Garante per la protezione dei dati personali (Italy) - 382/2026
Italian DPA fines company for systematic employee vehicle tracking without consent or deactivation.
Italy's Data Protection Authority (Garante) issued decision 382/2026 against a controller for systematic and continuous monitoring of employees' company vehicles at frequent intervals (every 15 minutes) without allowing deactivation. The DPA found violations of Articles 5(1)(a), (b), (c), 6, 13, 25, 35, and 88 of GDPR, determining the tracking was excessive, lacked proper legal basis, violated purpose limitation, and failed privacy-by-design and DPIA requirements. The DPA rejected the employer's justification based on hazardous materials transport safety and ruled that collective bargaining agreements alone do not satisfy GDPR compliance.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Italian employer systematically tracked company vehicles every 15 minutes without providing employees any means to deactivate the system, violating multiple GDPR principles including data minimisation, purpose limitation, and lawfulness. The Garante found that safety justifications related to hazardous materials transport were insufficient to legitimise such pervasive, continuous surveillance, and that collective bargaining agreements alone do not constitute a valid GDPR legal basis. No Data Protection Impact Assessment (DPIA) was conducted, and privacy-by-design principles were ignored entirely during system deployment. This case highlights that even operationally justified monitoring programmes must be proportionate, transparently communicated to employees, and supported by robust legal and technical safeguards from the outset.