Garante per la protezione dei dati personali (Italy) - 10143261

Garante per la protezione dei dati personali - 10143261

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1) GDPR Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6 GDPR Article 88 GDPR Art. 113 d. lgs. 196/2003
Type:	Complaint
Outcome:	Upheld
Started:	20.05.2025
Decided:	21.05.2025
Published:
Fine:	420,000 EUR
Parties:	Autostrade per l'Italia S.p.A. An unnamed employee
National Case Number/Name:	10143261
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	cci

The DPA fined Autostrade per l'Italia €420,000 for unlawfully processing an employee's personal data for disciplinary proceedings. The data included screenshots from the employee's social media account and private communications.

English Summary

Facts

Autostrade per l’Italia S.p.A. (the controller) is a private company that maintains a portion of the Italian highway system.

The controller received screenshots of Messenger and WhatsApp messages of an employee (the data subject) as well as screenshot of content she shared on Facebook. The controller used the information in disciplinary proceedings and fired the data subject.

The data subject filed a complaint with the DPA, claiming that her personal data were processed unlawfully.

Holding

The DPA held that the controller violated Articles 5(1)(a)(b)(c), 6, and 88 GDPR as well as Article 113 d. lgs. 193/2003.

The DPA issued a €420,000 fine. The DPA considered the controller’s infringement to be severe and noted that the controller had already been fined for violation related to the processing of employees’ data.

The employer processed personal data

The controller claimed that it did not process personal data because it merely received the information rather than collecting it. On the contrary, the DPA held that the use of the data in the disciplinary proceedings against the data subjects, constituted a processing of personal data. It did not matter that the controller did not actively collect the information.

The processing was unlawful and excessive

The DPA held that the controller processed personal data without a legal basis. In particular, the DPA rejected the argument that the processing was based on the controller’s legitimate interest in managing the employment relationship and exercising its powers as the employer, for several reasons.

First, the controller claim that it carried out a “balancing test” beforehand (i.e.: that it assessed whether its legitimate interest outweighed the interests and fundamental rights and freedoms of the data subject). However, it also failed to demonstrate this claim, as required by the principle of accountability (5(2) GDPR).

Second, the controller failed to demonstrate that the processing was necessary for the stated purpose. In particular, the DPA pointed out that the disciplinary proceedings did not revolve entirely around the screenshots but were based on other elements as well, including the data subject’s past behavior on the workplace. However, the controller did not even consider the option of bringing discliplinary proceedings without using the screenshots it received.

Finally, the DPA pointed out that under Italian labor law^[1], employers are not allowed to investigate any aspect of employee’s personal lives which are irrelevant to the employment relationship. In the case at hand, the DPA held that the controller violated this prohibition. Therefore, the DPA concluded that the data processing unlawful^[2] as well as excessive, in violation of Articles 5(1)(a)(b)(c) GDPR.

Comment

The DPA has consistently held that the principle of lawfulness of the GDPR must be interpreted in light of the domestic rules that limit the employer’s surveillance power (especially Article 8 l. 300/1970). If such rules are violated, then the principle of lawfulness of the GDPR is also violated: see for instance Garante per la protezione dei dati personali - provv. 10021491.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

SEE ALSO Newsletter of June 25, 2025

[web doc. no. 10143261]

Measure of May 21, 2025

Register of measures
no. 288 of May 21, 2025

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Dr. Claudio Filippi, Acting Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”);

HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”);

HAVING SEEN the complaint filed by Ms. XX against Autostrade per l’Italia S.p.A.;

HAVING EXAMINED the documentation in the files;

HAVING SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000;

REPORTER Dr. Agostino Ghiglia;

WHEREAS

1. The complaint against the Company and the investigative activity.

By complaint dated 20 May 2024, regularised on 30 July 2024, Ms. XX complained of alleged violations of the Regulation by Autostrade per l’Italia S.p.A. (hereinafter, the Company), with particular reference to the processing of certain personal data used by the local unit of XX to raise two disciplinary charges against the complainant.

In particular, the complaint alleged that the disciplinary charge of 16 February 2024, raised by the XX Management, contains, among other things, a reference to content taken from the complainant’s Facebook social network profile, published on 16 and 21 January 2024.

Furthermore, with the same act initiating the disciplinary procedure, the Company contested the complainant for having used, in her capacity as President of a private association (XX), the company email account to send an email to the Director of XX.

A subsequent disciplinary complaint dated 21 March 2024, raised by the same Directorate, contains excerpts of conversations held by the complainant with a third party on 8, 9 and 17 January 2024, via the Messenger messaging app.

The complaint also contains reference to content that the complainant allegedly conveyed to some colleagues (images taken from the Company's 2022 Sustainability Report accompanied by comments), via their respective profiles activated on the WhatsApp platform.

