Giessegi Industria Mobili S.p.A. – €50,000 Fine (Italy, 2022)

The controller (Giessegi Industria Mobili S.p.A.) was in a contractual relationship with a processor (Verizon Connect Italy S.p.A.) providing geolocation devices. The controller installed geolocation devices to track vehicles delivering goods on its behalf. These vehicles were not directly owned by the controller, but rather by a third company to which the controller outsourced certain services. The data subject was a driver employed by this third company and had no direct contractual relationship with the controller. After the termination of the agreement with the processor, the controller phased out the devices. However, the controller forgot to remove one of them, which was subsequently found by the data subject in the engine of their car. It must be stressed that when the data subject found the device the contract between Giessegi and the data subject´s company was no longer in place either. Giessegi claimed that the geolocation devices were associated with car plates and not with individuals. As the controller did not know who the driver was, geolocation data could not be considered personal data under the GDPR. The Italian DPA started an investigation concerning potential violations of Articles 5(1)(a), 6, 13, 28(1) and 35 GDPR. The Italian DPA rejected the controller´s argument and clarified that “personal data” refers not only to an identified person, but also to an identifiable one, like in the case at issue. Giessegi was the controller, as it determined purposes and means of the processing. The Italian DPA then identified a number of violations. In the first place, Giessegi violated Articles 5(1)(a) and 13 GDPR, as it did not provide the data subject with a proper privacy policy. Article 28 GDPR was also infringed, as no controller-processor agreement existed between Giessegi and Verizon. With regard to the time after the end of the agreement between Giessegi and the company employing the data subject, there was also a violation of Article 6 GDPR. Geolocation devices were installed to monitor the performance of the contract between Giessegi and the data subject´s delivery company. However, the controller could no longer rely on Article 6(1)(b) after the termination of such an agreement. Therefore, it processed personal data without any legal basis. Finally, the DPA identified a violation of Article 35 GDPR. As a matter of fact, no DPIA was in place. Referring to the Article 29 WP guidelines, the DPA claimed that location data are “highly personal” and that employees are vulnerable data subjects. As a consequence, the controller should have applied Article 35 GDPR. In light of the above, the Italian DPA used its corrective powers under Article 58(2)(c) and 83 GDPR and fined the controller €50.000.