Sign in

Italian DPA fines security company EUR 39,000 for failing to respond to employee data access requests

Original title: Italian DPA fines security company EUR 39 000 for violations concerning employees’ data

Info Other, enforcement EU

The Italian DPA (Garante) fined La Patria S.p.A. EUR 39,000 for breaching Articles 12, 13, and 15 of the GDPR after the company failed to respond adequately to an employee's requests for access to his personal data and disciplinary documentation. The DPA clarified that data subjects do not need to expressly reference the GDPR for a request to qualify as a right of access exercise, and established that controllers must inform data subjects of reasons for non-compliance and available remedies. Additionally, the company failed to provide employees with appropriate information about GPS geolocation data processing on company vehicles, which constitutes personal data as vehicle location can be indirectly linked to specific employees.

What changed

  • Italian DPA clarifies that data subjects do not need to explicitly cite the GDPR when submitting an access request for it to be recognized as an exercise of the right of access under Article 15
  • Controllers must inform data subjects of the specific reasons for refusing an access request and notify them of their right to lodge a complaint or seek judicial remedy
  • Geolocation data collected through GPS systems on company vehicles constitutes personal data, even when the vehicle location is only indirectly linked to employees, requiring appropriate transparency measures
  • Employers must provide employees with clear and adequate information about the processing of GPS geolocation data before or at the time of data collection, as required by Article 13 of the GDPR
  • Privacy notices cannot incorrectly reference the processing of special categories of personal data when the actual processing does not justify such reference

Who is affected

Security companies and employers in the EU who process GPS geolocation data on company vehicles; all controllers handling employee data and processing employee access requests

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR