Italian DPA Fines Employer €6,600 for Unlawfully Accessing Former Employee's Locker

A company in Italy was fined €6,600 after opening and emptying a former employee's personal locker without their presence or consent, an act the Garante ruled constituted unlawful personal data processing under GDPR. The root failure was the organization's lack of clear policies governing how personal belongings and associated data are handled during and after employment termination. This case illustrates that 'personal data' extends beyond digital records — physical items stored by an employee can carry personal information subject to GDPR protections. Organizations that fail to apply lawfulness, transparency, and data minimization principles to offboarding processes expose themselves to regulatory penalties even in seemingly routine operational tasks.

Tactical Insight

Immediate actions

Establish a written, GDPR-compliant offboarding procedure that covers the handling of all employee property, including physical lockers and personal effects.
Ensure former employees are notified in advance and given the opportunity to be present — or represented — when personal storage areas are accessed.

Long-term improvements

Train HR and facilities management teams on GDPR obligations, emphasizing that personal data extends to physical items and spaces.
Implement a documented retention and return policy for employee belongings that defines lawful bases and required transparency steps.
Conduct periodic audits of offboarding practices to verify compliance with data protection policies.

Governance & oversight measures

Assign a Data Protection Officer (DPO) or designated privacy lead to review and approve offboarding procedures before implementation.
Maintain records of all actions taken on former employee property as part of your Article 30 processing activity records.