Ambiente 2000 S.r.l. – €20,000 Fine (Italy, 2024)

The controller asked the data subject for access to the latter`s work computer. The data subject stated that the computer contained personal data and communication. Subsequently, the data subject asked the controller, with two emails, why the manager asked some technicians to inspect, outside of work hours and without any employee present, the personal data stored inside the work computers. After receiving no answer to this email, the data subject further requested to exercise her right to erasure under Article 17 GDPR, and to deactivate and delete all email accounts used to avoid collection, the memorization and the indiscriminate minute check of any email received on those account. Violation of Article 12 and 17 GDPR due to the lack of reply to the data subject´s access and erasure request The investigation revealed that the controller programmed the installation of a document-management software. When installing the software, the controller asked the service provider to activate an email inbox dedicated to the aggregation of incoming company mail by activating the forwarding of mailboxes to the latter. Nevertheless, after a couple days, the controller asked the software provider to close the email inbox and set it up for erasure. Thus, the controller claimed that no personal data of employees was accessed or stored in connection with the setting up of that email inbox. Moreover, the controller claimed that the erasure of the data subject´s data was communicated orally to the data subject. Violation of Article 5(1)(a) and (c) GDPR due to the use of IT tools by the company leading to the systematic gathering and memorizing “internet surfing placeholders” The controller adopted an internal policy to correctly using the IT tools of the company that included the systematic gathering and memorizing “internet surfing placeholders”. More specifically, in relation to the email inboxes, personal data is stored for 30 days and, subsequently, the data is stored on an ex