Italy

Liguria Health Protection Authority

6,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-28.

Rank · Sector

#123

of 215 in Employment

Rank · Italy

#362

of 573

Rank · All fines

#1,697

of 3,106

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-28
Controller / Processor: Liguria Health Protection Authority
Sector: Employment
Quoted Articles: Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 88 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 6000 on the Liguria Health Protection Authority. The controller launched disciplinary proceedings against one of its employees, the dta subject, who was employed as a driver by the controller. In these proceedings, the controller elleged, that the data subject had missused the car given to them for the purposes of their work, using GPS dta collected through the cars tracking system. Although the authority noted the necessity of a GPS system for vehicles transporting hazardous materials, the interval was deemed to short and enabled the controller to fully reconstruct the data subjects driving.

Open original source Links to the regulator's original publication or another source.