Myndoor S.r.l. – Violation Found (Italy, 2026)

Myndoor S.r.l. (the controller) is a workplace consulting company. The controller offers a plug-in system that carries out sentiment analysis of messages exchanged by employees (data subjects) that activated the plug-in. The system used AI to analyse the content of messages sent between data subjects in order to assess their stress levels, and generated a report on a weekly basis. The DPA initiated an ex-officio investigation following press reports on the controller. During its investigations, the controller stated that it currently only provided the service to one company, and that the report was only compiled if a minimum number of data subjects used it. In addition, the controller argued that the report covered the entire workforce of a company to prevent employees from being identified. Finally, the controller argued that the system only processed information provided by the data subject (such as names and contact information), and that sensitive and usage data was anonymised. The DPA first clarified that the company providing the system acted as a controller in relation to the data subjects, and not the employers who purchased the system. According to the DPA, employers are technically prohibited from accessing the data processed by the controller to provide the service, and would in any case lack the valid legal basis to do so under the GDPR. While employers can receive reports of the data subjects’ stress levels, the DPA concluded that the employer in question did not have sufficient information to identify the data subjects involved.The DPA compared this to employers entering into a contract for the provision of benefits and services to employees (such as health insurance or access to psychological counselling services). The DPA also emphasised that the controller has the obligation to comply with the GDPR from the design phase (Article 25 GDPR). In addition, the controller must comply with national provisions that prohibit employers from collecting data that is irrelevant to work activities ([https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 113 of the Code]). If this provision is not complied with, the processing is not lawful under Article 88(2) GDPR. The DPA also noted that the controller must also comply with [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng Article 5(1)(f) of the AI Act], which expressly prohibits the use of AI systems to infer the emotions of a data subject in the workplace. The DPA highlighted that AI systems can generate further inferences in relation to the data originally processed that may not be understandable or verifiable. Therefore, aspects such as model reliability, quality of the data, transparency and explainability are essential conditions to prevent processing activities that are invasive and non-compliant with the GDPR. It is also essential that companies take a prudent approach when adopting AI systems. The DPA did not find a violation of the GDPR, as the controller did not transfer the data to employers, and the company that received the report was unable to identify specific data subjects. However, the DPA issued a warning, as it could not rule out that the processing activities were likely to infringe the GDPR in the future. The DPA was concerned of the possibility that companies and entities could, in the future, identify data subjects from the reports provided by the controller. This would result in a violation of Articles 5, 6, 9, 24, 25 and 88 GDPR, and [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 113 of the Code]. Therefore, the DPA ordered the controller to implement measures to prevent it from disclosing data from data subjects to their employers in any way, even indirectly.