That said, the complaint alleged the unlawful processing of data relating to the complainant, also with regard to the use deemed "improper" of personal data taken from messages exchanged on WhatsApp and Messenger accounts and from the complainant's Facebook profile, for purposes related to the employment relationship.

The Authority initiated the preliminary investigation, with a note dated 3 September 2024, with which the Company was requested to provide information useful for assessing the case, pursuant to art. 157 of the Code.

The Company, in providing feedback to the request for information made by the Office, with a note dated 2 October 2024, stated that:

the Company “became aware of the contents (posts) of the employee, present in the Facebook profile, referred to in the dispute of 16/2/2024 by transmission to the offices of the Management of XX via Whatsapp message by a colleague (employee of ASPI) who is in a “friendship” relationship on the Facebook profile of the complainant. The communication reports the publication of the “contents” on the FB profile of the employee herself and contains a copy of the “screenshots” of the same contents” (note 2/10/2024, p. 2);

similarly the Company “became aware of the contents present in a conversation carried out by the employee with a “third party” on Messenger and whose conversation was directly “forwarded” via WhatsApp by the third party” (note cit., p. 2);

the Company “acquired the contents of the employee’s conversation with colleagues via a communication sent via WhatsApp by one of the colleagues themselves, an ASPI employee, to the offices of the XX Management” (note cit., p. 2);

“For all the above-mentioned processing, the legal basis of the processing was identified in the pursuit of the legitimate interest of the company as data controller pursuant to art. 6, par. 1, letter, f) of the Regulation […] to process personal data for the sole purposes of protecting its rights and exercising the prerogatives connected to the management of the employment contract” (note cit., p. 2);

in this last regard, the Company represented the existence of “defense rights” in relation to “the dispute concerning the challenge of the dismissal imposed as a result of the disciplinary disputes that are the subject of the complaint, a proceeding initiated by the employee before the Civil Court of Trani - Labor Section” (note cit., p. 2).

The Company also attached to the response a copy of the “Social media policy” and the “Management procedure for the management of company equipment made available to employees”, stating in this regard that “the existence of both documents [the Company itself] communicated at the time of their issue and entry into force” (note cit., p. 3).

Having learned of the existence of a dispute before the competent ordinary judge, concerning the challenge of the dismissal of the complainant imposed following the disciplinary disputes, the Authority proceeded to request, both from the complainant (with notes dated 9 and 23/12/2024) and from the Company (24/1/2025), a copy of the appeal presented before the Court of Trani, taking into account that pursuant to art. 140-bis of the Code "If the interested party believes that the rights he or she enjoys under the legislation on the protection of personal data have been violated, he or she may lodge a complaint with the Guarantor or appeal to the judicial authority. The complaint to the Guarantor cannot be lodged if, for the same subject matter and between the same parties, the judicial authority has already been approached [...]".
On 3 February 2025, the Company responded to the Authority by sending a copy of the appeal, presented pursuant to art. 414 of the Italian Code of Civil Procedure and of the defence brief presented by the Company in the proceedings initiated before the Court of Trani, Labour Section.

Following examination of the documentation produced in the files, the Authority considered that the case of lis pendens, provided for by the aforementioned art. 140-bis of the Code, was not applicable, since. in the specific case. between the complaint to the Guarantor and the appeal to the ordinary judge, the identity of petitum was not discernible.

2. The initiation of the procedure for the adoption of corrective measures and the Company's deductions.

On 3 March 2025, the Office notified the Company, pursuant to art. 166, paragraph 5, of the Code, of the alleged violations of the Regulation found, with reference to art. 5, paragraph 1, letter a), b) and c), 6 and 88 of the Regulation and art. 113 of the Code.

In the defense briefs sent on March 27, 2025, the Company represented that:

in this case, there was a lack of “an “active role” in such processing/collection activity, a profile on which […] the circumstance that the posts on Facebook and the conversations on Messenger and Whatsapp held by the worker “received” ASPI, and not sought by the Company or actively and directly collected on such platforms, can and must be considered undisputed.” (note 27/3/2025, p. 2);

in order to “assess whether personal data acquired in this way could or could not be used for disciplinary purposes,” the Company took into account the previous provision of the Guarantor of April 20, 2017, no. 202, web doc. no. 6552839, “confirmed by the Court of Turin with the ruling of 08.11.17 and then by the Supreme Court with ruling no. 15161/21” (note cit., p. 2);

“the statement according to which the “balancing test” in this case “does not appear to have been carried out” appears […] apodictic: in fact, there does not appear to be any element (documentary or otherwise) on the basis of which it was possible to arrive at this conclusion, given that, on the contrary, the Company carried out, through the competent corporate functions and its trusted external lawyers specialized in the matter at the time, a careful analysis and evaluation regarding the possibility of using the aforementioned data for disciplinary disputes also in light of the precedents mentioned above” (note cit., p. 3);

