Italy

Depac Società Cooperativa Sociale a r.l.

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-02-26.

Rank · Sector

#79

of 213 in Employment

Rank · Italy

#239

of 543

Rank · All fines

#1,225

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-02-26
Controller / Processor: Depac Società Cooperativa Sociale a r.l.
Sector: Employment
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 30 GDPR, Art. 35 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 15,000 on Depac Società Cooperativa Sociale a r.l. The controller used two fingerprint devices to track the arrival and departure times of six employees working for a public contractor. The controller had no legal basis for this processing.

Open original source Links to the regulator's original publication or another source.