Garante per la protezione dei dati personali (Italy) - 462/2026
Italian DPA fines company €6,600 for unlawfully processing former employee's personal data.
The Italian DPA has fined Cosmint S.p.A. €6,600 for unlawfully processing a former employee's personal data. The company opened and emptied the employee's locker in his absence, destroying its contents, and recorded the process with a smartphone. The DPA ruled that the locker's contents constituted personal data and the actions taken were unlawful processing operations under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cosmint S.p.A.?
Get an email when a new story names Cosmint S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCosmint S.p.A. violated GDPR by opening and emptying a former employee's locker without lawful basis, destroying its contents, and recording the process on a smartphone — all of which constituted unlawful personal data processing. The root cause was a failure to understand that physical items belonging to an individual can constitute personal data, and that any interaction with them must comply with data protection principles. This case highlights that GDPR obligations extend well beyond digital systems and into physical workplace actions. Organizations that lack clear, GDPR-aligned off-boarding procedures expose themselves to regulatory fines and reputational harm even through seemingly routine administrative actions.