Go to Wolters Kluwer VitalLaw.comGo to Wolters Kluwer VitalLaw.com
VitalLaw®
  • Find answers to your questions
  • Log in to access your subscriptions
In depth. On point.
In depth. On point.
  • Home
  • Legal Directory
  • Home
  • Legal Directory
In depth. On point.
  • Articles
    • Articles
  • Organizations
    • Organizations
    • House Cyber Panel Leaders Seek Briefing on OpenAI’s Misbehaving AI Models
    • Bicameral Bill Would Extend Privacy Protections for OPM Data Breach Victims
    • Cyber Coalition Seeks Robust Federal Response After Water System Hacks
    • Italian Employer Fined Over Improper E-Mail Monitoring
    • Organizations Should Have Plans for Ransomware Attacks, Dutch Agency Advises
    • Platform for Data Broker Opt-out Requests Becomes Operational in California
    • Sixth Circuit Grants En Banc Review in Challenge of FCC’s Data Breach Order
    • Supreme Court’s Slaughter Ruling Prompts Request for Review of EU-U.S. Data Transfers
    • The Week in State Privacy and Cybersecurity Legislation—July 2026
  • Articles
    • Articles
  • Organizations
    • Organizations

    Cybersecurity Policy Report, Italian Employer Fined Over Improper E-Mail Monitoring, (Aug 3, 2026)

    By Tony Foley

    In its July 29 biweekly newsletter, Garante, the Italian data protection authority, announced that it had fined motor vehicle manufacturer Piaggio & C. S.p.A 460,000 euros ($530,000) over violations of the European Union’s General Data Protect ...

    By Tony Foley

    In its July 29 biweekly newsletter, Garante, the Italian data protection authority, announced that it had fined motor vehicle manufacturer Piaggio & C. S.p.A 460,000 euros ($530,000) over violations of the European Union’s General Data Protection Regulation (GDPR) associated with its management of company e-mail accounts.

    Garante’s decision, issued June 18, resulted from an investigation initiated by Garante following complaints from two former employees of Piaggio. The investigation revealed that the company had accessed the employees’ e-mails during their employment, acquiring more than 100 such e-mails, to look into alleged illicit behavior. In some cases, the acquired e-mails dated back to about two years before the company became suspicious.

    Garante said the monitoring was made possible by Piaggio’s systematic collection and storage of e-mail data performed through backups of the entire duration of the employment relationship and up to five years after termination, as well as related logs for a period of six months, which Garante found violated the principles of both the GDPR and the Italian employment law. Specifically, Piaggio failed to respond to employees’ requests regarding deactivation of their corporate e-mail accounts after their termination, improperly accessed and collected e-mails from corporate accounts for disciplinary purposes, and retained e-mail content for longer than permitted without a proper legal basis under the GDPR.

    While noting that Piaggio subsequently reduced its standard retention period from five years to three months after an employee’s termination and reduced the period for which it retains e-mails logs, Garante concluded that its processing of the complainants’ e-mail data remained unlawful. In addition to the fine, Garante prohibited Piaggio from accessing the content of the data collected and stored on its company systems related to corporate e-mail.

    News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR

    © 2026 CCH Incorporated and its affiliates and licensors. All rights reserved.

    • Manage Cookie Preferences
    • Privacy Statement
    • Terms of Use