Garante per la protezione dei dati personali (Italy) - 462/2026
Italian DPA rules employee locker contents are personal data, processing unlawful.
The Italian Data Protection Authority (Garante) ruled that personal items found in an employee's locker constitute personal data under GDPR. The controller's actions of opening the locker, filming the process, and destroying the contents were deemed unlawful data processing. The DPA rejected the controller's defense of legitimate interest, citing the employee's reasonable expectation of privacy and the lack of proper balancing of interests.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Garante ruling highlights that personal data under GDPR extends beyond digital information to physical personal items, meaning organisations must treat any interaction with employees' personal belongings as a data processing activity subject to GDPR principles. The employer failed to establish a valid legal basis, as 'legitimate interest' requires a documented balancing test weighing the organisation's interests against the employee's reasonable expectation of privacy — a step that was entirely skipped. Compounding the violation, filming the locker opening created an additional layer of unlawful data processing with no documented justification. This case matters because it demonstrates that GDPR obligations follow people into physical spaces, and organisations that conflate ownership of premises with unrestricted access to employee private spaces face significant regulatory and reputational risk.