[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffww4I969pfZzQ2n98iqAvmXQ7ph9wNvRkoa7zIWZPTU":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":68},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"e35a5692-0a3e-4517-ab53-21951508b411","Garante per la protezione dei dati personali (Italy) - 585\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-585-2026-d95e10","← Older revision Revision as of 08:19, 23 September 2026 Line 92: Line 92: }} }} The DPA fined a controller €20,000 for insufficiently responding to two access requests, by not providing suitable nor correct information. The DPA fined a controller €20,000 for insufficiently responding to two access requests by one of its employees, and for not informing its employees about the processing of their vehicles’ GPS data. == English Summary == == English Summary == Line 101: Line 101: In its defence, the controller submitted that the data subject requested access to the documentation pertaining to the disciplinary proceedings, referencing national labour law, and made no reference to the GDPR. Therefore, the requests were interpreted as part of the data subject’s right to a defence under national labour law, and the controller found it sufficient to deal with it as such. The controller explained that had the data subject made evident that the request was an exercise of their data subject rights, namely the right to access under [[Article 15 GDPR]], they would have allowed for a response compliant with the GDPR. In its defence, the controller submitted that the data subject requested access to the documentation pertaining to the disciplinary proceedings, referencing national labour law, and made no reference to the GDPR. Therefore, the requests were interpreted as part of the data subject’s right to a defence under national labour law, and the controller found it sufficient to deal with it as such. The controller explained that had the data subject made evident that the request was an exercise of their data subject rights, namely the right to access under [[Article 15 GDPR]], they would have allowed for a response compliant with the GDPR. As regards the GPS data, the controller explained that the GPS devices were intended for fleet management, and active and passive safety of the drivers, and that no data directly related to the drivers was processed. Thus, in order for the controller to have complied with this request they would have had to access the system and undertake processing which they had not done before. As a result of the use of the GPS for the above-mentioned purposes, in good faith the controller did not have a privacy notice concerning the processing of data via the GPS. As regards the GPS data, the controller explained that the GPS devices were intended for fleet management, and active and passive safety of the drivers, and that no data directly related to the drivers was processed. Thus, in order for the controller to have complied with this request they would have had to access the system, and undertake processing which they had not done before. As a result of the above-mentioned use of the GPS, the controller decided not include a privacy notice concerning the processing of data via the GPS. Finally, the controller claimed that the data subject did not suffer any harm. Finally, the controller claimed that the data subject did not suffer any harm.","The Italian Data Protection Authority (Garante) fined a company €20,000 for failing to properly respond to two employee access requests and for not informing employees about the processing of their vehicle's GPS data. The company argued the requests were related to labor law defense, not GDPR, and that GPS data was only for fleet management. The DPA found these defenses insufficient.","Italian DPA fines company €20,000 for GDPR violations related to employee access requests and GPS data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_585\u002F2026&diff=53174&oldid=53170","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-23T08:19:57+00:00","2026-09-23T10:00:28.225131+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"GPS","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":67},[50],{"slug":51,"name":52,"problem":53,"products":54},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[55,61],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":56,"product_name":57,"url":59,"description":60},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":62,"product_name":63,"url":65,"description":66},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":69,"title":70,"body":71,"framework_refs":72,"framework_notes":84},"italian-dpa-fines-company-20000-for-ignoring-employee-data-access-rights-and-gps-transparency-failur","Italian DPA Fines Company €20,000 for Ignoring Employee Data Access Rights and GPS Transparency Failures","This case highlights two compounding GDPR failures: the company did not properly respond to employees' data subject access requests (DSARs), and it failed to transparently inform employees that their vehicle GPS data was being collected and processed. Dismissing DSARs as 'labor law matters' rather than GDPR obligations is a common but costly misunderstanding — the GDPR applies regardless of the underlying business context. GPS tracking of employees is particularly sensitive personal data that requires clear, upfront disclosure in privacy notices. This case demonstrates that inadequate transparency and unresponsiveness to data rights are independently enforceable violations, not minor procedural oversights.",[73,74,75,76,77,78,79,80,81,82,83],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 12 – Transparent information and communication","GDPR Article 13 – Information to be provided at the time of data collection","GDPR Article 15 – Right of access by the data subject","GDPR Article 30 – Records of processing activities","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data processing","NIST SP 800-53 IP-1 – Consent","NIST SP 800-53 IP-2 – Individual Access","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Management – Request Fulfilment Process",{}]