Piaggio – €460,000 Fine (Italy, 2026)

Two former employees (the data subjects) of Piaggio (the controller) were dismissed for just cause in March 2023. Following the termination of their employment, they asked the controller to confirm that the individualised corporate email accounts assigned to them had been deactivated. The controller did not respond within the one-month deadline under Article 12(3) GDPR and they reiterated their request. The controller again did not respond within the statutory period and the data subjects lodged complaints with the Italian DPA (Garante). The data subjects also filed subsequent complaints arguing that the controller had accessed their previous email correspondence and used the messages in the disciplinary proceedings against them. They alleged that the controller had collected at least 18 emails sent or received through one data subject’s account, dating from November 2020 to January 2022, and 94 emails sent or received through the other data subject’s account, some dating back to April 2020. The correspondence also included emails exchanged with personal email accounts and third parties. The controller stated that, following internal reports received in November 2022 concerning possible serious misconduct by the two data subjects, it decided to conduct an internal investigation. The controller characterised these checks as “defensive controls”, namely targeted checks intended to verify suspected serious unlawful conduct by the employees and to protect corporate assets. According to the controller, the investigation was limited to their corporate email accounts, used predefined filters and keywords and was conducted following a balancing assessment and consultation with its DPO. It maintained that the investigation constituted a defensive control intended solely to investigate possible unlawful conduct and protect corporate assets, not to systematically monitor its employees. The controller further relied on its internal policy, which mentioned that all messages sent