La Risorsa Umana s.r.l. – €40,000 Fine (Italy, 2023)

The data subject worked as a labour consultant for the controller and for its subsidiary under two parallel professional engagement contracts running from 3 June 2019 to 2 June 2020. The controller assigned him an individualised email account with an extension that linked to the controller's contact details On 31 December 2020, the data subject filed a complaint with the DPA. They claimed that the company director was monitoring his email correspondence on a daily basis from her own account, and that several shared accounts (such as admin@, somministrazione@ and sicurquality@) were also visible to management. They attached numerous emails showing the director regularly stepping into ongoing threads to issue instructions and comment on the work of staff and external collaborators, keeping all original recipients in copy. They also stated that no written information had ever been provided about this monitoring. The controller replied that the data subject had never been its employee. It argued that the shared accounts existed for operational reasons, that the information had been given "verbally", and that the director was authorised to act for both companies. During the investigation, the DPA also found that, on 10 July 2018, the controller and Form-App had designated each other as data processors using identical and generic deeds, which did not specify the processing operations entrusted nor contain concrete instructions. A similar reciprocal designation already existed since November 2017. The DPA noted that the controller had not provided the data subject with any written information about the systematic visibility of email exchanges by management, neither for the individualised account assigned to him nor for the shared accounts through which his correspondence transited. The privacy notices and internal codes produced by the controller either post-dated the facts of the complaint or contained no reference whatsoever to email management. The DPA also held that