La Risorsa Umana s.r.l. – €40,000 Fine (Italy, 2023)

The data subject worked as a labour consultant for the controller and for its subsidiary under two parallel professional engagement contracts running from 3 June 2019 to 2 June 2020. The controller assigned him an individualised email account with an extension that linked to the controller's contact details On 31 December 2020, the data subject filed a complaint with the DPA. They claimed that the company director was monitoring his email correspondence on a daily basis from her own account, and that several shared accounts (such as admin@, somministrazione@ and sicurquality@) were also visible to management. They attached numerous emails showing the director regularly stepping into ongoing threads to issue instructions and comment on the work of staff and external collaborators, keeping all original recipients in copy. They also stated that no written information had ever been provided about this monitoring. The controller replied that the data subject had never been its employee. It argued that the shared accounts existed for operational reasons, that the information had been given "verbally", and that the director was authorised to act for both companies. During the investigation, the DPA also found that, on 10 July 2018, the controller and Form-App had designated each other as data processors using identical and generic deeds, which did not specify the processing operations entrusted nor contain concrete instructions. A similar reciprocal designation already existed since November 2017. The DPA noted that the controller had not provided the data subject with any written information about the systematic visibility of email exchanges by management, neither for the individualised account assigned to him nor for the shared accounts through which his correspondence transited. The privacy notices and internal codes produced by the controller either post-dated the facts of the complaint or contained no reference whatsoever to email management. The DPA also held that providing information "verbally", as claimed by the controller, did not satisfy Article 12(1) GDPR, which requires information to be given in writing and only allows oral information at the data subject's request. Therefore, the DPA found a violation of Article 13 GDPR. Since the duty to inform employees is, in the employment context, a direct expression of the principle of fairness, the DPA also found a violation of Article 5(1)(a) GDPR. The DPA then assessed the director's systematic access to non-individualised accounts and, through them, to communications originating from individualised accounts of staff and external collaborators (including those of the subsidiary, with extension form-app.it). It found that this access went beyond what was necessary to coordinate the company's activities, since it was also used to comment on and evaluate the conduct of individual employees in front of their colleagues, in some cases using language that affected their professional dignity. Coordination and managerial instructions could have been issued through individualised channels that would not have exposed third parties' communications. Therefore, the DPA found that the processing was not adequate, relevant or limited to what was necessary, in violation of Article 5(1)(c) GDPR. As to the reciprocal designations between the controller and Form-App, the DPA pointed out that the appointment of a data processor under Article 28 GDPR is not a merely formal step: the underlying legal act must identify the subject matter and duration of the processing, its nature and purposes, the type of personal data and the categories of data subjects, and must include specific instructions from the controller. Since the deeds in question only contained a generic and reciprocal formula and did not specify which processing operations were actually entrusted, the DPA found a violation of Article 28 GDPR. Finally, the DPA archived the contested violation of Article 6 GDPR concerning the director's access to communications from form-app.it accounts, accepting that the director acted as legal representative of both companies and was therefore authorised to process data on behalf of both. On these grounds, the DPA fined the controller €40,000 for the violations of Articles 5(1)(a), 5(1)(c), 13 and 28 GDPR, taking into account, among other elements, the negligent conduct of the controller, the cooperation provided during the proceedings and the absence of prior relevant violations.