At a glance
1. Data controller
| Controller | Condominio Sunrise Tower |
| Italian tax code | 90028600303 |
| Address | Via Latisana 16, 33030 Lignano Sabbiadoro (UD), Italy |
| Representative | Administrator pro tempore: IAIA Servizi Immobiliari di Rossi Isabella |
| Data protection contact | amministrazioni@iaiaservizi.it |
The condominium has not appointed a Data Protection Officer (DPO), as the conditions set out in Art. 37 GDPR do not apply.
2. Purposes of the processing
Images of the common areas are processed for the sole purpose of protecting the condominium property and the safety of persons and assets (prevention and investigation of theft, damage, vandalism, assault, robbery and defacement), in relation to events occurring inside the building.
3. Legal basis
Legitimate interest of the controller in protecting the common property and ensuring safety (Art. 6(1)(f) of Regulation (EU) 2016/679), in line with EDPB Guidelines 3/2019 and the instructions of the Italian Data Protection Authority. The processing does not involve special categories of personal data (Art. 9): biometric and facial recognition functions are disabled.
4. Categories of data and processing methods
Video images of the building's common areas only, captured by fixed cameras. Private areas, the entrances of individual units and public land are excluded from the field of view or obscured by privacy masking.
Recordings are stored on local equipment located inside the building; access to the images is restricted to authorised personnel only, using individual credentials. The processing is protected by appropriate technical and organisational measures (Art. 32 GDPR); no automated decision-making or profiling takes place.
5. Storage period
Recordings are kept for a maximum of 7 days, the longest period considered appropriate by the Italian Data Protection Authority for residential buildings, and are then deleted by automatic overwriting. Retention beyond 72 hours is justified by the need to detect events occurring over weekends and public holidays and by the occasional use of some of the units.
Longer retention is permitted only upon specific request of the judicial authorities or the police.
6. Recipients of the data
- authorised personnel of the controller (building administrator), for the purposes stated above only;
- the technical maintenance provider, appointed as data processor under Art. 28 GDPR, for equipment maintenance only, with no access to recorded images unless instructed in writing by the controller;
- judicial or law enforcement authorities, upon request, in connection with investigations.
The data are not disclosed to the public nor transferred to third countries or international organisations.
7. Rights of the data subject
The following rights may be exercised against the controller:
- access to one's data (Art. 15), rectification (Art. 16) and erasure (Art. 17);
- restriction of processing (Art. 18) and objection on grounds relating to one's particular situation (Art. 21);
Requests should be sent to the controller at amministrazioni@iaiaservizi.it; a reply is provided within one month of receipt (Art. 12(3) GDPR).
8. Complaint to the supervisory authority
A complaint may be lodged at any time with the Italian supervisory authority, the Garante per la protezione dei dati personali (Art. 77 GDPR): Piazza Venezia 11, 00187 Rome, Italy · protocollo@gpdp.it · www.garanteprivacy.it. The right to an effective judicial remedy remains unaffected (Art. 79 GDPR).
9. Legal references
- Regulation (EU) 2016/679 (GDPR) · official text, EUR-Lex
- EDPB Guidelines 3/2019 · processing of personal data through video devices
- Italian Data Protection Authority · Video surveillance · topic page and FAQ, in Italian
- Italian Privacy Code · Legislative Decree 196/2003, as amended, in Italian