Università degli Studi di Cassino e del Lazio Meridionale – €8,000 Fine (Italy, 2025)

A professor (the data subject) filed three complaints against his former employer, an Italian university (the controller). He claimed that the controller: * did not deactivate his work email account or delete his emails after firing him; * unlawfully published its personal data on its website; * dismissed his request for access and erasure as well as his opposition to the processing of their data. The data subject claimed that the dismissal was unlawful and not sufficiently explained. The DPA held upheld the data subject’s claims and held that the controller: * violated Articles 5(1)(a), 5(1)(e) and 6 GDPR by failing to deactivate the email account of the data subject and to erase his communications after the end of the employment relationship; * violated Articles 12(3), 17 and 21 GDPR by unlawfully dismissing the data subject’s requests and by failing to explain the reasons behind the dismissal; * violated Articles 5(1)(a) and 6 GDPR as well as 2-ter of the Italian data protection code by unlawfully publishing the personal data of the complainant, as well as information about other data subjects. Contrary to the controller’s arguments, the DPA found that the data subject’s emails did not constitute administrative acts. So, the emails were not covered by any archiving obligation under administrative law. The DPA also dismissed the controller’s arguments that the emails were necessary to defend the controller’s legal claims against the data subject. In this regard, the DPA acknowledged that the controller and the data subject were involved in pending legal proceedings. However, the DPA held that the controller failed to show how storing the emails was concretely necessary for the controller to defend itself in those proceedings. The DPA fined the controller €8,000. In calculating the fine, the DPA considered that the controller implemented technical measures to prevent its staff from accessing the data subject's email, and that it eventually erased the data subject