Cybersecurity Policy Report, Unlawful Processing of Employee Data Results in Fine for Italian Firm, (Jun 26, 2025)
By Tony Foley
Garante, the Italian data protection authority, has fined motorway maintenance company Autostrade per I’Italia Spa 420,000 euros ($492,000) over improper processing of an employee’s personal information later used to justify the employee’s termination.
Garante’s decision was issued in May and announced yesterday in an agency newsletter. It said it issued the fine after investigating a complaint by the employee, who reported the company’s use of content extracted from her Facebook profile and private chats on Messenger and WhatsApp. The investigation revealed that among the contents used were quoted excerpts of comments and photo descriptions.
Garante’s order found that Autostrade used the content at issue without a valid legal basis, through screenshots provided by some of the employee’s colleagues and a third party, present among the employee’s “friends” on Facebook and active in her private Messenger and WhatsApp conversations. In addition, Garante found that the communications concerned opinions and exchanges that took place in contexts unrelated to the employment relationship and not relevant for the purposes of assessing professional suitability.
Specifically, Garante held that once the private nature of the conversations and comments, published in a digital environment with limited access, had been ascertained, Autostrade should have refrained from using them. The use of the information violated principles of lawfulness, purpose and data minimization under the European Union’s General Data Protection Regulation (GDPR), it said.
Garante added that, even in the context of disciplinary action, employers are required to balance their power to impose disciplinary measures against the fundamental rights and freedoms of the data subject. The GDPR purpose principle requires that data be collected for specific, explicit, and legitimate purposes and processed in a manner consistent with those purposes.
In imposing the fine, Garante said it considered both the seriousness of the violation and the company’s annual turnover.
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR