Geico S.p.A. – €40,000 Fine (Italy, 2023)

GEICO S.p.A., the controller, was the employer of the three data subjects in this case. Two of the three data subjects resigned at the end of March 2019, the third data subject resigned at the end of May 2019. Their email accounts were deactivated shortly after their respective end of employment. However, the controller did not archive them, meaning they still had access to their email accounts and redirected them to a different account. The data subjects noticed that someone was repeatedly accessing their email accounts even after termination of their employment contracts thanks to an automated security notification system. The data subjects claimed that this constituted a violation of the GDPR, as they had not been informed about such access and thus submitted a complaint to the Italian DPA. The DPA asked for clarification on the matter from the controller. In its submissions, the controller argued that accessing the data subjects' e-mail accounts was necessary for gathering information for a separate lawsuit against them as they showed suspicious behaviour that could have potentially harmed the controller. The controller also explained that this was an exceptional circumstance and such processing was necessary in order to protect the controller’s rights in connection with the separate lawsuit. The controller also noted that the data subjects were informed in several communications about the company operating procedures and policies regarding - amongst others - IT tools and services. The controller stated that these policies were made known to the data subjects in these communications. The DPA held that the controller breached the principle of fairness and transparency pursuant to Article 5(1)(a) GDPR as the disseminated communications did not include any information on the processing operations carried out by the controller after the end of employment. Additionally, third parties were made to believe that the accounts of the data subjects were no longer acti