Italy

Liguria Health Protection Authority

6,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-28.

Rank · Sector

#125

of 223 in Employment

Rank · Italy

#393

of 623

Rank · All fines

#1,778

of 3,267

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-28
Controller / Processor: Liguria Health Protection Authority
Sector: Employment
Quoted Articles: Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 88 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 6000 on the Liguria Health Protection Authority. The controller launched disciplinary proceedings against one of its employees, the dta subject, who was employed as a driver by the controller. In these proceedings, the controller elleged, that the data subject had missused the car given to them for the purposes of their work, using GPS dta collected through the cars tracking system. Although the authority noted the necessity of a GPS system for vehicles transporting hazardous materials, the interval was deemed to short and enabled the controller to fully reconstruct the data subjects driving.

Open original source Links to the regulator's original publication or another source.