[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$figMFSr6XGSWE1W4wfUvyepn7wdmZgDjnRUINyeQjqrA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"61f3b54a-1e86-4df8-90a3-a401f3f132cb","Garante per la protezione dei dati personali (Italy) - 462\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-462-2026-3b0cb4","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=462\u002F2026 |ECLI= |Original_Source_Name_1=GPDP |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10268633 |Original_Source_Language_1=Italian |Original_Source_Language__Code_1=IT |Original_Source_Na...\" Show changes","The Italian DPA has fined Cosmint S.p.A. €6,600 for unlawfully processing a former employee's personal data. The company opened and emptied the employee's locker in his absence, destroying its contents, and recorded the process with a smartphone. The DPA ruled that the locker's contents constituted personal data and the actions taken were unlawful processing operations under GDPR.","Italian DPA fines company €6,600 for unlawfully processing former employee's personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_462\u002F2026&diff=52520&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-07-28T23:19:42+00:00","2026-07-29T00:00:33.60819+00:00",7,[17],{"name":18,"type":19},"Cosmint S.p.A.","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"italian-dpa-fines-cosmint-for-unlawful-processing-of-former-employees-personal-data","Italian DPA Fines Cosmint for Unlawful Processing of Former Employee's Personal Data","Cosmint S.p.A. violated GDPR by opening and emptying a former employee's locker without lawful basis, destroying its contents, and recording the process on a smartphone — all of which constituted unlawful personal data processing. The root cause was a failure to understand that physical items belonging to an individual can constitute personal data, and that any interaction with them must comply with data protection principles. This case highlights that GDPR obligations extend well beyond digital systems and into physical workplace actions. Organizations that lack clear, GDPR-aligned off-boarding procedures expose themselves to regulatory fines and reputational harm even through seemingly routine administrative actions.",[53,54,55,56,57,58,59,60,61],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 6 – Lawfulness of processing","GDPR Article 13\u002F14 – Transparency and information obligations","GDPR Article 24 – Responsibility of the controller","NIST SP 800-53 PS-4 (Personnel Termination)","NIST SP 800-53 IP-1 (Privacy Policy and Procedures)","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Annex A 6.5 – Responsibilities after termination or change of employment","ITIL Service Transition – Off-boarding and asset return processes",{}]