USB Lavoro Privato Puglia – €50,000 Fine (Italy, 2025)

An automotive company (Magna PT S.p.A., the data controller) asked its employees (the data subjects) to undergo “return to work interviews” (“RTWI”) upon returning after leave. Interviews were carried out by the direct superior of the data subjects. The purpose of the interview was to support data subjects in their return to their workplace and gather information on possible shortcomings of the working environment in order to later address them. The questions included, among others, whether the employee's leave was caused by their work, whether their health condition got worse in time, and whether their doctor prescribed specific accomodations or limitations. The controller claimed that participation in the interview was voluntary. Answers given in the interview were manually transcribed in a form and forwarded to HR. HR would then assess the modules and consider possible action to address any issues, along with the data subjects’ superior or the company doctor. Forms were stored for a maximum of ten years. In practice, the controller periodically reviewed the forms and destroyed the ones it did not consider relevant anymore. At the time of the investigation, no form had been stored for longer than 1 year. In 2021 a workers’ union (USB Lavoro Privato Puglia) challenged the lawfulness of this practice by filing a complaint with the DPA. The DPA investigated the complaint two years later. The DPA held that the controller violated Articles 5(1)(c)(e), 6, 9, 13 and 88 GDPR as well as Article 113 of the Italian privacy code. The DPA issued a €50,000 fine and ordered the erasure of the subjects’ data. = The controller stated that the processing relied on the legal basis of consent. In this regard, the controller observed that while consent cannot generally be freely given by employees, EDPB and WP29 Guidelines leave some room for consent when the employee's refusal has no negative consequences for the employee. The controller argued that this was precisely the case of its interviews. As an alternative to consent, the controller also invoked the legal bases of legal obligation and legitimate interest as its legal bases. The DPA, however, held that the controller had no legal basis to process the subject’s data, for several reasons. With regards to consent, the DPA considered that RTW interviews were carried out by a direct superior of the data subject. This, in and of itself, prevented data subject from giving free and valid consent. Furthermore, the DPA found that the sensitive nature of the data prevented the data subjects from freely giving their consentThe DPA's reasoning is not clearly explained here. However, the motivation seems to imply that the sensitive nature of the data was one of several factors which the DPA took into account when assessing whether consent was freely given.. With regards to the other legal bases invoked by the controller, the DPA clarified that controllers must accurately identify the legal basis before processing personal data. In other words, controllers cannot invoke additional legal bases as a backup when the first legal basis doesn’t hold up to regulatory scrutiny, as the controller did in the case at hand. On these grounds, the DPA held that the controller violated Articles 5(1)(a), 6 and 9 GDPR. = The DPA held that the privacy notice contained in the form, did not provide data subjects with sufficient information. The DPA also noted that even the general company policies, to which the notice referred, did not specifically address the processing of data collected in RTWI forms. On these grounds, the DPA held that the controller breached its transparency obligation, in violation of Articles 5(1)(a) and 13 GDPR. The DPA also held that because the controller violated its transparency obligations, the consent of data subjects was not informed (aside from not being freely given, for the reasons explained above). = The DPA held that the data collected in RTWI forms was excessive and unnecessary for the employer to comply with its legal obligation to ensure workers’ health on the workplace//. The DPA also observed that some of the data collected via the module, was already available to HR, which made its repeated collection unnecessary. For the reasons above, the DPA held that the controller violated the principle of data minimization under Article 5(1)(c) GDPR. = The DPA held that the maximum storage period of 10 years was excessive. The DPA also acknowledged that the storage periods were much shorter in practice but also considered that the controller failed to both establish clear policies on the “actual” storage times, and to inform the data subjects about those policies. On these grounds, the DPA held that the controller violated the principle of storage limitation under Article 5(1)(e) GDPR. = Finally, the DPA considered that under Italian employment lawSee the comments for more detail on the relevant laws and their role in the DPA's findings., employers are only allowed to collect employees’ data when the data are relevant to assessing employees’ capacity for work. The DPA held that RTWI interviews could potentially collect data which were irrelevant to this assessment, in violation of Italian law. On these grounds, the DPA found that the controller violated Article 88 GDPR and 113 d. lgs. 193/2003.