Amazon Italia Logistica s.r.l. – Violation Found (Italy, 2026)

The DPA began an ex-officio investigation against Amazon Italia Logistica s.r.l. (the controller), following media reports on the way the controller was processing employees’ (the data subjects) personal data in warehouses managed by the controller. The DPA investigated the use of a platform that notified managers on the need to interview data subjects in specific situations (e.g. after a data subject returns from a leave of absence) or based on the score in an algorithm that takes into consideration the number and duration of data subjects’ absences. The DPA found that the platform also allowed managers to add comments in the free text fields of the data subjects’ individual records. This was used by managers to add detailed information related to data subjects, such as their medical conditions, involvement in trade unions, information on their families’ personal life, and concerns relating to personal relationships between data subjects. The controller retained this data for the entire duration of the employment relationship, and for up to ten years after its termination. Finally, the DPA found that this data is shared between teams, and that personnel of several roles had broad access to this data. The DPA also investigated the video surveillance cameras placed in areas reserved for employees, especially bathrooms and break areas. The DPA found that the cameras were positioned in a way that allowed the controller to identify individuals accessing the bathrooms and break area, even if a privacy masking function was activated. The controller argued that the purpose was to protect common areas. The DPA found that the controller had unlawfully processed data subjects’ personal data. First, the controller processed data subjects’ personal data in its platform that was not relevant for the purposes of assessing their professional aptitudeIn this regard, the DPA referenced Article 8 of the so-called "Workers' statute" (l. 300/1970). Among other things, the law regulates workplace surveillance as well as the collection of information about employees' personal opinions. The DPA often uses this law as a point of reference when dealing with Art. 88 GDPR and its national implementation.. This was in violation of Article 88 GDPR [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%2528Testo+coordinato%2529 (Article 113 of the national law implementing the GDPR]). In addition, the DPA stated that both the platform and the video surveillance cameras violated the principles of lawfulness (Article 5(1)(a) GDPR), data minimisation (Article 5(1)(c) GDPR) and storage limitation (Article 5(1)(e) GDPR). Finally, the controller processed personal data without a valid legal basis (Article 6 GDPR), including sensitive data (Article 9 GDPR). The DPA decided to adopt urgent measures while the investigation process was ongoing. This is because of the large number of data subjects involved (approximately 1,800 employees), the considerable time frame the controller had been systematically processing this data (including making it accessible to personnel), and the sensitive nature of the personal data. Therefore, the DPA ordered the controller to limit the processing of personal data on the platform and surveillance cameras with immediate effect, subject to a fine for non-compliance (in accordance with Article 58 (2)(f) GDPR). In addition, the controller must immediately verify the lawfulness of processing data in the platform’s free-text fields.