XX – €1,000 Fine (Italy, 2020)

Ms. XX, an employee of TB s.r.l., claims a violation of her data protection rights following the posting on the company notice board "visible to all employees and customers of the supermarket [of] the letter of [...] dismissal without just cause, with attached [...] personal details [of the complainant itself]". Is the controller's decision to publish the termination letter respectful of the GDPR? The Garante clarifies that, following the termination of the employment relationship, there is an obligation to communicate to the employee, not to the general public (including the customers of the supermarket), to whom communication is not absolutely necessary. The communication could instead be made to previous colleagues of the complainant, but in different ways, respectful of confidentiality and professional of the data subject (see art. 5, paragraph 1, letter a) and c) of the Regulation). For the above reasons, the processing of personal data referred to the complainant is unlawful in relation to Articles 5, paragraph 1, letter a) and c) and 6 of the Regulation.