Italy

Autostrade per l’Italia S.p.A.

420,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2025-05-21.

Rank · Sector

of 213 in Employment

Rank · Italy

#45

of 543

Rank · All fines

#261

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2025-05-21
Controller / Processor: Autostrade per l’Italia S.p.A.
Sector: Employment
Quoted Articles: Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 88 GDPR,
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 420,000 on Autostrade per l’Italia S.p.A. The controller used data from a worker's social media profiles obtained by other workers and a third party in a disciplinary proceeding. The controller did not have a legal basis to use this data.

Open original source Links to the regulator's original publication or another source.