Background information
- Date of final decision: 21 May 2025
- National case
- Controller: Autostrade per l’Italia spa
- Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 88
- Decision: Administrative fine
- Key words: Administrative fine, Consent, Lawfulness of processing, Unsolicited communication
Summary of the Decision
Origin of the case
The Italian Supervisory Authority (SA) - Garante action followed the complaint of an employee who had reported the company's use of content extracted from her Facebook profile and private chats on Messenger and WhatsApp to justify disciplinary proceedings against her.
Key Findings
In justifying the sanction, the Italian SA pointed out that once the private nature of the conversations and comments - published, inter alia, in digital environments with restricted access - had been established, the company should have refrained from using them. The use of such information, in fact, violated the principles of lawfulness, purpose and minimisation laid down in the privacy legislation. The Italian SA also reiterated that personal data present on social networks, or in any case accessible online, cannot be used freely and for any purpose, just because they are visible to a more or less wide audience of people.
Moreover, even in the context of disciplinary activity, the employer is required to balance this power correctly with the fundamental rights and freedoms accorded to the persons concerned. The purpose principle, the Italian SA recalled, requires that data be collected for specific, explicit and legitimate purposes, and processed in a manner consistent with those purposes. Therefore, the use in the disciplinary proceedings of messages exchanged on private channels of communication occurred in violation of the secrecy and confidentiality of the correspondence, thus in the absence of a regulatory basis.
Decision
The Italian SA found that the processing carried out by Autostrade per l'Italia Spa was unlawful in relation to Articles 5(1)(a), (b) and (c), 6 and 88 of the Regulation and Article 113 of the Italian data protection Code and ordered the company to pay the sum of EUR 420 000 as a fine for the infringements.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.