La Patria S.p.A.

Summary

The Italian DPA has imposed a fine of EUR 39,000 on La Patria S.p.A. In 2022, an employee of the controller faced disciplinary charges and was subsequently dismissed for just cause. Following the dismissal, the data subject requested all data relevant to the case, including the GPS data from company vehicles. The controller did not comply with this request and later used the GPS documentation and an investigator's report in court. The company stated that the data subject's requests were being made under employment law and were too vague. However, the authority dismissed this argument, stating that no specific form is required for requests under the GDPR. Furthermore, the company did not adequately inform its employees about the processing of personal data. Following the investigation, the controller appointed a new DPO, adopted several measures to ensure compliance, and informed its employees about the processing of personal data.