Azienda regionale per lo sviluppo dell'agricoltura calabrese – €50,000 Fine (Italy, 2025)

The Calabrian Regional Agency for Agricultural Development (the controller) implemented a remote work policy that required employees to use a time-tracking application called "Time Relax" when working remotely. The application required employees to enable location services on their devices and collected their precise geographical coordinates during clock-in and clock-out procedures. The controller used this geolocation data to verify that employees were working from locations specified in their individual remote work agreements. In addition to routine location tracking during daily time-stamping, the controller conducted targeted inspections of specific employees. During these inspections, an officer would call the employee during their availability hours and request them to perform double time-stamping (clock-in and clock-out) through the Time Relax application. The employee was then required to send an email declaring their exact location during the inspection. The officer would subsequently verify whether the declared location matched both the email declaration and the location data recorded by the application. An employee of the controller (the data subject) was subjected to such an inspection. The controller found discrepancies found between their declared work location in the remote work agreement and their actual location during the inspection. On these grounds, the controller initiated disciplinary proceedings against the data subject. The data subject filed a complaint with the DPA, alleging violations of data protection principles. Additionally, the Department of Public Administration reported the controller's practices to the DPA. During the proceedings, the controller claimed that the monitoring was carried out with the consent of its employees. The controller also pointed out that its monitoring system was implemented in agreement with trade union representatives, as required under Italian labor law. Overall, the DPA found violations of Articles 5(1)(a), (b) and (c), and 6 GDPR, as well as Article 113 of the Italian Data Protection CodeArt. 113 d. lgs. 196/2003 (available [https://www.gazzettaufficiale.it/atto/serie_generale/caricaDettaglioAtto/originario?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218 here]).. On these grounds, the DPA issued a €50,000 fine. On purpose limitation and Italian law The DPA clarified that the remote monitoring of employees is prohibited in Italian law, with limited exemptions when the monitoring is necessary for legally specified purposes ("for organisational and productive necessities"; "for workplace safety"; "for the protection of company assets")Art. 4 l. 300/1970 (available [https://www.gazzettaufficiale.it/eli/id/1970/05/27/070U0300/sg here]). The DPA held that in the case at hand, remote monitoring did not fall under an exemption and was illegal under the Italian law. For this reason, the DPA concluded that the processing violated the principle of purpose limitation (Article 5(1)(b) GDPR), as it pursued an illegal purpose under Italian law. In this regard, the DPA held it irrelevant that trade union representatives agreed to the monitoring system beforehand. The DPA clarified that data protection law and labor law are complementary. So, an agreement with trade union representatives did not exempt the controller from complying with the GDPR. On the DPA's other findings Second, the DPA held that the controller could not collect valid consent from its employees. In this regard, the DPA referenced [https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf EDPB] and [https://ec.europa.eu/newsroom/article29/items/610169 WP29] guidance, as well as the DPA's own [https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10084453 case law.] Furthermore, because the collection of personal data was unlawful, the further processing of the same data for the purpose of bringing discliplinary proceedings against the data subject, was also unlawful. Therefore, the further processing of personal data in the context of disciplinary proceedings, violated Articles 5(1)(a), (b) and 6 GDPR. In this regard, the DPA referenced Recital 50 of the GPDR as well as the Italian data protection codeArt. 2-decies d. lgs. 196/2003, available [https://www.gazzettaufficiale.it/dettaglio/codici/datiPersonali here].. The DPA also considered that the controller failed to conduct a Data Protection Impact Assessment (DPIA). Given that processing employee geolocation data in remote work contexts presents high risks to rights and freedoms, particularly considering the vulnerability of employees in workplace contexts and the systematic monitoring involved, a DPIA was clearly required under Article 35 GDPR. Additionally, the DPA found that the systematic collection of precise location information, went beyond what was necessary for managing remote work arrangements. So, the monitoring violated the principle of data minimisation as well as Article 113 of the Italian Data Protection Code. Finally, the DPA found violations of the transparency requirements under Article 13 GDPR because the controller's documentation did not contain all essential information required. Additionally, the documentation containing the information, was never meant to serve as a privacy notice and was drafted to fulfill different obligations.