[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4B084EhRpwE9m5IfVMIcJXr9e9Pj80YCvN0VbddKkqA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":28,"created_at":29,"published_at":30,"article":31,"tags":35,"podcasts":54,"controls":55},"c41d9b0f-b4e8-413f-a124-d5a2e56885ef","italian-dpa-fines-employer-for-unlawful-continuous-gps-tracking-of-staff-vehicles","25eadb5e-7d1f-467f-a22e-45af6bbd8e9b","Italian DPA Fines Employer for Unlawful Continuous GPS Tracking of Staff Vehicles","An Italian employer systematically tracked company vehicles every 15 minutes without providing employees any means to deactivate the system, violating multiple GDPR principles including data minimisation, purpose limitation, and lawfulness. The Garante found that safety justifications related to hazardous materials transport were insufficient to legitimise such pervasive, continuous surveillance, and that collective bargaining agreements alone do not constitute a valid GDPR legal basis. No Data Protection Impact Assessment (DPIA) was conducted, and privacy-by-design principles were ignored entirely during system deployment. This case highlights that even operationally justified monitoring programmes must be proportionate, transparently communicated to employees, and supported by robust legal and technical safeguards from the outset.","**Immediate actions:**\n- Conduct a lawful basis review for all existing employee monitoring systems to ensure GDPR Article 6 compliance before continuing their use.\n- Provide employees with clear, Article 13-compliant privacy notices detailing the scope, frequency, and purpose of any location or vehicle tracking.\n\n**Privacy-by-design improvements:**\n- Implement configurable tracking intervals and employee-controlled deactivation windows that balance operational needs with data minimisation requirements.\n- Embed privacy-by-design (GDPR Article 25) reviews into the procurement and deployment process for any new monitoring or tracking technology.\n- Commission a formal DPIA (GDPR Article 35) before deploying any systematic employee monitoring solution, documenting risks and mitigations.\n\n**Governance & compliance measures:**\n- Establish a cross-functional review process (HR, Legal, DPO) to assess whether collective bargaining agreements adequately address — not substitute — GDPR obligations.\n- Maintain an up-to-date register of all employee monitoring activities as part of the Records of Processing Activities (RoPA) required under GDPR Article 30.\n- Schedule periodic audits of active monitoring systems to verify continued proportionality and alignment with stated processing purposes.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(b) – Purpose limitation","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 6 – Lawful basis for processing","GDPR Article 13 – Transparency and information obligations","GDPR Article 25 – Data protection by design and by default","GDPR Article 30 – Records of processing activities","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the context of employment","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-3 (Personally Identifiable Information Processing Purposes)","NIST Privacy Framework: Govern-P, Control-P","CIS Control 3 – Data Protection","ISO\u002FIEC 29134 – Guidelines for Privacy Impact Assessment","EDPB Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR",{},"published","2026-07-07T14:20:21.979446+00:00","2026-07-07T14:20:21.619+00:00",{"id":7,"url":32,"slug":33,"title":34},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_382\u002F2026&diff=52086&oldid=52076","garante-per-la-protezione-dei-dati-personali-italy-382-2026-9bf8b7","Garante per la protezione dei dati personali (Italy) - 382\u002F2026",[36,42,48],{"id":37,"name":38,"slug":39,"description":40,"color":41},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":49,"name":50,"slug":51,"description":52,"color":53},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]