Background information
- Date of final decision: 10/07/2025
- National case
- Controller: la Combricola Dei Birichini Di Betty
- Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 7 (Conditions for consent), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 35 (Data protection impact assessment), Article 37 (Designation of the data protection officer), Article 38 (Position of the data protection officer)
- Decision: Administrative fine
- Key words: Administrative fine, Consent, Data protection officer, Education, Transparency, Lawfulness of processing or children
Summary of the Decision
Origin of the case
The proceeding followed a complaint from a parent who, in order to enrol his daughter in a nursery school, had to give consent for the collection and use of images of the child. The parent also reported the presence of a video surveillance system inside the nursery, which was also in operation during school and educational activities.
Key Findings
During the investigation, it emerged that the nursery had published numerous images of children at various times during a “typical day” on both its website and its Google Maps profile, including in particularly sensitive contexts (sleeping, eating, using the toilet, nappy changing, infant massage). These were situations and activities that were particularly sensitive or intended to remain private. This is without considering the risks associated with the increased exposure of the images on the web and their possible reuse by malicious individuals for illegal purposes or crimes against children.
The Garante stated that the processing carried out by the nursery could not be legally based on parental consent, as the best interests of the children prevailed in not having photographs of them in particularly intimate moments of their school and educational experience published online to promote the nursery's activities. Moreover, such consent could not be considered informed and freely given, since, in the event of refusal, the possibility of enrolling the children in the nursery would have been precluded.
The video surveillance system, which collected images of minors, educational staff, as well as parents, suppliers and visitors, had also been used without complying with the European and Italian privacy legislation.
Decision
Taking into account that the kindergarten has cooperated with the Authority, the Garante imposed an administrative fine of 10 000 EUR, in light of infringements of articles 5(1), 6, 7, 12(1), 13, 35, 37(7) and 38(6) of the GDPR e 2-term of the National Personal Data Protection Code.
The Italian SA also imposed a definitive ban on processing and ordered the nursery school to erasure the personal data.
For further information:
- National press release: Minori: il Garante privacy sanziona un asilo nido Telecamere installate senza garanzie e foto di bambini piccolissimi online
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.