video surveillance

Privacy Notice pursuant to Article 13 of Regulation (EU) 2016/679 (‘GDPR’) relating to the video surveillance system of ATAC S.p.A. - Azienda per la Mobilità

ATAC S.p.A. - Azienda per la Mobilità, in its capacity as Data Controller, hereby informs you that it has installed and operates a video surveillance system (hereinafter, the “System”) at the metro stations of lines A, B/B1 and C, tunnels, ticket offices, termini, stops/shelters, car parks, depots/garages/warehouses/workshops, administrative offices, as well as on board buses and trains (hereinafter, the “Video-Surveillance Areas”).

Through the System, ATAC may process personal data relating to you, consisting of images and video recordings, including recordings where the device is equipped with recording functionality, as well as any additional elements visible or associated with the recordings, such as images of vehicles, registration plates where visible and legible, date, time and location of the recording (hereinafter, the “Data”).

1. Data Controller and Data Protection Officer (“DPO”)

The Data Controller is ATAC S.p.A. - Azienda per la Mobilità, with registered office at Via Prenestina, 45 - 00176 Rome, Tax Code and VAT No. 06341981006 (hereinafter, “ATAC”, the “Company” or the “Controller”), which may be contacted by registered letter with acknowledgement of receipt sent to the above-mentioned registered office or via the following certified e-mail address (PEC): protocollo@cert2.atac.roma.it.

ATAC has appointed a Data Protection Officer (“DPO”), who may be contacted at the following e-mail address: responsabileprotezionedati@atac.roma.it.

2. Purposes of processing and legal bases

Your Data will be processed for one or more of the following purposes, on the basis of the corresponding legal grounds indicated below:

a) Safety, regularity and continuity of the local public transport service and operational management of infrastructures, systems and vehicles

Your Data will be processed by ATAC, to the extent necessary, in order to monitor and manage events that may materially affect the safety, regularity and continuity of the local public transport service, the operational management of infrastructures, systems and vehicles, as well as the protection of people’s safety in the relevant areas.

This purpose includes, by way of example only, the detection and management of service disruptions, critical passenger flows, overcrowding situations, evacuation requirements, malfunctions or unavailability of systems, accidents, falls, emergencies and other events requiring intervention to ensure the correct and safe operation of the local public transport service.

Legal basis: processing is necessary for the performance of a task carried out in the public interest relating to the safety, regularity, continuity and operational management of the local public transport service entrusted to ATAC, pursuant to Article 6(1)(e) of the GDPR and Article 2-ter(1) and (1-bis) of Legislative Decree No. 196/2003, as subsequently amended (“Italian Privacy Code”).

In particular, pursuant to Article 2-ter(1) of the Italian Privacy Code, such public interest task is based on the applicable European, national, regional and local legislation governing local public services and local public transport, including Regulation (EC) No. 1370/2007, Legislative Decree No. 201/2022, Legislative Decree No. 422/1997, Lazio Regional Law No. 30/1998 and Presidential Decree No. 753/1980, as well as on the administrative acts governing the entrustment of the service to ATAC, including Resolution No. 159/2023 of the Capitoline Assembly, Resolution No. 136/2024 of the Capitoline Assembly, Resolution No. 29/2025 of the Capitoline Executive and the Roma Capitale-ATAC Service Contract.

Pursuant to Article 2-ter(1-bis) of the Italian Privacy Code, processing is also based on ATAC’s status as operator of a local public service, insofar as such processing is necessary for the performance of tasks carried out in the public interest relating to the provision, safety, continuity and operational management of the service.

No specific provision of Data is required, as ATAC collects the Data automatically through the System.

b) Protection of company assets and prevention, detection and documentation of unlawful or harmful conduct

Your Data will be processed by ATAC for the purposes of protecting company assets, vehicles, systems, infrastructures and other company property, as well as for preventing, detecting, documenting and reconstructing unlawful or harmful conduct, damage, theft, vandalism, unauthorised access, assaults or other events likely to cause harm to individuals or property.

By way of example, images may be used, to the extent necessary, in the event of damage, theft, vandalism, unauthorised access, assaults, physical altercations, tampering, unauthorised occupation of areas or vehicles, or other events that may adversely affect company assets, the safety of individuals or the security of property.

Legal basis: legitimate interest of the Company pursuant to Article 6(1)(f) of the GDPR in protecting its assets, vehicles, systems, infrastructures and other company property, as well as in preventing, detecting and documenting unlawful or harmful conduct.