“there is no doubt […] that ASPI, in exercising its prerogatives of managing the employment relationship and assessing disciplinary conduct, at the time of the articulation of the disputes against the worker, had on the table various elements, and in particular also “facts additional” to those which were the subject of the complaints of the complainant. In this context, the theory according to which the Guarantor can be invested upstream with the task of evaluating among them which ones can be used, and which on the contrary should not have been used because they were “unbalanced” against the worker seems to integrate an overlapping of roles with outcomes that are, to say the least, questionable” (note cit., p. 3);

“The effect of what is presented as a virtuous application of the “balancing test” would therefore have been to prevent the employer from adopting the measure deemed most appropriate with respect to the conduct held by the worker” (note cit., p. 4);

in light of the previous provision of the Guarantor no. 202 of 2017 "What is reported in the notification of violations, therefore, is a change of direction which, in consideration of the position crystallized in the ruling of the Court of Cassation, in addition to not appearing to be well-founded, appears equally impeded by the nomophylactic scope of the ruling" (note cit., p.4);

“art. 8 L. 300/70 prohibits the employer “from carrying out investigations, even through third parties, on the political, religious or trade union opinions of the worker, as well as on facts that are not relevant for the purposes of assessing the professional aptitude of the worker”. The prohibition imposed by the provision of law therefore concerns “investigations” […] In essence, the investigation, in order to be such, implies an active behavior of the employer aimed at acquiring information that is not in the public domain, which evidently did not happen in the case in question given that […] the posts on Facebook and the conversations on Messenger and Whatsapp held by the worker “received” ASPI, and not sought by the Company or actively and directly collected on such platforms” (note cit., p. 4);

with reference to art. 10 of Legislative Decree 276/2003, the Company believes that “From a textual analysis of this provision it appears clear that the recipients of the same are – only and exclusively – employment agencies and other authorized or accredited public and private entities (as specified in art. 6 of Ministerial Decree 13/10/2004, “The prohibition under art. 10 of Legislative Decree no. 276 of 2003, applies to those who access the continuous national labor exchange”)” (note cit., p. 5);

with regard to the contested violation of the principle of purpose, the Company also believed that “This is equivalent to supporting the inadmissibility for disciplinary purposes of the opinions and comments expressed by the worker outside the pure perimeter of the work performance, transforming the principle of purpose affirmed by the GDPR into a sort of safe conduct for the worker” (note cit., p. 5-6);

“the Authority was able to establish that in this case the ne bis in idem principle pursuant to art. 140-bis of the Privacy Code could not be configured thanks to the collaboration provided by ASPI […]. Now, it appears clear that in substance we are risking violating that very principle here: if in fact it is stated that it is up to the Authority to ascertain that certain data could not be used for disciplinary purposes because they are disproportionate (in alleged violation of the principles of minimization and proportionality, as well as of the “balancing test” of legitimate interest), in fact the very dynamic that leaves any assessment of the validity and proportionality of the disciplinary dismissal to the Labour Judge is being altered” (note cit., p. 6);

with regard to the criteria for quantifying the sanction, “there are no previous relevant violations committed by the Company as data controller, nor have any measures pursuant to article 58, paragraph 2, been previously ordered against the same Company in relation to the same object” (note cit., p. 7);

“the Company provided maximum collaboration and actively cooperated with this Authority, even when it forwarded the claimant’s appeal to the Labour Court (an act which, in the physiological management of the proceedings, should obviously have been provided by the person who had presented it)” (note cit., p. 7);

“with regard to the other mitigating factors applicable to the circumstances of the case, without prejudice to the interpretative uncertainties already underlined several times regarding the application of the reference rules, it is finally highlighted that no financial benefits were obtained, directly or indirectly, as a consequence of the violation” (note cit., p. 7).

3. The outcome of the investigation and the procedure for the adoption of corrective and sanctioning measures.

3.1 The applicable regulatory framework.

The private employer may process the personal data of workers (Article 4, No. 1, of the Regulation), including those relating to “special categories”, as a rule, if the processing is necessary “for compliance with a legal obligation to which the controller is subject” or if it is necessary “for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures adopted at the request of the data subject” (Articles 6, paragraph 1, letter b) and c), and 2 and 3, and Article 9, paragraphs 2, letter b) and 4; 88 of the Regulation).

In the case of processing “common” data, the data controller/employer may carry out processing operations if this is necessary for the pursuit of a legitimate interest “provided that the interests or fundamental rights and freedoms of the data subject which require protection of personal data do not prevail” (Article 6, paragraph 1, letter f) of the Regulation).

