Italian DPA fines security company EUR 39 000 for violations concerning employees’ data

What happened

The Italian Data Protection Authority investigated La Patria S.p.A. after a former employee complained about denied access to disciplinary documents and lack of clear information on GPS tracking. The regulator found violations of GDPR Articles 12, 13 and 15, imposing a total fine of EUR 39,000 split between access‑right failures (EUR 22,000) and information‑provision failures (EUR 17,000). The company had already begun remedial actions, so no further corrective measures were ordered.

Why it matters

Employers handling employee monitoring must treat access requests as GDPR rights and supply precise notices on geolocation processing, or risk enforcement actions.

Business impact

Failure to comply can lead to monetary penalties and reputational damage, prompting firms to audit privacy notices and access‑request workflows.

Checklist

• Update employee privacy noticesHigh priority

  Remove inaccurate references to special categories and clearly describe GPS tracking purposes.

• Implement a formal access‑request procedureHigh priority

  Respond to employee requests within GDPR timelines and provide reasons if a request is denied.

• Document geolocation data processingMedium priority

  Ensure employees receive detailed information about how vehicle GPS data is collected and used.

Who reported it

Discussion