Garante per la protezione dei dati personali (Italy) - 476/2026
Italian DPA fines company €460K for unlawful employee email monitoring and data retention.
The Italian Data Protection Authority (Garante) has fined a company €460,000 for violating GDPR. The DPA found that the company unlawfully monitored employee emails by retaining correspondence for too long and conducting retrospective investigations without a clear suspicion. The company also infringed on data subject rights and transparency obligations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe company violated GDPR by retaining employee email correspondence beyond permissible retention periods and conducting retrospective investigations without establishing clear, documented suspicion beforehand. This constitutes a failure in both data minimisation principles and transparency obligations owed to data subjects. Monitoring employees without a lawful basis, proportionate purpose, or proper notice exposes organisations to significant regulatory penalties. The case highlights that even internally directed surveillance must comply with data protection law, and employees retain rights over their personal data regardless of the employment context.