Risk Management<\/strong> Newsletter, professionals from Andersen’s 231\/Privacy<\/strong> Service Line have explored the topic of video surveillance in the workplace<\/strong>, highlighting the growing importance of adopting appropriate measures to mitigate the risks associated with the installation of a video surveillance system (CCTV), thereby improving governance<\/strong>.<\/p>\n

Video surveillance in the workplace: the distinction between lawful and unlawful use pursuant to Legislative Decree 231\/2001<\/h2>\n

The installation of cameras is lawful only if prior authorisation<\/strong> is obtained from the competent local Labour Inspectorate or if an agreement is entered into with the trade union representatives, as provided for in Article 4 of the Workers’ Statute. Failure to comply with this requirement qualifies the activity as covert monitoring of workers<\/strong>, a crime that gives rise to administrative liability for the entity. Defensive surveillance is an exception, which is only lawful in the event of serious and concrete evidence of wrongdoing.<\/p>\n

Therefore, in order to strengthen the company’s position, the MOGC must incorporate specific dedicated protocols<\/strong>: from GDPR-compliant privacy notices to the training of managers and the Supervisory Body, to the detailed mapping of areas under video surveillance.<\/p>\n

Video surveillance system and facial recognition: how to make it compliant with the GDPR and the AI ACT<\/h2>\n

For compliance purposes (in particular, with the GDPR and the AI ACT), the implementation of a video surveillance system with facial recognition<\/strong> necessarily requires a risk-based approach.<\/em> In addition to defining the purposes<\/strong> for which such a system is to be installed (e.g. security, theft prevention), also considering the prohibitions provided for by the AI ACT, it is necessary to assess the risks to the rights and freedoms of individuals <\/strong>through a Data Protection Impact Assessment (DPIA), adopting systems that enable compliance with the principle of minimisation.<\/strong><\/p>\n

In organisational terms, it is first necessary to establish clear and comprehensible internal procedures<\/strong> and information<\/strong> visible in the areas under video surveillance. Only by integrating legal, technical and organisational aspects is it possible to use facial recognition in a compliant manner, thus reducing the risks to individuals’ rights.<\/p>\n

CCTV system and risk assessment: the most relevant risks<\/h2>\n

The design and installation of a video surveillance system require careful analysis of all associated risks (technical, legal, organisational, security and liability risks) in order to ensure an integrated risk management<\/strong>. Privacy issues should not be underestimated, given that a CCTV system processes images, which are personal data<\/p>\n

The impact of the video surveillance system in the workplace<\/strong> must also be carefully considered, with regard to the provisions of Article 4 of the Workers’ Statute, as well as the technical and operational risks<\/strong> due, for example, to network vulnerabilities.<\/p>\n

It is therefore necessary to establish and maintain a stable governance <\/strong>structure that provides for procedures or operating instructions<\/strong> to ensure that the system is used in full compliance with current regulations.<\/p>\n","protected":false},"excerpt":{"rendered":"

In this fifth issue of the Compliance & Risk Management Newsletter, professionals from Andersen’s 231\/Privacy Service Line have explored the topic of video surveillance in the workplace, highlighting the growing importance of adopting appropriate measures to mitigate the risks associated with the installation of a video surveillance system (CCTV), thereby improving governance. Video surveillance in […]<\/p>\n","protected":false},"author":146,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[50],"tags":[],"_links":{"self":[{"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/posts\/30591"}],"collection":[{"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/users\/146"}],"replies":[{"embeddable":true,"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/comments?post=30591"}],"version-history":[{"count":2,"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/posts\/30591\/revisions"}],"predecessor-version":[{"id":30593,"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/posts\/30591\/revisions\/30593"}],"wp:attachment":[{"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/media?parent=30591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/categories?post=30591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/it.andersen.com\/en\/wp-json\/wp\/v2\/tags?post=30591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}