Costampress S.p.A. – €10,000 Fine (Italy, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Costampress S.p.A. was fined for not properly managing a former employee's email and laptop after his dismissal. The Italian data protection authority found that the company failed to ensure the employee's data was handled correctly. This case shows that businesses need to have clear policies for managing employee data after they leave.
What happened
Costampress S.p.A. did not delete a former employee's company email and laptop data after his employment ended.
Who was affected
A former employee of Costampress S.p.A. was affected by the company's failure to manage his data.
What the authority found
The Garante determined that Costampress did not comply with GDPR rules regarding the management of personal data after employment termination.
Why this matters
This case highlights the need for companies to establish clear data management policies for former employees. It serves as a warning that neglecting these responsibilities can lead to penalties.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A data subject issued a complaint with the Italian DPA (Garante per la Protezione dei Dati Personali – Garante) against his previous employer Costampress S.p.A. (a manufacturer of aluminium components). The data subject alleged that once his employment relationship had been terminated, the company had failed to delete the company email assigned to him, and that he had not been granted access to the company laptop computer and the personal data contained in it. The company responded to these allegations, stating that after the data subject’s dismissal, he had unilaterally proceeded to delete all the communications in his company email account. The company also explained that in order to protect its legitimate interest, it set up an automatic response system that would notify users of the deactivation of the complainant's mailbox, with an alternative email address to send messages relating to the activities carried out by the complainant within the company. According to the employer, this lasted for a month and a half, and then the email account itself was completely deactivated. Furthermore, the company stated that once the relationship was terminated, the data subject’s company laptop was given to an expert IT consultant to carry out an inspection. This was based on a legitimate suspicion that the hard disk might contain elements that could be used to refute the authenticity of documents which were subject to a separate legal dispute between the claimant and the company in the a Specialised Business Section Court in Venice. Additionally, during the preliminary phase of the proceedings, the Garante expressed concerns related to this data processing carried out on the data subject’s hard disk, due to an absence of specific company regulations regarding the handling of IT systems used by employees. The company addressed these concerns, noting that among the tasks entrusted to the complainant, one was precisely the drafting of these regulations, which were never fully c
Related Enforcement Actions (0)
No other enforcement actions found for Costampress S.p.A. in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
10 February 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€10,000
About this data
Cite as: Cookie Fines. Costampress S.p.A. - Italy (2022). Retrieved from cookiefines.eu
Last updated: