The Italian data protection authority (‘Garante’) announced, on 26 January 2018, that it had issued a decision on digital signage (also known as totems) installed in a train station and operated by Grandi Stazioni Retail s.p.a. The Garante found that the totems determine the presence of a human face, measure the time spent in front of the advertisement, record characteristics such as gender, age and distance from the totem, and analyse facial expressions. The data was collected, encrypted and processed for statistical analysis purposes. The Garante concluded that adequate measures were in place to ensure compliance with Article 3, concerning data minimisation, and Article 11, regarding processing arrangements, of the Personal Data Protection Code, Legislative Decree No. 196/2003 (‘the Privacy Code’).