The data controller is also required to observe the general principles of the matter, in particular those of "lawfulness, fairness and transparency", "purpose limitation" and "data minimization" (art. 5, par. 1, letters a), b) and c) of the Regulation).

In accordance with the principle of lawfulness of processing, the employer is required to comply with the more specific and more protective national rules relating to the processing of data in the context of employment relationships (Article 88 and paragraph 155 of the Regulation), and, in particular, the provisions that prohibit the employer from collecting, including through third parties, and further processing information on the political, religious or trade union opinions of the worker, as well as on facts that are not relevant for the purposes of assessing the professional aptitude of the worker (see Article 113 of the Code, “Data collection and relevance”, which refers to the provisions of Article 8 of Law No. 300 of 20 May 1970 and Article 10 of Legislative Decree No. 276 of 10 September 2003).

As a result of this referral, and taking into account the provisions of Article 88, paragraph 2, of the Regulation, compliance with the rules expressly referred to in Article 113 of the Code constitutes a specific condition of lawfulness of the processing, which is added to the obligations set out in Articles 5, 6 and 9 of the Regulation (see, Court of Justice of the European Union, judgments of 19/12/2024, case C 65/23 and 30 March 2023, case C-34/21).

3.2. Violation of the principles of lawfulness, purpose and minimization (Articles 5, paragraph 1, letter a), b) and c) and 6 of the Regulation).

Following the examination of the statements made to the Authority during the proceedings as well as the documentation acquired, it appears that the Company, as the controller, has carried out some processing operations, relating to the complainant, which are not compliant with the legislation on the protection of personal data.

In this regard, it is highlighted that, unless the fact constitutes a more serious crime, anyone who, in a proceeding before the Guarantor, falsely declares or certifies information or circumstances or produces false acts or documents is liable pursuant to art. 168 of the Code "False declarations to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor".

First of all, it is specified that the scope of the investigation activity carried out by the Authority concerns exclusively the profiles of protection of personal data assigned by the national and European legal system to the competence of the supervisory authorities (art. 57 of the Regulation; arts. 154 and 154-bis of the Code).

Consequently, even in this case, there is no alteration - as feared by the Company - of the distribution of the forms of administrative and judicial protection established by the legal system with specific reference to the verification of the lawfulness of the disciplinary dismissal imposed on the complainant, by the competent ordinary judicial authority.

On the merits, it emerged that the Company sent the complainant two disciplinary complaints, pursuant to art. 7, Law no. 300 of 1970. In the first complaint, dated 16 February 2024, the Company reported the content of some comments written by the complainant on her Facebook profile (on 16 and 21 January 2024), by inserting quoted excerpts of the comments and describing the content of some photos.

In the disciplinary complaint dated 21 March 2024, the Company also reported the content of a conversation that took place via a Messenger account between the complainant and a third party (who forwarded it to the Company via WhatsApp), not an employee of the Company, transcribing, in this case too, quoted excerpts of the conversation. Furthermore, in the same complaint, the Company reported quoted excerpts of a communication sent by the complainant, dated 22 February 2024, to some colleagues, via her WhatsApp account.

The Company, in order to raise the two disciplinary disputes that are the subject of the complaint, therefore used, in addition to the reference to further contested facts, the content of communications made by the complainant through her Facebook profile and the Messenger and WhatsApp messaging channels.

The use of such information relating to the complainant constitutes an activity of “collection” and subsequent further processing of data (in light of the definition of “processing” contained in art. 4, no. 2 of the Regulation, “any operation or set of operations, […], such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”).

In particular, the Company, after receiving - via WhatsApp communication - some screenshots taken from the Facebook profile and the Messenger and WhatsApp accounts of the complainant extracted by some participants in the communications, the transmission of which is therefore not attributable to the employer, decided to use them in the disciplinary proceedings, even without having directly taken steps to carry out searches on the social profile or instant messaging channels.

The absence of an “active role” of the Company in the search for information has no relevance for the purposes of identifying the activity consisting in the subsequent use in the disciplinary procedure as “processing”, as it constitutes only one of the possible manifestations (see in conformity Cass. civ., sentence 14/10/2014, n. 21107, according to which in light of the broad definition of processing of personal data “it must be recognized that the objective fact of the acquisition of information pertaining to [the] employee is sufficient in itself to make it possible to configure a data processing […], the methods and limits of which must be reconstructed taking into account the management of the employment relationship, for which the adoption of disciplinary measures is indisputably preordained”).

Having therefore ascertained that the Company has processed personal data relating to the complainant, taken from the Facebook profile and the Messenger and WhatsApp channels, it is then necessary to verify whether the processing in question was carried out in the presence of an appropriate legal basis, i.e. one of the conditions of lawfulness of the processing strictly indicated by art. 6 of the Regulation.

