Italian DPA Rules Employee Locker Search Violates GDPR Personal Data Rights

Written by AI from the linked story. Not reviewed by an editor. How this works

The Garante ruling highlights that personal data under GDPR extends beyond digital information to physical personal items, meaning organisations must treat any interaction with employees' personal belongings as a data processing activity subject to GDPR principles. The employer failed to establish a valid legal basis, as 'legitimate interest' requires a documented balancing test weighing the organisation's interests against the employee's reasonable expectation of privacy — a step that was entirely skipped. Compounding the violation, filming the locker opening created an additional layer of unlawful data processing with no documented justification. This case matters because it demonstrates that GDPR obligations follow people into physical spaces, and organisations that conflate ownership of premises with unrestricted access to employee private spaces face significant regulatory and reputational risk.

Tactical Insight

Immediate actions

Conduct a legal review of all existing policies governing access to employee-assigned private spaces (lockers, desks, personal storage) to ensure GDPR compliance.
Cease any practice of recording or filming searches of employee personal spaces without a documented legal basis and explicit proportionality assessment.

Policy & governance improvements

Develop a formal Legitimate Interest Assessment (LIA) procedure that must be completed and documented before any employer access to employee personal spaces is authorised.
Establish a clear written policy defining under what lawful conditions, and by whom, employee lockers or personal storage may be accessed, communicated to all staff at onboarding.
Ensure that any physical evidence handling process (including destruction of belongings) is reviewed by a Data Protection Officer or legal counsel before execution.

Training & awareness measures

Train HR, facilities management, and line managers on the principle that GDPR applies to physical personal data, not just digital records.
Include real-world case studies like this ruling in annual GDPR refresher training to reinforce broad interpretation of 'personal data' among decision-makers.