Garante per la protezione dei dati personali (Italy) - 476/2026
Italian DPA fines company €460K for unlawful employee email monitoring.
The Italian Data Protection Authority (Garante) has fined a company €460,000 for unlawfully accessing and using employee email correspondence in disciplinary proceedings. The DPA found that the company's investigation was retrospective, examining emails dating back two years before a suspicion arose, violating GDPR principles of purpose limitation, data minimisation, and storage limitation. The authority also ruled that employees retain a reasonable expectation of privacy in the workplace, and the company's monitoring practices lacked proper safeguards and transparency.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe company violated core GDPR principles by conducting a sweeping, retrospective review of employee emails spanning two years prior to any formal suspicion arising — far exceeding what is proportionate or lawful. This breach of purpose limitation, data minimisation, and storage limitation principles demonstrates that even internal HR investigations must operate within strict legal boundaries. Employees retain a reasonable expectation of privacy even in the workplace, meaning monitoring must be transparent, targeted, and governed by clear policies. This case matters because it shows that misusing access to legitimately held data — not just collecting it unlawfully — can trigger significant regulatory penalties.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.