Video surveillance

 

Video surveillance at the airport. Privacy aspects for the protection of data subjects


Pursuant to current privacy regulations (European Regulation 2016/679 "GDPR" and Legislative Decree No.  196/03 and subsequent amendments and additions) the following notice is provided regarding the processing of personal data collected through video surveillance systems located at "Leonardo da Vinci" Fiumicino and "Giovan Battista Pastine" Ciampino Airports.

1.    DATA CONTROLLER 

Aeroporti di Roma S.p.A. with headquarters at Via Pier Paolo Racchetti, 1 - 00054 Fiumicino (Rome) (hereinafter also ADR) is the Autonomous Data Controller with regard to data processed through the video surveillance systems installed at Fiumicino and Ciampino airports. 

The video surveillance systems have been installed by ADR in accordance with current airport security regulations (such as, for example, EU Regulation 1998/2015 and subsequent amendments and additions, EU Regulation 300/2008 and subsequent amendments and additions, National Civil Aviation Security Program).

Some of these systems are installed upon request of State Agencies/Police Forces, for safety and public order protection purposes, as well as for the purpose of preventing terrorism and acts of unlawful interference to the detriment of air transportation. Regarding the use of these videosurveillance facilities, State Agencies/Police Forces act as autonomous data controllers of personal data under the applicable regulations.
 
As an airport operator, ADR also uses video surveillance systems for its own security, infrastructures safety, logistics and operations, process efficiency, aviation safety, protection and integrity of corporate assets purposes. The data collected through the latter facilities are processed by ADR as an autonomous Data Controller, but the processing modalities are limited to what is described below.
 
The video surveillance systems are spanned across multiple facilities located at different airport areas and consist of more than 5,000 cameras, designed to ensure the most complete security and the highest standards of supervision.
                                   
2.     DATA PROTECTION OFFICER 

ADR has appointed a Data Protection Officer ("DPO") who can be contacted at the following e-mail address: dpo@adr.it   

3.    TYPE OF DATA PROCESSED

The personal data processed (1) by ADR S.p.A. consists of images acquired through video surveillance systems that are viewed by operators in instant/live display mode and stored in the systems as described below.
Images may also refer to special categories of data under Art. 9 GDPR. 

4.    PURPOSE AND LEGAL BASIS OF PROCESSING

The video surveillance systems located at "Leonardo da Vinci" Fiumicino and "Giovan Battista Pastine" Ciampino Airports referred to in this notice - installed by ADR in accordance with the applicable regulations and autonomously accessible by the State Agencies/Police Forces – are used by ADR for the following purposes.
The data detected are processed through video surveillance systems on the perimeter and within the airport areas (including car parks) of Fiumicino and Ciampino’s airports by the Controller ADR for purposes of protection and integrity of corporate assets, airport safety and security, as well as process efficiency, logistical and operational related to applicable regulatory provisions.
The legal bases for processing are:

• Art. 6, p.1 letter f., GDPR - legitimate interest

The processing operations in question are necessary for the pursuit of a legitimate interest of ADR, justified by reason of the obligations to which this entity is bound as airport operator also in terms of infrastructure safety, process efficiency, logistical and operational, aviation safety and the protection and integrity of corporate assets. This also includes cameras located near aircraft parking aprons, check-in areas, operational/technical areas and car parks.
These operations also include those relating to the cameras placed - in line with the provisions of the regulations on facilities for public use - in the proximity of escalators, outdoor lifts and moving walkways subject to video surveillance also for the purpose of enabling the facility to be restarted (remote-restart in the event of a blockage of the facility) and which also allow ADR to retrieve the images in the event of an accident/adverse event for the purpose of analysing damaging events/accidents on facilities for public use and for the potential protection of its rights.

• Art. 6, p.1 letter c., GDPR legal obligation 

In relation to the security purpose, the applicable regulations establishes that ADR - as airport operator - must ensure that public areas and terminal areas reserved for passengers are equipped with electronic monitoring systems as an aid to security activities. 
All the aforementioned video-surveillance systems are connected to State Agencies/Police Forces that act as autonomous data controllers by virtue of the legislation applicable to them.
For further details, see the table at the end of this notice.
It should also be noted that, in order to fulfil a legal obligation pursuant to Art. 6, p.1 letter c., GDPR related to the applicable legislation on facilities for public use, there are additional (and different from those described above) video intercom systems inside lifts for public use that are activated on call in the event of an emergency, putting the user in contact with the technical facilities. Video intercom cameras only allow live connection of images and audio and are not subject to recording and/or archiving.
Within certain delimited airport areas, there are also cameras that - after anonymising the images collected - feed systems that provide anonymous and aggregated data and information on the number/density of people useful for monitoring and analysing queuing/waiting times and travel times. No systems or technologies are used to collect biometric data and/or perform facial recognition activities.

