Video surveillance is one of the most effective security tools in campsites: a deterrent against theft, evidence in the event of damage, and a tool for optimizing access flows. The GDPR imposes specific obligations: violations may result in corrective measures and administrative fines. The maximum amounts provided for by the regulation are very high, but the actual amount depends on the seriousness, duration, number of data subjects, measures adopted, and the controller's conduct.
GDPR obligations for video surveillance
- Signage: a concise first-layer notice must be placed before entering the monitored area, including at least the camera symbol, the identity of the controller, the purpose of the processing, and a reference to the complete privacy notice, which must be easily accessible (via QR code or web page).
- Limited retention: images must be retained only for the time strictly necessary for the intended purpose. In general, the Garante Privacy considers very short retention periods appropriate (often 24–72 hours), unless specific documented needs apply. Longer periods must be adequately justified based on the risks, the characteristics of the facility, or particular security requirements; in some justified cases, periods of 7 days or more may also be permitted.
- Restricted access: access to images must be limited to authorized personnel through individual credentials and adequate security measures. Logging access is strongly recommended, especially in more complex systems.
- Limitation of the monitored area: cameras must be positioned to record only the areas that actually need protection, avoiding public spaces, neighboring properties, or areas unrelated to the stated purpose as far as possible.
- Areas to exclude: areas where guests or workers have a reasonable expectation of particular privacy must not be recorded, such as bathrooms, showers, changing rooms, and the interiors of accommodations.
- Privacy notice: it must be easily accessible, for example on the website, at reception, or via the QR code indicated on the signs. It may be referenced in the terms of stay or booking documentation.
- Recording workers: if cameras may record employees or contractors during work activities — even indirectly, by enabling monitoring of their performance — the safeguards provided for by art. 4 of the Statuto dei lavoratori apply. Before installation, a trade union agreement or authorization from the labor inspectorate may be required.
Examples of IP cameras suitable for campsites
| Use | Model example | Key features |
|---|---|---|
| Entrance/exit | HikVision DS-2CD2T47G2-L | 4MP, IR 60m, optional ANPR |
| Internal roads | Dahua IPC-HFW2849S-S-IL | 8MP, dual-light, IP67 |
| Pool/open area | Axis P3245-V | 1080p, WDR, vandalproof |
| Bar/reception cash desk | Reolink RLC-810A | 4K, PoE, person detection |
⚠ Before installation, it is advisable to consult a qualified privacy adviser. Appointing a Data Protection Officer (DPO) is mandatory only in the cases provided for by art. 37 of the GDPR and does not depend simply on the use of a video surveillance system. The Garante Privacy has adopted measures and imposed sanctions against accommodation facilities that used video surveillance systems that did not comply with the regulations.
Where processing may present a high risk to the rights and freedoms of individuals, the controller must assess whether a data protection impact assessment (DPIA) is necessary, pursuant to art. 35 of the GDPR. It is not mandatory in every case, but its necessity must be assessed on a case-by-case basis.