[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQyH0EaiRzVxOA1DRNLBNKoqGXs6Om2vjZuAIQQDklIg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"94120d74-698d-4c9c-912f-c21eb04a6525","italian-dpa-rules-employee-locker-search-violates-gdpr-personal-data-rights","88ff3ab2-fada-460e-8257-f956e693b4a5","Italian DPA Rules Employee Locker Search Violates GDPR Personal Data Rights","The Garante ruling highlights that personal data under GDPR extends beyond digital information to physical personal items, meaning organisations must treat any interaction with employees' personal belongings as a data processing activity subject to GDPR principles. The employer failed to establish a valid legal basis, as 'legitimate interest' requires a documented balancing test weighing the organisation's interests against the employee's reasonable expectation of privacy — a step that was entirely skipped. Compounding the violation, filming the locker opening created an additional layer of unlawful data processing with no documented justification. This case matters because it demonstrates that GDPR obligations follow people into physical spaces, and organisations that conflate ownership of premises with unrestricted access to employee private spaces face significant regulatory and reputational risk.","**Immediate actions:**\n- Conduct a legal review of all existing policies governing access to employee-assigned private spaces (lockers, desks, personal storage) to ensure GDPR compliance.\n- Cease any practice of recording or filming searches of employee personal spaces without a documented legal basis and explicit proportionality assessment.\n\n**Policy & governance improvements:**\n- Develop a formal Legitimate Interest Assessment (LIA) procedure that must be completed and documented before any employer access to employee personal spaces is authorised.\n- Establish a clear written policy defining under what lawful conditions, and by whom, employee lockers or personal storage may be accessed, communicated to all staff at onboarding.\n- Ensure that any physical evidence handling process (including destruction of belongings) is reviewed by a Data Protection Officer or legal counsel before execution.\n\n**Training & awareness measures:**\n- Train HR, facilities management, and line managers on the principle that GDPR applies to physical personal data, not just digital records.\n- Include real-world case studies like this ruling in annual GDPR refresher training to reinforce broad interpretation of 'personal data' among decision-makers.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 4(1) — Definition of Personal Data","GDPR Article 6 — Lawfulness of Processing","GDPR Article 6(1)(f) — Legitimate Interests (and requirement for balancing test)","GDPR Recital 47 — Legitimate Interests Balancing Test","GDPR Article 5(1)(a) — Principle of Lawfulness, Fairness and Transparency","GDPR Article 5(1)(c) — Data Minimisation","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","ISO\u002FIEC 27001:2022 Annex A 6.4 — Disciplinary Process","ISO\u002FIEC 27701 — Privacy Information Management","CIS Control 3 — Data Protection",{},"published","2026-08-04T16:20:54.853477+00:00","2026-08-04T16:20:54.765+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_462\u002F2026&diff=52609&oldid=52559","garante-per-la-protezione-dei-dati-personali-italy-462-2026-8b2fdf","Garante per la protezione dei dati personali (Italy) - 462\u002F2026",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]