According to what was represented by the Company itself, the screenshots of the comments posted on the Facebook profile were communicated to the company by an employee who had a “friendship” relationship with the complainant on the well-known social network; from this it follows that the visibility of the contents conveyed on the profile was reserved for subjects in a “friendship” relationship with the complainant herself, who therefore intended to voluntarily and expressly exclude the generalized sharing of the comments, outside this circle of subjects.

This therefore entailed a legitimate expectation of confidentiality on the part of the complainant on the contents shared with a specific circle of recipients, given that it was a communication that took place in a chat, on a closed Facebook group, with the consequence that the use of such contents by a third party (in this case the employer) would necessarily have required a prior balancing of the rights and interests of the parties involved (see Cass. sez. lav., 10/9/2018, n. 21965, with regard to a chat on Facebook composed of members of a trade union: "the need to protect the confidentiality of communications is also required with regard to e-mail messages exchanged via mailing lists reserved for members of a specific group of people, newsgroups or private chats, with access conditional on the possession of a password provided to specific subjects"; "messages that circulate through new "forms of communication", where forwarded not to an indistinct multitude of people but only to members of a specific group"; group, such as in private or closed chats, must be considered as private, closed and inviolable correspondence”).

From a different, albeit connected, perspective, it is necessary to consider that the contents present on social networks, even in the section of the profile accessible to anyone, even if this were the case in this case, are made available by the interested parties for the purposes of interpersonal communication or expression of thought (see art. 21 of the Constitution and art. 1, law no. 300 of 1970, which constitutes its application in the workplace), purposes which are therefore distinct from those pursued by the owner/employer for the purpose of assessing the correct execution of the employment relationship, which includes the processing necessary for the execution of the contract (art. 6, par. 1, letter b) of the Regulation).

This does not prevent, according to general principles, each conduct from being subject to the limits set by the legal system (in particular, the freedom of expression must be balanced with the protection of honor and reputation as well as with the duty of loyalty pursuant to art. 2105 of the Civil Code and with the general obligation of correctness and good faith in the execution of the employment relationship, to be assessed also in light of the specific task performed).

For the above reasons, it is not possible to agree, in this regard, with what the Company has argued in its defense briefs, according to which the application of the principle of purpose, provided for by the legislation on the protection of personal data, would be transformed "into a sort of safe conduct for the worker, enabled by this interpretation to see his behavior legitimized for the sole fact of having aimed at his own "purposes".

Even in the exercise of the disciplinary power that characterizes the employment relationship, the employer is in fact required to carry out a correct balancing with the rights and freedoms recognized by the legal system to the interested parties.

The application of the purpose principle, in the workplace, therefore entails the need for the employer to collect data, relating to the data subjects, for "specific, explicit and legitimate purposes" and subsequently process them "in a way that is not incompatible with those purposes".

Therefore, in general terms, the data controller may use, for further processing, only the personal data lawfully collected, by virtue of an appropriate legal basis, after having "satisfied all the requirements for the lawfulness of the original processing", also taking into account the context in which the data were collected (see recital 50 of the Regulation), having regard to the original purpose and in compliance with the general principles of data protection.

Personal data published on social networks or, more generally, available online, cannot therefore be used indiscriminately and for any purpose, only because they are accessible to a more or less extensive number of people.

In this regard, the Authority has already established, in the past, in relation to a specific case relating to the workplace, that the publication of information by the interested party on a website, accessible by anyone, cannot in itself justify the processing of the same information, for the purpose of any other processing, given that it is, first of all, necessary to take into account the limits set by sector regulations applicable to the various matters (see Provv. 24/4/2024, n. 268, web doc. n. 10021491; on this point see Cass. 7 October 2014, n. 21107, cit., where it held that "the entry of some of one's personal data online, while leaving one to presume the interested party's will to allow their use in view of the objectives for which they were made available to the public, does not however allow one to consider that that consent was implicitly given also for the purpose of any other processing. The use of the data disclosed for purposes other than those for which they were made available to the public". from that for which its disclosure was permitted constitutes, moreover, an eventuality already taken into consideration by this Court, which has affirmed in this regard that the protection provided by Legislative Decree no. 196 of 2003 also extends to data that is already public or published, since the person who carries out processing operations on such information can obtain further information from their juxtaposition, comparison, examination, analysis, conjunction, relationship or cross-referencing, therefore an "informative added value", which cannot be extracted from the data considered in isolation, potentially damaging to the dignity of the interested party, a supreme value (protected by art. 3, first paragraph, first part, and art. 2 of the Constitution) which inspires the legislation on the processing of personal data (see Cass., 1st Section, 8 August 2013, no. 18981; 25 June 2004, no. 11864)"; on the limits of the use of data taken from social networks in the workplace, see also Working Party art. 29, Opinion 1/2017 on data processing in the workplace, points 5.1. and 5.2.; Recommendation CM/Rec(2015)5 of the Committee of Ministers to Member States on the processing of personal data in the employment context, par. 5).