No new or specific provision of Data is required, as the Data are collected automatically through the System.

c) Compliance with obligations established by law, regulations or European legislation, and with provisions/requests from legally authorised authorities and/or supervisory and control bodies

Your Data will be processed in order to comply with legal or regulatory obligations to which the Company is subject and, where necessary, will be disclosed in order to comply with requests, orders or measures issued by judicial authorities, Judicial Police, Law Enforcement Authorities and other competent authorities, in the cases and within the limits provided for by applicable legislation.

Requests for the acquisition of images may be submitted directly to ATAC or, where applicable, through the “Sala Sistema Roma” of Roma Capitale, acting as a coordination and liaison structure for requests submitted by the competent authorities, as provided for by the Ordinance of the Mayor of Rome No. 63 of 28 February 2011.

Legal basis: compliance with a legal obligation to which the Company is subject pursuant to Article 6(1)(c) of the GDPR.

Where the processed images include data relating to criminal offences, criminal convictions or security measures, processing shall take place within the limits provided for by Article 10 of the GDPR and Article 2-octies of the Italian Privacy Code.

No new or specific provision of Data is required, as the Data are collected automatically through the System.

d) Extraordinary events and making images available to competent public bodies for public safety, public order, civil protection or emergency management purposes

In the event of major events, public gatherings, emergencies, extraordinary events or other situations characterised by significant numbers of people or by specific requirements relating to public safety, public order, civil protection, emergency management, traffic, mobility or operational coordination, your Data will be processed by ATAC, to the extent necessary, by making images recorded by the System available to, providing temporary viewing access to and/or transmitting such images to competent public bodies, authorities or public organisations.

Such processing is carried out by ATAC in order to allow the above-mentioned entities to perform their respective institutional functions relating to public safety, public order, civil protection, emergency management, traffic, mobility or event management, as well as to ensure, within ATAC’s area of responsibility, the safety, regularity and continuity of the local public transport service.

The recipients will process the Data for their own institutional purposes and, where applicable, as independent Data Controllers.

Legal basis: processing is necessary for the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the GDPR and Article 2-ter(1), (1-bis) and (2) of the Italian Privacy Code.

Pursuant to Article 2-ter(1) of the Italian Privacy Code, the public interest task connected with the coordinated management of the specific situation is based on acts, plans, protocols, ordinances or administrative provisions adopted by the competent bodies and authorities in matters of public safety, public order, civil protection, emergency management, traffic, mobility or operational coordination of the event.

Pursuant to Article 2-ter(1-bis) of the Italian Privacy Code, processing is also based on ATAC’s status as operator of a local public service, insofar as making images available is necessary, within its area of responsibility, for the performance of tasks carried out in the public interest relating to the safety, regularity, continuity and operational management of the local public transport service.

The disclosure, making available or consultation of images by other public Data Controllers takes place within the limits of Article 2-ter(2) of the Italian Privacy Code and of the provisions applicable to the specific situation.

No new or specific provision of Data is required, as the Data are collected automatically through the System.

e) Establishment, exercise or defence of rights in judicial, administrative or out-of-court proceedings and in connection with disputes

Your Data may be processed by ATAC for purposes connected with the establishment, exercise or defence of its own rights or those of third parties before the competent judicial, administrative or out-of-court authorities, including in relation to the reconstruction of events, incidents, damage, assaults, claims, complaints or disputes.

Legal basis: legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR for the protection of its own rights or those of third parties.

Where the images used for these purposes contain data relating to criminal offences or criminally relevant unlawful conduct, the relevant processing shall take place within the limits provided for by Article 10 of the GDPR and Article 2-octies of the Italian Privacy Code, in particular for the establishment, exercise or defence of a right in judicial proceedings.

No new or specific provision of Data is required, as the Data are collected automatically through the System.

3. Processing methods

With regard to the purposes indicated in paragraph 2 above, ATAC has configured the System and established the related operating procedures according to the principles of necessity, proportionality and data minimisation, taking into account the characteristics of the Video-Surveillance Areas, the position and field of view of the devices, their respective functionalities and the authorisation profiles assigned to authorised personnel.

ATAC processes the Data primarily by means of IT and electronic tools, according to procedures strictly related to the purposes indicated in this Privacy Notice and in compliance with the principles of lawfulness, fairness, transparency, data minimisation, integrity and confidentiality provided for by the GDPR.