5.    PROCESSING METHOD

The data are processed in compliance with the regulations in force by means of camera facilities and IT systems, with logics strictly related to the stated purpose, so as to guarantee the quality, security and confidentiality of the data.

6.    DATA RECIPIENTS

The data collected through the video surveillance systems referred to in this notice are accessible - as described above - to State Agencies/Police Forces and processed only by authorised operators of ADR S.p.A. for the exclusive pursuit of the purposes and obligations of the latter as airport operator.
The following also access the live image display: 

  • authorised personnel of ADR Security S.r.l., an ADR Group company that provides ADR with airport security monitoring services at Fiumicino and Ciampino airports, specifically appointed as external Data Processor pursuant to Article 28, GDPR; 
  • authorised personnel of ADR Mobility S.r.l., an ADR Group company that manages the areas designated for parking vehicles and motorbikes, whose operators access in live mode to images collected by the cameras located at the parking areas of Fiumicino and Ciampino airports, for the purposes of asset protection and facility management.  ADR Mobility has been specifically appointed as external Data Processor pursuant to Article 28, GDPR. 
The table below shows the data recipients for each type/scope system/cameras facility. 

Within the scope of the processing activities carried out by ADR, only persons appointed and authorised to process data for this purpose will have access to the images. Under no circumstances will the images be disclosed.
Finally, specialised providers of technical, IT and maintenance services appointed as Data Processors, pursuant to Article 28 of the GDPR, may have access to the data. 
 
7.    RETENTION PERIOD

The cameras referred to in this notice are in operation 24 hours a day, 7 days a week.
The video surveillance systems referred to in this information notice retain images for a maximum of 7 days. In fact, the systems retain the images for 7 days for public safety/security reasons pursued in their capacity as autonomous data controllers by State Agencies/Police Forces and for exclusive and autonomous access by the latter only. Therefore, during such retention period of 7 days following the filming, without prejudice to what is described below, the images remain at the exclusive disposal of State Agencies/Police Forces. This is without prejudice to the possibility for State Agencies/Police Forces to autonomously pursue, in their capacity as data controllers, the need for further retention also for specific investigative requests or by order of the judicial authorities.
With regard to the above-described purposes pursued by ADR, it should be noted that:
 
  • ADR’s authorised operators can view camera images in live mode only;
  • authorised security officers may access the images for the above-mentioned security purposes only for the previous 24 hours;
  • in the event of an accident/adverse event, the authorised and responsible persons with reference to the cameras located near the facilities for public use may access the images within the limit of 72 hours for the analysis of the event and the preliminary investigation required by the reference legislation, as well as retain them in the event of proven objective reasons requiring an extension of the retention period in order to guarantee ADR the protection of a right with respect to possible claims for compensation and/or in court;
  • on the occasion of incidents or accidents occurring within the so-called airside, the authorised subjects assigned to the activities required in the field of aviation safety by the Airport Manuals may access the images of the airside area concerned for up to a maximum of 7 days (also in order to be able to reconstruct also events that were not promptly reported). The viewing of the images pursues the objective of continuous improvement of airport safety also for the purpose of investigation aimed at the exclusive identification of causes. To this end, authorised personnel collects all useful elements to carry out targeted analyses on the dynamics of the events giving prompt feedback to ENAC/EASA in compliance with Reg. (EU) no. 376/14, Reg. (EU) no. 139/14, ENAC Circular GEN01E. Furthermore, these functions carry out punctual analyses of events following the request for support from the Italian civil aviation safety investigation authority (ANSV, Agenzia nazionale per la sicurezza del volo) with reference to Reg. (EU) no. 996/2010. The investigators - according to Reg (EU) no. 376/14 - must guarantee the confidentiality obligations of sensitive information obtained from their analyses also towards the Competent Authorities (ENAC, EASA, ANSV).
The table below shows the retention periods for each type of facility/system, as well as the subjects accessing the images.

8.    DATA TRANSFER OUTSIDE THE EU

Personal data will not be disclosed and/or communicated to third parties located outside the European Economic Area.

