Amazon Italia Logistica s.r.l. – Violation Found (Italy, 2026)

Violation Found
Garante per la protezione dei dati personali24 February 2026Italy
final
Violation Found

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

Amazon Italia was investigated for how it handled employee data in its warehouses. The company used a system that tracked personal information, including sensitive details, without proper safeguards. This is important because it raises concerns about employee privacy and how companies manage personal data.

What happened

Amazon Italia was found to be processing employee personal data in ways that could compromise privacy.

Who was affected

Employees working in Amazon warehouses were affected by the data processing practices.

What the authority found

The Garante found that Amazon Italia's data processing methods raised significant privacy concerns, although no specific violations were classified.

Why this matters

This investigation signals that companies must be cautious about how they handle employee data, especially sensitive information. It encourages businesses to implement stronger privacy protections.

GDPR Articles Cited
Automatically processed
Art. 6(GDPR)
Art. 9(GDPR)
Art. 5(1)(a) GDPR
Art. 5(1)(c) GDPR
Art. 5(1)(e) GDPR
Art. 58(2)(f) GDPR
View original scraped data
Art. 5(1)(a) GDPR
Art. 5(1)(c) GDPR
Art. 5(1)(e) GDPR
Art. 6(GDPR)
Art. 9(GDPR)
Art. 58(2)(f) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
art. 113 of the Code

Source checks

Secondary-source text retrieved.

Automated check recorded — 14 April 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The DPA began an ex-officio investigation against Amazon Italia Logistica s.r.l. (the controller), following media reports on the way the controller was processing employees’ (the data subjects) personal data in warehouses managed by the controller. The DPA investigated the use of a platform that notified managers on the need to interview data subjects in specific situations (e.g. after a data subject returns from a leave of absence) or based on the score in an algorithm that takes into consideration the number and duration of data subjects’ absences. The DPA found that the platform also allowed managers to add comments in the free text fields of the data subjects’ individual records. This was used by managers to add detailed information related to data subjects, such as their medical conditions, involvement in trade unions, information on their families’ personal life, and concerns relating to personal relationships between data subjects. The controller retained this data for the entire duration of the employment relationship, and for up to ten years after its termination. Finally, the DPA found that this data is shared between teams, and that personnel of several roles had broad access to this data. The DPA also investigated the video surveillance cameras placed in areas reserved for employees, especially bathrooms and break areas. The DPA found that the cameras were positioned in a way that allowed the controller to identify individuals accessing the bathrooms and break area, even if a privacy masking function was activated. The controller argued that the purpose was to protect common areas. The DPA found that the controller had unlawfully processed data subjects’ personal data. First, the controller processed data subjects’ personal data in its platform that was not relevant for the purposes of assessing their professional aptitudeIn this regard, the DPA referenced Article 8 of the so-called "Workers' statute" (l. 300/1970). Among other things, the law regul

Outcome

Violation Found

The DPA found a violation but did not impose a fine.

Details

Decision Date

24 February 2026

Authority

Garante per la protezione dei dati personali

GDPRhub ID

gdprhub-9882

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Amazon Italia Logistica s.r.l. - Italy (2026). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: