SWG S.p.A. – €15,000 Fine (Italy, 2023)

On July 03, 2020, the data subject told their employer, the controller, about their desire to terminate the employment contract. In a consensual agreement, they decided that the contract would end on July 31, 2020. That same month, the processor, which managed the information systems for the controller, carried out a technical inspection to ensure the secure transmigration of data after the logistical transfer of the controller's headquarters. During the inspection, the processor identified a massive download of around 600 files from its servers and verified it was done through the data subject's business account. The processor communicated the fact to the controller who determined the blocking of the data subject's access to the servers as well as to their business email. Dissatisfied, the data subject filed a complaint with the Italian DPA, claiming that, still during the course of the employment contract, the credentials to access their professional email were changed, which made it impossible for them to access their own personal data. On its turn, the controller argued that it had a legitimate interest in preserving business secrecy and avoiding data breaches. In addition, it claimed that the business account could only be used for work-related activities, not for private purposes, pursuant to internal regulations. After ascertaining the facts, the Italian DPA found that the internal regulations did not expressly provide for carrying out inspections aimed at verifying compliance with the company's rules. Therefore, it held that the controller violated Article 13 GDPR by failing to inform the data subject in advance about the specific the purposes and methods of internal controls as well as of the possibility of blocking employees' access to their business accounts. Moreover, the DPA stated that informing employees about personal data processing activities constitutes an expression of the fairness principle provided for by Article 5(1)(a) GDPR, which was als