Cybersecurity Policy Report, Shopping Privacy Guidance Released in Italy, Latvia, (Aug 5, 2025)

By Tony Foley

Garante, Italy’s data protection authority, has sent a letter to an Italian business association providing guidance on the use of video surveillance in shopping venues, and Latvia’s data protection agency, the Data State Inspectorate (DVI), has outlined the minimum amount of information required to be provided by users to place an order in an e-shop.

Garante. In its Aug. 1 newsletter, Garante said it sent a letter to the president of Confcommercio-Imprese per l'Italia, the country’s largest business association, following numerous reports of inspections carried out by law enforcement and other authorities resulting in significant fines imposed on businesses using video surveillance systems that did not comply with privacy legislation.

Garante said the most frequent violations included the lack of information signs, the use of cameras aimed at public areas or other people’s property, unauthorized audio recordings, and retention of images beyond permitted time limits. The agency further noted more serious violations, including employee video monitoring that disregarded guarantees available under Italian labor law.

Garante cited Guidelines 3/2019 from the European Data Protection Board (EDPB) on the processing of data through video devices as a reference for the proper use of video surveillance systems. The agency said its aim was to ensure security within commercial establishments while fully respecting the privacy of citizens and workers and to avoid potential sanctions from Garante, particularly against local shops and small retail businesses.

Latvia. The DVI released guidance yesterday on information required to execute an online order, acknowledging that it was necessary to collect and process certain personal data, including the name and surname of the customer, e-mail address, phone number, and delivery address, but adding that merchants must be able to clearly indicate why each type of data is necessary.

For products and services individually adapted to a customer, additional information may be required, such as sizes for buyers of clothes.

All of this data may be used only for the initial purpose specified and may not be transferred to other persons without customer consent or another valid legal basis, DVI said. Businesses may in some cases justify using the data for related purposes like archiving, provided that it does not conflict with the original purpose for obtaining the data. Transfers of data are justified to transfer data when it is necessary to ensure delivery or to comply with accounting requirements, but in such cases, like transferring to a customer’s courier service to ensure delivery both parties will be considered processors subject to data protection requirements.

News: InternationalLegislation DataPrivacy DataSecurity