Duyurular

The Italian Data Protection Authority Fines an Entity €460,000 Over Unlawful Employee Email Monitoring and Retention

A decision ("Decision") concerning the conclusion of proceedings conducted by the Italian Data Protection Authority ("Authority") in relation to an entity acting as a data controller ("Controller") concerning the processing, retention and monitoring of employees' corporate email data has been published.

The Decision highlights, in summary, the following:

  • The proceedings, conducted under the General Data Protection Regulation ("GDPR") and the relevant Italian data protection and labor law framework, concerned, among other matters, the Controller's failure to respond within the applicable statutory period to former employees' requests for confirmation that their individualized corporate email accounts had been deactivated, the systematic retention of corporate emails and related logs, and the retrospective examination of historical correspondence in the context of "defensive controls".
  • The Authority determined that Articles 12(3) and 17 of the GDPR had been infringed, as the Controller failed to provide a timely and reasoned response to the former employees' requests concerning the deactivation of their individualized corporate email accounts. The Authority further found that the Controller had unlawfully processed and examined employee email data, including correspondence predating the emergence of the specific suspicion that gave rise to the internal investigation. In this respect, the Authority found that the processing lacked an appropriate legal basis under Article 6 of the GDPR and infringed the principles of purpose limitation (Article 5(1)(b)), data minimisation (Article 5(1)(c)) and storage limitation (Article 5(1)(e)).
  • The Authority also found violations of the transparency principle under Article 5(1)(a) and the information obligation under Article 13 of the GDPR, as the Controller had not adequately informed employees of the purposes and legal bases applicable to the retention of emails and related logs. Furthermore, the processing was found to have been carried out in violation of Article 88 of the GDPR and Article 114 of the Italian Data Protection Code, which incorporates the safeguards applicable to employee monitoring under Italian labor law.
  • As a result of these infringements, the Authority imposed an administrative fine of €460,000 on the Controller.
  • In addition, pursuant to Article 58(2)(f) of the GDPR, the Authority prohibited the Controller from accessing the content of email data unlawfully collected and retained on its corporate systems.
  • Accordingly, the proceedings were concluded with the imposition of an administrative fine and a corrective measure prohibiting access to the unlawfully collected and retained email data.

You can access the full text of the Decision here.

 

                                                                                                           Kind regards,

                                                                                                 Zumbul Attorneys-at-Law

                                                                                                        info@zumbul.av.tr

 

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.