[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKQKzpP5yGbzrLeAjsySOMYGz-1psWBABrnHOaFykjzk":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":79},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b25b1e04-07d6-49f6-b2b4-e5bb19120332","Garante per la protezione dei dati personali (Italy) - 342\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-342-2026-91762e","← Older revision Revision as of 11:41, 2 June 2026 Line 7: Line 7: |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=342\u002F2026 |Case_Number_Name=Case number: 342\u002F2026 Internal number: 10255494 |ECLI= |ECLI= Line 85: Line 86: === Holding === === Holding === The DPA first clarified that the company providing the system acted as a controller in relation to the data subjects, and not the employers who purchased the system. According to the DPA, employers are technically prohibited from accessing the data processed by the controller to provide the service, and would in any case lack the valid legal basis to do so under the GDPR. The DPA compared this to employers entering into a contract for the provision of benefits and services to employees (such as health insurance or access to psychological counselling services). While employers can receive reports of the data subjects’ stress levels, the DPA concluded that the employer in question did not have sufficient information to identify the data subjects involved. The DPA first clarified that the company providing the system acted as a controller in relation to the data subjects, and not the employers who purchased the system. According to the DPA, employers are technically prohibited from accessing the data processed by the controller to provide the service, and would in any case lack the valid legal basis to do so under the GDPR. While employers can receive reports of the data subjects’ stress levels, the DPA concluded that the employer in question did not have sufficient information to identify the data subjects involved. The DPA compared this to employers entering into a contract for the provision of benefits and services to employees (such as health insurance or access to psychological counselling services). The DPA also emphasised that the controller has the obligation to comply with the GDPR from the design phase (Article 25 GDPR). In addition, the controller must comply with national provisions that prohibit employers from collecting data that is irrelevant to work activities (Article 113 of the Code). If this provision is not complied with, the processing is not lawful under [[Article 88 GDPR#2|Article 88(2) GDPR]]. The DPA also emphasised that the controller has the obligation to comply with the GDPR from the design phase ([[Article 25 GDPR]]). In addition, the controller must comply with national provisions that prohibit employers from collecting data that is irrelevant to work activities ([https:\u002F\u002Fwww.garanteprivacy.it\u002Fdocuments\u002F10160\u002F0\u002FCodice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 113 of the Code]). If this provision is not complied with, the processing is not lawful under [[Article 88 GDPR#2|Article 88(2) GDPR]]. The DPA also noted that the controller must also comply with Article 5(1)(f) of the AI Act, which expressly prohibits the use of AI systems to infer the emotions of a data subject in the workplace. The DPA highlighted that AI systems can generate further inferences in relation to the data originally processed that may not be understandable or verifiable. Therefore, aspects such as model reliability, quality of the data, transparency and explainability are essential conditions to prevent processing activities that are invasive and non-compliant with the GDPR. It is also essential that companies take a prudent approach when adopting AI systems. The DPA also noted that the controller must also comply with [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj\u002Feng Article 5(1)(f) of the AI Act], which expressly prohibits the use of AI systems to infer the emotions of a data subject in the workplace. The DPA highlighted that AI systems can generate further inferences in relation to the data originally processed that may not be understandable or verifiable. Therefore, aspects such as model reliability, quality of the data, transparency and explainability are essential conditions to prevent processing activities that are invasive and non-compliant with the GDPR. It is also essential that companies take a prudent approach when adopting AI systems. The DPA did not find a violation of the GDPR, as the controller did not transfer the data to employers, and the company that received the report was unable to identify specific data subjects. However, the DPA issued a warning, as it could not rule out that the processing activities were likely to infringe the GDPR in the future. The DPA was concerned of the possibility that companies and entities could, in the future, identify data subjects from the reports provided by the controller. This would result in a violation of Articles 5, 6, 9, 24, 25 and 88 GDPR, and Article 113 of the Code. Therefore, the DPA ordered the controller to implement measures to prevent it from disclosing data from data subjects to their employers in any way, even indirectly. The DPA did not find a violation of the GDPR, as the controller did not transfer the data to employers, and the company that received the report was unable to identify specific data subjects. However, the DPA issued a warning, as it could not rule out that the processing activities were likely to infringe the GDPR in the future. The DPA was concerned of the possibility that companies and entities could, in the future, identify data subjects from the reports provided by the controller. This would result in a violation of [[Article 5 GDPR|Articles 5]], [[Article 6 GDPR|6]], [[Article 9 GDPR|9]], [[Article 24 GDPR|24]], [[Article 25 GDPR|25]] and [[Article 88 GDPR|88 GDPR]], and [https:\u002F\u002Fwww.garanteprivacy.it\u002Fdocuments\u002F10160\u002F0\u002FCodice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 113 of the Code]. Therefore, the DPA ordered the controller to implement measures to prevent it from disclosing data from data subjects to their employers in any way, even indirectly. == Comment == == Comment ==","Italy's data protection authority (Garante) issued a warning in case 342\u002F2026 regarding an AI system that infers employee stress levels in the workplace. While the DPA found no current GDPR violation because data was not transferred to employers and subjects could not be identified from reports, it ordered the controller to implement safeguards against future disclosure of personal data. The decision emphasizes that AI systems inferring emotions in the workplace violate the EU AI Act Article 5(1)(f) and require compliance with GDPR design principles and transparency requirements.","Italy's DPA warns AI emotion-inference system used for workplace stress monitoring risks GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_342\u002F2026&diff=51789&oldid=51787","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-06-02T11:41:22+00:00","2026-06-02T12:00:19.278571+00:00",7,[17,20,23],{"name":18,"type":19},"Garante per la protezione dei dati personali (Italy)","vendor",{"name":21,"type":22},"AI emotion-inference systems","technology",{"name":24,"type":22},"EU AI Act","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":25,"icon":27,"name":28,"slug":29},null,"GDPR","gdpr",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":27,"name":24,"slug":44},"f22671ea-092b-4568-aede-526bb16dedd5","eu-ai-act",[],[18],{"controls":48,"vendors":78},[49],{"slug":50,"name":51,"problem":52,"products":53},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",[],{"slug":80,"title":81,"body":82,"framework_refs":83,"framework_notes":89},"ai-workplace-monitoring-systems-face-gdpr-and-ai-act-compliance-requirements","AI Workplace Monitoring Systems Face GDPR and AI Act Compliance Requirements","An AI system designed to infer employee stress levels in the workplace was found to violate the EU AI Act's prohibition on emotion recognition systems, despite currently complying with GDPR due to anonymized reporting. The Italian data protection authority emphasized that such systems must implement robust safeguards to prevent future disclosure of personal data and comply with GDPR's privacy-by-design principles. This case highlights the evolving regulatory landscape where AI systems face dual compliance requirements under both data protection and AI-specific legislation. Organizations deploying workplace AI must ensure transparency, implement technical safeguards, and continuously assess compliance with multiple regulatory frameworks.",[84,85,86,87,88],"GDPR Article 25 (Data protection by design)","GDPR Article 35 (Data Protection Impact Assessment)","EU AI Act Article 5","ISO 27001 A.18.1.4","NIST AI RMF",{}]