Autostrade per l'Italia S.p.A. – €420,000 Fine (Italy, 2025)

Autostrade per l’Italia S.p.A. (the controller) is a private company that maintains a portion of the Italian highway system. The controller received screenshots of Messenger and WhatsApp messages of an employee (the data subject) as well as screenshot of content she shared on Facebook. The controller used the information in disciplinary proceedings and fired the data subject. The data subject filed a complaint with the DPA, claiming that her personal data were processed unlawfully. The DPA held that the controller violated Articles 5(1)(a)(b)(c), 6, and 88 GDPR as well as Article 113 d. lgs. 193/2003. The DPA issued a €420,000 fine. The DPA considered the controller’s infringement to be severe and noted that the controller had already been fined for violation related to the processing of employees’ data. The employer processed personal data The controller claimed that it did not process personal data because it merely received the information rather than collecting it. On the contrary, the DPA held that the use of the data in the disciplinary proceedings against the data subjects, constituted a processing of personal data. It did not matter that the controller did not actively collect the information. The processing was unlawful and excessive The DPA held that the controller processed personal data without a legal basis. In particular, the DPA rejected the argument that the processing was based on the controller’s legitimate interest in managing the employment relationship and exercising its powers as the employer, for several reasons. First, the controller claim that it carried out a “balancing test” beforehand (i.e.: that it assessed whether its legitimate interest outweighed the interests and fundamental rights and freedoms of the data subject). However, it also failed to demonstrate this claim, as required by the principle of accountability (5(2) GDPR). Second, the controller failed to demonstrate that the processing was necessary for the stated purpose. In particular, the DPA pointed out that the disciplinary proceedings did not revolve entirely around the screenshots but were based on other elements as well, including the data subject’s past behavior on the workplace. However, the controller did not even consider the option of bringing discliplinary proceedings without using the screenshots it received. Finally, the DPA pointed out that under Italian labor lawArt. 8 d. lgs. 300/1970; Art. 19 d. lgs. 276/2003., employers are not allowed to investigate any aspect of employee’s personal lives which are irrelevant to the employment relationship. In the case at hand, the DPA held that the controller violated this prohibition. Therefore, the DPA concluded that the data processing unlawfulThis is something of a leitmotiv in the Garante's case law- see comment. as well as excessive, in violation of Articles 5(1)(a)(b)(c) GDPR.