In this regard, it is also recalled that the Guarantor, in relation to processing operations other than that covered by this provision although equally pertaining to the scope of the employment relationship, has declared the collection and use, by public administrations, of personal data or information already disseminated, or in any case available, including online, to be non-compliant with data protection legislation, given that such personal data, although known by anyone, can be processed and used by third parties, within the limits and under the conditions of the applicable sector laws and, therefore, also in compliance with the more specific and more protective provisions safeguarded by art. 88 of the Regulation with regard to the work context (see Provision 10/11/2022, no. 367, web doc. no. 9835095; Provision 10/2/2022, no. 45, web doc. 9751549; Provision 12/3/2020, no. 56, web doc. no. 9429218).

Finally, it should be noted that, in the same perspective, the Code of Conduct for the Employment Agencies sector, approved by the Guarantor with Provision 11/1/2024, no. 12, web doc. no. 9983584, where it provides that “The fact that a Candidate’s social profile is available to the public cannot generally be considered a prerequisite for the lawfulness of the processing of personal data contained therein. Before examining a potential Candidate’s social network profile, [employment agencies] verify that the social network is of a professional nature in order to verify the admissibility of the analysis of the same” (point 7.6. cit. code).

Even in the event of consultation of social profiles of a professional nature, therefore of a non-generalist nature, employment agencies are therefore required to adopt certain precautions to protect the interested parties, carrying out processing “limited only to information connected to the professional aptitude for work, necessary for the sole purpose of assessing the specific risks associated with the type of activity to be carried out by the Candidates, carried out in the least intrusive manner possible, adopting every necessary measure to ensure a correct balance between the legitimate interest of the APL in verifying the above and the fundamental rights and freedoms of the interested parties” (cit. code, point 7.7.).

In order to raise the two disciplinary charges against the complainant, the Company, as seen above, also used the contents of conversations made by the complainant, through her private accounts with a third party and with some colleagues, on Messenger and WhatsApp.

Also in relation to the processing of such data (and perhaps even more so, given the particular protection reserved by the legal system to correspondence and any other form of communication) the circumstance that the Company had knowledge of the conversations through the participants in the conversations themselves (therefore in the absence of an "active role") is irrelevant.

In fact, the legal system protects the freedom and confidentiality of communications, listed among the fundamental rights of the individual, establishing that any limitation can occur only "by reasoned act of the judicial authority with the guarantees established by law" (art. 15 of the Constitution).

The notion of correspondence and any other form of communication, moreover, refers to "any communication of human thought (ideas, intentions, feelings, data, news) between two or more specific people, implemented in a way other than face-to-face conversation", and therefore includes, given the state of available technologies, also the exchange of electronic messages such as e-mails, WhatsApp, SMS "and similar" (see Constitutional Court no. 170 of 27/7/2023, which, in accordance with previous decisions of the Court, confirmed that the guarantee established by art. 15 of the Constitution "extends [...] to any tool that technological evolution makes available for communication purposes, including electronic and IT tools, unknown at the time of the launch of the Constitutional Charter").

The same perspective characterizes the decisions of the European Court of Human Rights, with which, mostly in relation to treatments carried out in the workplace, they were deemed to be subject to the protection established by art. 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms communications carried out by means of instant messaging systems, telephony, electronic mail and SMS (see ECHR, Copland v. UK, 3.4.2007 (rec. no. 62617/00); Bărbulescu v. Romania [GC], 5.9.2017 (rec. no. 61496/08); Saber v. Norway, 17/12/2020 (rec. no. 459/18), relating to communications between lawyer and client; decisions recalled by Constitutional Court no. 170 of 2023 cited).

Finally, it should be noted that, with regard to the processing of data contained in a private chat between work colleagues created on the WhatsApp platform, carried out by the employer who had learned its content, on the initiative of one of the participants in the conversation, the Court of Cassation has finally held that the learning of the content of the aforementioned communication has resulted in conduct in violation of the right to secrecy and confidentiality of correspondence, given that "the guarantee of freedom and secrecy of private correspondence and the right to confidentiality in the employment relationship [constitute] safeguards of the dignity of the worker". Therefore, given "the scope and implications of the fundamental right to secrecy of correspondence", the fact that the message in the chat had not been learned by the employer "on his own initiative" cannot constitute a decisive element (see Corte Cass 28/2/2025, no. 5354).

Therefore, in light of the aforementioned protective status granted by the legal system to communications, the processing of personal data relating to the complainant and, in particular, of the messages exchanged by the latter with a person external to the company structure and with colleagues, carried out by the Company occurred in the absence of an appropriate legal basis (Article 5, paragraph 1, letter a) and 6 of the Regulation).

