Cosmint S.p.A. – €6,600 Fine (Italy, 2026)

The case involves a worker (the data subject), his former employer (the controller), and the staffing agency that had provided the company with the worker. In late 2023 the data subject learned that its working relationship with the controller would soon end. The data subject called in sick and did not show up to work again. When his contract ran out, some of his belongings were still in a locker in its workplace. Over the month of January, the data subject booked and annulled several appointments with the controller to empty his locker. In this phase, communications between the controller and the data subject were mediated by the staffing agency. Eventually, the controller opened and emptied the locker. The opening took place the day before the last planned appointment and roughly one month since the data subject had last worked for the controller. A collaborator of the controller (specifically, a member of the external security staff) recorded the opening of the locker with her personal smartphone, in order to defend the controller from possible claims over missing items. Inside the locker, the controller found some of its own products which could no longer be sold, along with personal items of intimate use which could not be preserved due to hygiene concerns. All the contents were destroyed. The data subject later learned that the controller had opened his locked and filed a complaint. He claimed that the opening of its locker constituted an unlawful processing of his personal data. In its defense, the controller protested that the content of the data subject’s locker, did not constitute personal data as defined under Article 4(1) GDPR. The controller also put forward the alternative argument that the emptying of the locker, did not fall under Article 2(1) GDPR (i.e.: it was neither an automated processing of personal data, nor a non-automated processing of personal data “which form part of a filing system or are intended to form part of a filing system”). Finall