Alitalia Società Aerea Italiana S.p.a. – €1,250,000 Fine (Italy, 2026)

The data controllers were Alitalia and ITA Airwais, two Italian airlines. Alitalia was Italy’s historic flagship Airline while ITA is a new airline under partly public ownership, founded in 2021 to serve as a successor to Alitalia. In 2021 Alitalia sold numerous assets from its aviation division to ITA and entered receivership. The operation was the result of a government decision and was provided for by law. Due to certain technicalitiesThe operation was described as a sale of individual assets as opposed to the sale of a "business unit". However, the qualification of the contract was controversial: see the comments for more information. of the sale contract, ITA did not take over Alitalia’s existing employment contracts. So, ITA lacked the staff to operate the assets it bought and sought to hire many former Alitalia employees. In order to speed up the recruitment, Alitalia disclosed personal data of the former employees of its aviation division with ITA. The data included the personal details and contact information of employees, their marital status, their salary (which, as the DPA incidentally noted, was irrelevant for HR purposes), their professional qualification and other information relative to the employment relationship (for instance, whether a worker had been fired and was later reintegrated in the workplace following a court ruling). In 2023 a labour union representative and former Alitalia employee (the data subject) filed access requests with both controllers. In his requests, he specifically asked whether his personal data had been shared between the controllers and inquired about this processing. ITA responded that it was not processing the complainant’s personal data at the time of his request. The company also provided the data subject with the copy of its privacy notice for employees and with other documents related to the processing of personal data. Alitalia did not respond to the request at first. The data subject later filed two distinct complaints, claiming that Alitalia did not respond to his request and that ITA did non address the request properly. The DPA joined the two cases and addressed them with a single investigation. Alitalia eventually responded to the request after the DPA notified it about the investigation. In its response, the company explained that it disclosed the complainant’s data to ITA in the context of the sale of assets between the two companies. With regards to all further details on the processing, the company referred the reader to its privacy notice for employees. The DPA held that both controllers failed to respond to the data subject’s request. Additionally, the DPA held that personal data from many employees (including the data subject) were shared between the two controllers with no legal basis and without transparency. On these grounds, the DPA found violations of Articles 5(1)(a), 6, 12, 13, 14, and 15 GDPR and fined the controllers for a total of €1,25M (€1M for ITA, €250.000 for Alitalia). = With regards to Alitalia, the DPA first clarified that the right to be informed under Article 13 GDPR, and the right of access under Article 15 GDPR, are correlated but ultimately distinct. In the DPA’s view, controllers cannot comply with Article 15 GDPR by merely referring to a privacy statement; instead, they need to explain how the complainant’s data were processed in concreto. The DPA then noted that Alitalia failed to do so. The DPA also noted that Alitalia only responded to the request after being notified of the investigation, long past the legal deadline. On these grounds, the DPA found that Alitalia failed to honor the complainant’s access request. = The DPA observed that in its response, ITA merely informed the data subject that it did not process his data at the time of the access request. The controller did not provide any information on the past processing of the data subject’s data, even though the data subject had explicitly requested this information. On these grounds, the DPA concluded that ITA failed to honor the complainant’s request. = The DPA also investigated the broader picture of the processing and the sharing of employees’ data between the controllers. In their defences, the controllers invoked several legal bases for sharing employees’ data. However, the DPA rejected the arguments and held that the data were processed unlawfully. == The controllers noted that many of Alitalia’s employees applied for a job with ITA before Alitalia entered receivership. On these grounds, they claimed that sharing their data was necessary in order to assess their applications and eventually enter into an employment contract with them (Article 6(1)(b) GDPR). The DPA, however, observed that Alitalia disclosed the data of all of the employees of its aviation division. Therefore, the legal ground invoked by the controller, only covered a subset of the data set. For these reasons, the DPA rejected the argument that the processing was justified under Article 6(1)(b) GDPR. == The controllers claimed that the processing was necessary under a legal obligation. In this regard, they pointed to a provisionArt. 11-quater d.l. 73/2021, as modified by d.l. 121/2021. from the 2021 legislative decree providing for the sale of Alitalia’s assets. The DPA, however, noted that the provision in question merely authorized the sale of assets and did not mention any processing of personal data. On these grounds, the DPA rejected the argument. == The controllers further claimed that they had a legitimate interest in correctly handling the business operation between them and that this interest was the legal basis for processing employees’ data. However, the DPA observed that neither controller had carried out an assessment of their legitimate interest. The DPA also stated (quite vaguely) that the situation did not allow for reliance on legitimate interest anyway. On these grounds, the DPA ruled out Article 6(1)(f) GDPR as a legal basis for the processing. = In their defense, the controllers referred to several privacy notices. The DPA examined them and found that, contrary to the controller's claims, they did not actually provide information about the transfer of data between the controllers. Furthermore, the DPA found no evidence that these notices were provided to the employees. On these grounds, the DPA held that the controllers failed to inform the employees about the processing.