Appropriate technical and organisational measures are adopted to protect the Data against unauthorised access, loss, destruction, alteration, unauthorised disclosure or use inconsistent with the purposes of the processing.

The video surveillance system may allow, where applicable and within the limits of the competences assigned to authorised personnel, the real-time viewing of video streams for purposes connected with operational safety, service management, the security of systems and facilities, and the management of any abnormal situations or emergencies.

For devices equipped with recording functionality, recording takes place continuously over a 24-hour period. Images are recorded on DVR/NVR systems or on local storage media.

Recorded images may only be accessed by persons specifically authorised by the Controller pursuant to Article 29 of the GDPR and/or, where necessary, by duly appointed Data Processors pursuant to Article 28 of the GDPR, or by other parties entitled to access them in the cases indicated in this Privacy Notice.

Operations involving access to, viewing, searching, playback, extraction, export, copying, decryption or transmission of images are permitted exclusively to authorised persons and only where necessary in relation to the purposes indicated in this Privacy Notice.

Such operations are recorded through logs and security controls in order to ensure access control, security, accountability and the traceability and verification of the operations performed.

The extraction, isolation or copying of specific images before their automatic overwriting is permitted exclusively where necessary to comply with requests, orders or measures issued by competent authorities, to manage extraordinary events or public coordination situations in the cases indicated in this Privacy Notice, to handle claims, complaints or disputes, or to establish, exercise or defend rights before the competent authorities.

Extracted or isolated images are limited to those strictly relevant to the specific need and are stored using methods suitable to ensure their integrity, confidentiality, traceability and access exclusively by authorised persons.

The use of the System is justified by the characteristics of the local public transport service, the size and complexity of the infrastructures, systems and vehicles involved, as well as by the large number of users, employees and third parties accessing or passing through the Video-Surveillance Areas.

The System constitutes a supporting tool for the organisational, operational and security measures already adopted by ATAC, including monitoring activities, security and surveillance operations, access controls and procedures for restricted areas, alarm and reporting systems, and operational procedures for emergency management.

An automatic image overwriting mechanism is in place once the maximum retention period provided for has expired, except where specific images need to be retained in order to comply with requests from competent authorities or to establish, exercise or defend a right before the competent authorities.

The use of systems that may also result in the possibility of remote monitoring of employees is carried out in compliance with Article 4 of Law No. 300/1970 and with applicable trade union agreements or authorisation measures.

Processing carried out through the System does not involve automated decision-making processes producing legal effects or similarly significantly affecting Data Subjects pursuant to Article 22 of the GDPR, nor does it involve the use of facial recognition systems or automated image or behavioural analysis functionalities.

4. Image retention period

The images collected through the System are retained for no longer than the period necessary to achieve the purposes for which they are processed and, in any event, for a maximum period of 7 days, through automatic overwriting mechanisms.

This period has been established by the Controller, in accordance with the accountability principle set out in Article 5(2) of the GDPR, taking into account the size and complexity of the network, the infrastructures and vehicles involved, the specific technical and operational requirements of the local public transport service, as well as the time required to detect events and respond to requests.

Such period remains within the maximum limit of one week considered acceptable by the General Provision of the Italian Data Protection Authority (Garante per la protezione dei dati personali) of 8 April 2010 on video surveillance (Section 3.4) in the presence of specific technical requirements, such as those relating to transport vehicles.

The possibility remains to extract, isolate or copy specific images before their automatic overwriting, exclusively where this is necessary in relation to the purposes indicated in this Privacy Notice.

In such cases, the retention of extracted or isolated images is limited solely to the images relevant to the specific need and is carried out according to the following criteria:

a) Requests, orders or measures issued by the Judicial Authority, Judicial Police, Law Enforcement Authorities or other competent authorities

In the event of requests, orders or measures issued by the Judicial Authority, Judicial Police, Law Enforcement Authorities or other competent authorities, images are retained for the period indicated by the relevant authority or, where no period is specified, for the time strictly necessary to process the request and document the activities carried out by ATAC, unless further retention is required by the authority or is necessary for the establishment, exercise or defence of rights.

b) Extraordinary events, major events, public gatherings, emergencies or other public coordination situations

In the event of extraordinary events, major events, public gatherings, emergencies or other public coordination situations, any extracted, isolated or made available images are retained for the period strictly necessary for managing the specific requirement and completing the related operational and documentary activities, unless they become part of requests, orders or measures issued by competent authorities, claims, complaints, disputes or proceedings.

