A €5,000 administrative fine and an official reprimand have been imposed on the Deputy Ministry of Social Welfare by the Office of the Commissioner for Personal Data Protection, following the unlawful use of audio recording through the Ministry's surveillance system at its headquarters.
The case came to light after an anonymous complaint reported audio capture by the Ministry's closed-circuit television (CCTV) system. During an on-site inspection, the Commissioner's Office found that out of 19 operating cameras, three were recording audio — a practice not permitted under data protection laws.
The audio recording was discovered while reviewing surveillance footage in the context of investigating a break-in at the Ministry's central building. Subsequently, the Ministry contacted the installation company, which disabled the audio recording function on 30/12/2024.
The investigation revealed several violations of the General Data Protection Regulation (GDPR):
- No Data Protection Impact Assessment (DPIA): The Ministry failed to conduct a DPIA as required under Article 35 of the GDPR.
- Lack of Compliance Controls: There was no evidence of system compliance checks during installation, breaching Article 24(1).
- Inadequate Public Notification: The absence of proper signage informing individuals about the surveillance system violated Article 13.
- No Legal Basis for Processing: The audio recording was deemed unlawful under Article 5(1)(a), as it lacked a valid legal basis for data processing.
On the 16/06/2025, after assessing both mitigating and aggravating factors, the Commissioner imposed a €5,000 fine and issued a formal reprimand for the violations of Articles 13, 24(1), and 35.
In addition, the Ministry was instructed to take corrective action within two months:
- Restrict Access: Ensure that access to stored CCTV footage is limited strictly to purposes that justify its use.
- Establish Access Procedures: Implement formal procedures to control access to the system, allowing it only for authorized personnel.
This incident highlights the critical importance of public authorities complying with data protection regulations, especially when deploying surveillance technologies.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
