Sicurnet Liguria – €8,000 Fine (Italy, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Italian company was fined for failing to delete a former employee's email account after their employment ended. This is important because it shows that companies must respect employees' rights to have their personal data deleted.
What happened
The company did not respond to requests from a former employee to delete their email account and kept it active for months.
Who was affected
The former employee who requested the deletion of their email account.
What the authority found
The data protection authority ruled that the company violated GDPR rules by not responding to the employee's deletion requests.
Why this matters
This case highlights the importance of respecting employees' rights regarding their personal data. Companies must ensure they have processes in place to handle data deletion requests promptly.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject is an employee of Sicurnet Liguria s.r.l., the controller. After their employment relationship with the controller terminated on 30 September 2021, the data subject sent two requests to the controller on 7 and 9 June 2022, asking for the deletion of his company email account, pursuant to Article 17 GDPR. In the request of 9 June 2022, the data subject also asked to receive any messages received from 1 October 2021, including those not strictly related to their previous work activities. The controller did not respond to these requests. Thus, the data subject advanced complaint before the DPA. Only after the DPA's intervention on 9 March 2023, the controller replied on 8 June 2023, stating that the account had been deactivated. The controller claimed it had not processed any personal data of the data subject and that the inclusion of the data subject's initials in the email address was not a relevant element for the application of the GDPR. In further communications with the DPA, the controller admitted that, after the employment termination, it kept the data subject's email account active and implemented an automatic system to forward incoming emails to a different, constantly-monitored company address. The controller could not specify the exact date when the account was finally deleted, but acknowledged it remained active at least until the data subject's requests in June 2022, approximately nine months after employment termination. The DPA found multiple violations of the GDPR by the controller. First, the DPA held that the controller violated Articles 12, 15, and 17 GDPR by failing to respond to the data subject's requests to exercise his rights. The controller did not provide any response within the one-month time frame established by Article 12(3) GDPR, nor did it communicate to the data subject any reasons for denying the requests as required by Article 12(4) GDPR. The DPA referenced the [https://www.edpb.europa.eu/system/files/2023-04/edpb_
Related Enforcement Actions (0)
No other enforcement actions found for Sicurnet Liguria in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
16 January 2025
Authority
Garante per la protezione dei dati personali
Fine Amount
€8,000
GDPRhub ID
gdprhub-9031About this data
Cite as: Cookie Fines. Sicurnet Liguria - Italy (2025). Retrieved from cookiefines.eu
Last updated: