Autotrasporti Cuccu Riccardo S.r.l. – €50,000 Fine (Italy, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Italian auto repair shop was fined for tracking its employees' locations without informing them. This is significant because it shows that companies must be transparent about how they use tracking technology.
What happened
The shop installed a geolocation system in company cars without informing employees about it.
Who was affected
The employees whose locations were tracked without their knowledge.
What the authority found
The data protection authority found that the shop violated several GDPR rules by not being transparent about the geolocation system.
Why this matters
This ruling serves as a warning to businesses about the need for clear communication regarding tracking technologies. Companies must inform employees about any monitoring practices to comply with privacy laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject advanced a complaint before the DPA against the controller, an auto repair shop. The controller was their former employee and the complaint concerned the presence of a geolocalisation system installed in the company cars assigned to them. Such geolocalisation system was installed by the controller without informing their employees. The DPA started an investigation, which revealed that, when accessing the platform to verify the safeguards in place in the system, the company cars were traced on the map through their plate numbers, which were in turn linked with the name and surname of the employee driving that car. Moreover, the DPA found that the data, namely name and surname, sometimes did not belong to the driver but rather to any employee to which each car was assigned to. Therefore, sometimes a different employee could be driving the work car assigned to another employee. In addition, the investigation revealed that some documentation was acquired relating to the contract signed with another company through a geolocation system registered under “TIM Your Way”. Thus, in light of the above, the DPA considered “TIM Your Way” the processor as per Article 28 GDPR. Violation of Article 5(1)(a) and 13 GDPR The DPA found that the privacy policy of the controller was completely unable to represent the data processing that happened when the geolocalisation system was in place. Additionally, the privacy policy did not mention at all how the data processing through the geolocalisation system took place. Especially, while the controller shared that identification of the driver takes place by means of a satellite system that recognises the pseudonymised ID of the user by means of a company badge, it appears that the examination of the documentation acquired in the course of the investigation has shown that the geolocation system in use allows the acquisition of location data, telemetry and other nature by means of on-board equipment equipped with GSM/GPRS m
Related Enforcement Actions (0)
No other enforcement actions found for Autotrasporti Cuccu Riccardo S.r.l. in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
16 January 2025
Authority
Garante per la protezione dei dati personali
Fine Amount
€50,000
GDPRhub ID
gdprhub-9069About this data
Cite as: Cookie Fines. Autotrasporti Cuccu Riccardo S.r.l. - Italy (2025). Retrieved from cookiefines.eu
Last updated: