Michael Page International Italia s.r.l.
GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-08-06.
Case details
- Authority
- Italian Data Protection Authority (Garante)
- Date
- 2026-08-06
- Controller / Processor
- Michael Page International Italia s.r.l.
- Sector
- Employment
- Quoted Articles
- Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 88 GDPR
- Type of violation
- Non-compliance with general data processing principles
Summary
The Italian DPA has imposed a fine of EUR 225,000 on Michael Page International Italia s.r.l. Three former employees complained that their email accounts with the controller remained active after they were terminated in 2021. Initially, the controller claimed that the accounts had been disabled; however, they later stated that the accounts had to be kept active in order to prove unfair competition by the employees. The authority found that the accounts had been active until 25 September 2023, during which time the controller had accessed their contents and hired an IT consultant to extract data from them. Furthermore, it was found that the controller's privacy policy did not adequately inform employees about the processing activities regarding their email accounts.