Nor, in this regard, can the Company's argument be accepted according to which the data processing would have been lawfully carried out, on the basis of its legitimate interest consisting in the "purposes of protecting its rights and exercising the prerogatives connected to the management of the employment contract".

Article 6, paragraph 1, letter f), of the Regulation, provides, with exclusive reference to the so-called data common, that processing may be lawfully carried out if it is “necessary for the purposes of the legitimate interests pursued by the controller […] “provided that the interests or fundamental rights and freedoms of the data subject do not prevail”. Therefore, the Regulation requires that the controller, before starting the processing, carry out a “balancing test” with the fundamental rights and freedoms of the data subject.

In this case, the Company stated in its defense briefs that it had “carried out, through the competent corporate functions and its trusted external lawyers specialized in the matter […], a careful analysis and evaluation of the possibility of using the aforementioned data for disciplinary disputes”.

However, first of all, this statement was not (as it should have been in application of the accountability principle) supported by any specific element relating to the content of the assessment that would have been carried out, taking into account that the balancing test, based on the indications provided at EU level, must consist of a complex assessment activity, carried out on the basis of a specific methodology adopted by the controller, taking into account that legitimate interest, given the objectively broad nature of the relevant concept, cannot be used as a “last resort” if other legal bases are not applicable (see European data protection board, Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, Version 1.0, Adopted on 8 October 2024, point 9; see Provv. 15/4/2021, n. 137, web doc. n. 9670738, point 3.2.).

Furthermore, it appears that the Company has not taken due account of the rulings adopted in this regard by the Court of Justice with regard to the assessment of the “necessity” of legitimate interest, in light of the general principle of minimization (see, with regard to the particular conditions in the presence of which the application of art. 6, par. 1, letter f), of the Regulation can be envisaged, OJEC, judgment 4/7/2023, Meta Platform and others, C-252-21, points 102-126, 12 where - among other things - it is clarified that the necessity of the processing for the achievement of the legitimate interest pursued must also be assessed in light of the principle of minimisation, given that the controller must verify that "the legitimate interest in the data processing pursued cannot reasonably be achieved equally effectively by other means which are less prejudicial to the fundamental rights of the data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter").

The Court of Justice has also repeatedly stated that, in accordance with what is indicated in recital 47 of the Regulation, the interests and fundamental rights of the data subject may prevail over the interests of the controller when the personal data are processed in circumstances in which the data subjects cannot reasonably expect such processing (see OJEU, judgment 4/10/2024, KNLTB, C-621-22, point 45), and in this case there seems no doubt that the interested party could not expect the employer to use the content of communications exchanged on her Messenger and WhatsApp accounts and content posted on her closed Facebook profile.

Above all, during the proceedings, it emerged that the Company did not take into consideration, following an objective assessment, the impact that the processing could have had on the rights, freedoms and interests of the interested party, in the terms indicated above, limiting itself to deriving the (deemed) legitimacy of the processing from the circumstance that third parties had provided the data then used to raise the disciplinary charges.

From a different perspective, the Company did not examine the possibility of exercising its "prerogatives connected to the management of the employment contract" through "other means less prejudicial to the fundamental rights of the interested parties", considering that the disciplinary charges referred to additional facts, with respect to the elements that are the subject of this complaint (in particular, and initially, the request for intervention by the State Police by the complainant on the occasion of the of the performance of “green works” by the Company between 16 and 17 January 2024).

All this, clearly, does not imply that the Guarantor, as argued in defense by the Company, is “invested upstream with the task of evaluating among [the facts deemed relevant for discipline] those that can be used, and those that on the contrary should not have been because they were “unbalanced” against the worker”, but only that it is up to the data controller, as argued in detail above, to carry out a preliminary assessment (proving it to the Authority during the control phase), based on the principle of accountability (art. 5, par. 2), regarding the lawfulness but also the adequacy, relevance and proportionality of the data processing that it intends to carry out, in application of the general principle of minimization and proportionality of processing (art. 5, par. 1, letter a) of the Regulation; art. 52 Charter of Fundamental Rights of the European Union European; in relation to the principle of proportionality, the Constitutional Court of 21/2/2019, no. 20, point 3.1, recalled that “The Court of Justice of the European Union has repeatedly stated that the needs of democratic control cannot overwhelm the fundamental right to privacy of natural persons, the principle of proportionality, defined as the cornerstone of the protection of personal data, must always be respected”).

In light of the above considerations, the conduct of the Company has therefore violated the principles of lawfulness, purpose and minimization pursuant to art. 5, par. 1, letters a), b) and c) and 6 of the Regulation, also given the unusability of the personal data processed in violation of the relevant legislation on the processing of personal data (see art. 2-decies of the Code), given that once it became aware that the data transmitted concerned private communications and comments on the closed Facebook profile, the Company should have refrained from using them.

