Garante per la protezione dei dati personali (Italy) - 382/2026
Italian DPA fines company €6,000 for excessive employee vehicle tracking.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined a company €6,000 for violating GDPR principles. The company was found to have excessively tracked employees' company vehicles at frequent intervals, processing more data than necessary and infringing on data minimization and purpose limitation principles. The DPA also cited violations of privacy by design and the lack of a DPIA.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA company was fined €6,000 by Italy's Garante for tracking employees' company vehicles at excessive frequency, collecting far more location data than was necessary for any legitimate business purpose. This violated GDPR's core principles of data minimization and purpose limitation, meaning data was gathered beyond what the stated purpose required. Compounding the violation, the company failed to conduct a Data Protection Impact Assessment (DPIA) before deploying the tracking system and did not embed privacy protections into the system's design. This case illustrates that even seemingly routine operational tools like fleet tracking can become serious compliance liabilities when privacy-by-design principles are ignored from the outset.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.