9.    RIGHTS OF THE DATA SUBJECTS

Finally, we would like to inform you that the data subjects of the personal data processing activities referred to in this notice may exercise their rights under EU Reg. 2016/679 (GDPR): 
 
  • The right of access under Art. 15 exclusively where the prerequisites are met and in so far as the exercise of this right does not injures the rights and freedoms of other subjects (as indicated by the European Data Protection Board Guidelines of 29th January 2020 on the processing of personal data through video devices). This is without prejudice to the fact that in cases where the images are subject to exclusive availability by the State Agencies/Police Forces (see table below), ADR, as it is not entitled to access the images, is not in a position to comply with any potential request by the data subject.
  • The right to object under Art. 21. In the event that the right to object is exercised, the Data Controller reserves the right not to proceed with the request and, therefore, to continue the processing, in the event that there are compelling legitimate reasons to proceed with the processing that prevail over the interests, rights and freedom of the data subject.
The above rights may be exercised with a request sent without formalities to the Data Protection Officer (DPO) at dpo@adr.it. Further information on how to contact the Data Protection Officer is available at link. 
In the event that the Controller refuses to comply with your request, the reasons for the refusal will be provided. 
The right to lodge a complaint directly with the the Italian Data Protection Authority (Garante per la protezione dei dati personali) as provided for in Article 77 GDPR remains unaffected.


10.    AMENDMENTS AND UPDATES

The Data Controller reserves the right to amend/update this information. 

Last Update February 2024
 
 
Location Filming points Recorded Viewed Purposes and notes Retention periods
Cameras at Fiumicino and Ciampino airport grounds and perimeters Internal and external areas of Fiumicino and Ciampino airports Images are recorded and stored in the systems for exclusive access by Police Forces/State Agencies ADR
ADR Security
Police Forces/State Agencies in the performance of their duties		 Safety/ Security Images are available for live viewing only by State Agencies/Police Forces and security officers authorised by ADR/ADR Security with the possibility of viewing the images of the previous 24 hours and stored for the next 7 days for the exclusive access of Police Forces/State Agencies.
Cameras at Fiumicino and Ciampino airport grounds and perimeters Internal and external areas of Fiumicino and Ciampino airports The images are recorded and stored in the systems for exclusive access by Police Forces/State Agencies, without prejudice to the possibility of access to the videos, only for images related to the so-called airside, by ADR structures operating in the safety area (see retention periods). ADR
ADR Security
Police Forces/State Agencies in the performance of their duties		 Infrastructures safety, process efficiency, logistics and operative, aviation safety, protection and integrity of corporate assets. Authorised ADR/ADR Security operators can view camera images in live mode only, with the possibility of viewing images from the previous 24 hours.
The images are stored for the next 7 days for exclusive access by Police Forces/State Agencies.
In the event of incidents or accidents occurring in the airside area, authorised persons assigned to the activities required in the field of aviation safety by the Airport Manuals may access images of the affected area for up to 7 days for the purpose of event reconstruction and investigation.
 
Video intercom cameras
lifts		 Lifts for public use - ADR Security in accordance with current regulations. Audio-video connection with operator is only activated in the event of an emergency call. The system does not record audio or video.
Car parks cameras Car parks Images are recorded and stored in the systems for exclusive access by Police Forces/State Agencies . ADR
ADR Security
ADR Mobility
Police Forces/State Agencies in the performance of their duties		 Safety, airport Security, corporate asset protection and facility management Authorised ADR/ADR Mobility operators can view camera images in live mode only.
Images are stored for the next 7 days for exclusive access by Police Forces/State Agencies.
Escalator and moving walkways cameras On escalators and moving walkways The images are recorded and stored in the systems for exclusive access by Police Forces/State Agencies, without prejudice to the possibility of the Technicians/Managers for the operations of the facilities concerned to have access to the images to reconstruct any incidents/adverse events (see retention periods). ADR
ADR Security
Police Forces/State Agencies in the performance of their duties		 Security, safety, protection and integrity of assets, operational facility management, process efficiency, logistics and operative, protection against potential claims/litigations Images are available for live viewing only by ADR with the possibility of viewing images from the previous 24 hours.
The images are stored for the next 7 days for exclusive access by Police Forces/State Agencies.
The system allows the retrieval of images to ADR in the event of an accident/adverse event. In the event of an accident/event, the authorised and responsible persons with reference to the cameras located near the facilities for public use may access the images within the limits of 72 hours for the analysis of the event and the preliminary investigation required by the relevant regulations, as well as retain them in the event of proven objective reasons requiring an extension of the retention period to ensure the protection of a right, including in court.
 
 
 (1) Personal data are understood under the GDPR as: "any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person" (the "Data").
The GDPR defines special categories of personal data as those capable of revealing “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, [...] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.”