c) Claims, complaints, disputes, damage, assaults or other events likely to give rise to liability or claims against ATAC or third parties

In the event of claims, complaints, disputes, damage, assaults or other events likely to give rise to liability or claims against ATAC or third parties, images are retained for the period necessary to manage the relevant case and, where necessary, for the limitation or forfeiture period applicable to the rights or legal actions that ATAC must establish, exercise or defend.

d) Judicial, administrative or out-of-court proceedings

In the event of judicial, administrative or out-of-court proceedings, images are retained for the entire duration of the proceedings and, subsequently, for the period necessary to protect ATAC’s rights or relevant legal positions, within the limits of the applicable limitation, forfeiture, appeal or enforcement periods.

Once the applicable retention period has expired, extracted or isolated images are deleted, anonymised or otherwise rendered no longer identifiable, unless further retention is required or permitted by law, by measures issued by competent authorities or by specific requirements relating to the establishment, exercise or defence of rights.

5. Disclosure of Data

Your Data may be made accessible or disclosed, within the limits strictly necessary and in relation to the processing purposes referred to in paragraph 2 above, to the following categories of recipients:

• ATAC personnel previously authorised to process Data pursuant to Article 29 of the GDPR, within the limits of their respective competences and duties, including system administrators and technical personnel responsible for managing and ensuring the security of the equipment and infrastructures;
• companies entrusted with security services and the operational management of security control rooms, as well as suppliers providing technical or support services connected with the management, maintenance, assistance and security of video surveillance systems and/or ICT infrastructures, where necessary appointed as Data Processors pursuant to Article 28 of the GDPR;
• Judicial Authorities, Judicial Police, Law Enforcement Authorities and other competent authorities, including through the “Sala Sistema Roma”, in the cases provided for by law and within the limits of the requests, orders or measures received;
• public bodies, authorities or competent public organisations, including entities responsible, pursuant to applicable legislation and provisions, for functions relating to public safety, public order, civil protection, emergency management, traffic, mobility or the operational coordination of extraordinary events or situations characterised by significant numbers of people or specific public requirements;
• insurance companies, law firms, consultants and other third parties acting, depending on the circumstances, as independent Data Controllers or Data Processors, where disclosure is necessary for the management of claims, complaints, disputes, proceedings or for the establishment, exercise or defence of rights before the competent authorities.

The Data will not be disseminated.

6. Transfer of Data abroad

The Data are processed exclusively within countries belonging to the European Union (EU) or the European Economic Area (EEA).

7. Your data protection rights

You may exercise, at any time, the rights provided for under Articles 15 to 22 of the GDPR by contacting the Controller or the Data Protection Officer (DPO) in order to request:

• a) access to your Data, as provided for by Article 15 of the GDPR;
• b) the erasure of your Data where ATAC no longer has any legal basis for processing them, as provided for by Article 17 of the GDPR;
• c) the restriction of the processing of your Data where one of the circumstances provided for by Article 18 of the GDPR applies.

Right to object: in addition to the rights listed above, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your Data carried out by ATAC for the pursuit of its legitimate interest or a public interest, pursuant to Article 21 of the GDPR.

The right to rectification and completion of your Data held by ATAC pursuant to Article 16 of the GDPR may, in practice, not be applicable due to the intrinsic nature of the Data subject to processing (i.e. images collected in real time).

However, this right may still be exercised to the extent that the processing includes inaccurate personal data that can be rectified, including, where relevant, metadata or information associated with the recordings.

The right to withdraw consent pursuant to Article 7 of the GDPR does not apply, as processing is not based on consent, but on the legal bases indicated in paragraph 2 above, namely the performance of a task carried out in the public interest, the legitimate interest of the Controller and compliance with a legal obligation to which the Controller is subject.

You may exercise your rights without any specific formalities by contacting the Data Controller or the Data Protection Officer (DPO), by writing to the postal address of the registered office or by sending a request to the following certified e-mail address (PEC): richeste.immagini@cert2.atac.roma.it.

For your convenience only, a downloadable form is also available on the ATAC website https://www.atac.roma.it/ under the sections “Privacy information” , “Privacy notice”, Documents at the bottom of the page – “Form to contact the data controller or data processors”.

If you believe that the processing of your Data is carried out in breach of the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), using the contact details available on the website www.garanteprivacy.it, or to bring proceedings before the competent courts.