Excerpts From The Italian Dpa's Decision Regarding Google Streetview 
[doc. web n. 1759984]
Excerpts From The Italian Dpa’s Decision Regarding Google Streetview
Information Obligations Applying To Google Inc.
On 15 October 2010, the Italian DPA adopted a decision regarding Google Inc.´s obligation to provide suitable information to citizens in connection with its StreetView service.
The DPA has been receiving several complaints from individuals that do not wish to be displayed on the images posted online by Google Inc.
The DPA also received information from Google Inc. following specific requests it had made to clarify the relevant processing arrangements.
The rationale underlying the DPA´s decision was the following:
As stated by Google Inc., the images are captured by special cameras on cars and automatically sent to a server held by Google Inc. in the USA, where they are processed and posted on the relevant website; in some cases, the images also contain personal data such as pictures of individuals or car plates;
The processing falls within the scope of application of the Italian Data Protection Code, as it is performed by means of equipment located in Italy (see section 5 of legislative decree no. 196/2003, i.e. the "DP Code");
Under Italian law, there is no need for the data subjects´ consent regarding image acquisition, since the images in question are captured in public places – subject to the limitations set forth in the law such as the ban on disseminating pictures if this may be detrimental to a person´s honour, dignity and/or reputation (section 97(2) of Act no. 633/1941) or on disseminating data suitable for disclosing a person´s health (section 26(5) of the DP Code);
However, the processing of personal data by Google Inc. for the purposes of StreetView must be compliant with fairness, lawfulness, proportionality and necessity principles, in any case;
Data subjects have the right to object to the processing of their data even if they can be identified only indirectly, also following the "blanking" or "blurring" performed by Google Inc. on captured images;
Data subjects have also the right to be adequately informed on the processing (section 13 of the DP Code) since they must be in a position to decide whether to subject themselves to the "capturing" of their images;
The current arrangements for informing data subjects are insufficient (list of the cities/towns where Google cars are expected to be around, posted a few hours beforehand plus a short general information notice on Google´s website);
However, providing information to every single data subject whose image is captured by the cameras would entail a disproportionate effort;
Based on the above premises, the Italian DPA required Google Inc. to take the following steps and set a 30-day deadline for compliance as from the date of service:
- Google Inc. in its capacity as controller of the processing will have to appoint a representative established in Italy with a view to application of the Italian legislation on processing of personal data (under section 5 of Italy´s DP Code);
- Google Inc. will have to inform data subjects in an appropriately detailed way on the routes followed by its StreetView cars, taking account of the size and features of the cities/locations visited – in particular, by publishing the relevant information on its website three days in advance of the date when image acquisition is expected to start;
- Google Inc. will have to inform data subjects appropriately also by having ads published in the local news section of at least two newspapers and broadcast by a local radio; the ads will have to provide information on the places (cities, towns, etc.) that will be visited by StreetView cars in each Region;
- Google Inc. will have to equip its StreetView cars with notices or stickers that should be clearly visible and unambiguously clarify that pictures are being taken to be subsequently posted online via the StreetView service.