Garante per la protezione dei dati personali (Italy) - 585/2026
Italian DPA fines company €20,000 for GDPR violations related to employee access requests and GPS data.
The Italian Data Protection Authority (Garante) fined a company €20,000 for failing to properly respond to two employee access requests and for not informing employees about the processing of their vehicle's GPS data. The company argued the requests were related to labor law defense, not GDPR, and that GPS data was only for fleet management. The DPA found these defenses insufficient.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis case highlights two compounding GDPR failures: the company did not properly respond to employees' data subject access requests (DSARs), and it failed to transparently inform employees that their vehicle GPS data was being collected and processed. Dismissing DSARs as 'labor law matters' rather than GDPR obligations is a common but costly misunderstanding — the GDPR applies regardless of the underlying business context. GPS tracking of employees is particularly sensitive personal data that requires clear, upfront disclosure in privacy notices. This case demonstrates that inadequate transparency and unresponsiveness to data rights are independently enforceable violations, not minor procedural oversights.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.