ITAS Mutua – €50,000 Fine (Italy, 2026)

The Italian DPA has imposed a fine of EUR 50,000 on ITAS Mutua. A former employee of the controller requested access to the documents and emails on his personalised company email account. However, the controller only provided emails that were not declared as work-related, confidential or personal. The DPA found that all emails on a work email account constitute the personal data of the employee (whether current or former), including emails related to work activity. The employer had no right to pre-scan these emails when providing them in the context of an Art. 15 GDPR request. Additionally, the controller had retention periods for backups of employees' email accounts and browser logs that were too long, and the process was too opaque.