3.2 Violation of art. 5, par. 1, letters a) and 88 of the Regulation and art. 113 of the Code.

A further aspect of unlawfulness of the data processing relating to the complainant collected from her Facebook profile and from conversations carried out on the Messenger and WhatsApp platforms, is related to the fact that the content of such information consists of opinions expressed and communications made in areas outside the employment relationship and therefore outside the scope relating to the evaluation of the professional aptitude of the worker.

In particular, the complainant - who held the position of "tax collector" at the XX motorway station - in the conversations carried out (on 8, 9 and 17 January 2024) via Messenger with a representative of the W.W.F. association expresses a difference of opinion with the latter, although referring to the evaluation of the Company's actions in a specific case ("Ciao Pasquale. But were you by any chance contacted by Autostrade for issues regarding turtles or animals?", "And where? Headquarters?", "So if I understand correctly, according to the WWF, placing nests on the ground on trees that have been unjustifiably felled is the solution to all evils", "I don't agree with you and I hope for the WWF that it wasn't a question of money": see disciplinary dispute of 21/3/2024).

Even the content of a comment sent by the complainant on February 22, 2024, via WhatsApp, to some colleagues does not appear to be relevant to the complainant's professional attitude ("I behave in line with what Autostrade wants from me and makes me read on the site in a transparent manner. Anyone who assumes the opposite is probably not in line or evidently has a lot to hide", in disciplinary dispute of 21/3/2024).

Finally, the comments posted on the complainant's Facebook profile on 16 and 21 January 2024, in which, however - as reported in the disciplinary complaint itself - the name of the Company is not mentioned, express the worker's opinions on environmental issues, again not pertinent to the performance of the work activity or to the professional attitude, also in light of the role performed by the latter (in particular, in support of a photo of felled trees, the comment reported was the following: "serial night-time felling of trees still in progress, on the access square to the XX motorway toll booth"; in a second post, in support of "two photographs depicting a motorway embankment", the comment reported was: "innocent trees used to live here", "extermination": see disciplinary complaint of 16/2/2024).

It is up to the data controller (the Company) to assess the existence of the conditions for the lawfulness of the processing of personal data (art. 5, par. 1, letter a) of the Regulation) and, in this verification of conformity, the more specific and more protective national provisions in the context of employment relationships indicated by art. 88 of the Regulation also fall within this scope.

Among the more specific provisions, art. 113 of the Code is included, which indicates, as a condition for the lawfulness of the processing, compliance with the provisions of art. 8 of law no. 300 of 1970 and art. 10 of Legislative Decree no. 276 of 2003.

The two provisions referred to in art. 113 of the Code have been significantly grouped together by the legislator in the section “Data collection and relevance”.

Already on the level of literal interpretation, therefore, it emerges that the prohibition for the employer to acquire and process information on the political, religious or trade union opinions of the worker, as well as on facts not relevant for the purposes of assessing the professional aptitude of the worker, also concerns the "collection" regardless of the method of data acquisition (which, as in the case in question, may be lawful), if it involves, after the acquisition of the information, also an activity of verification of the truthfulness and reliability of the information itself, intended for use in a disciplinary proceeding (in particular, in the case in question, the Company carried out a comparison of the screenshots of the Facebook posts of 16/1/2024, sent via WhatsApp by an employee in a "friendship" relationship with the complainant, with the service report of the State Police, received by the Company on 23/1/2024, relating to the telephone call made by the complainant, as well as the comparison between the forwarding of communications with a third party via Messenger, sent to the Company via WhatsApp message from the aforementioned third party, and the “tree felling operations” referred to in the disciplinary dispute).

Furthermore, even the systematic interpretation of the provisions referred to in art. 113 of the Code requires that such discipline cannot be considered inapplicable only because the employer/data controller did not play an “active” role in seeking information.

In fact, contrary to what the Company claims in its defense briefs, the reference to the content of art. 113 of the Code which identifies, as a condition for the lawfulness of the processing, both art. 8 of Law no. 300 of 1970 and art. 10 of Legislative Decree no. 276 of 2003, present in the notification of initiation of the proceeding by the Authority, cannot be considered irrelevant only because art. 10 cit. refers to the activities of intermediaries in the labor market.

This rule is in fact evidently connected to art. 8, l. 300/1970 as it constitutes its extension, following the creation of the open labour market, and the consequent need to adequately protect the confidentiality and dignity of the worker, in the face of the circulation of a significant amount of personal information (see Law 14/2/2003, no. 30, Delegation to the Government on employment and the labour market, art. 1, co. 2, letter g), which provides, among the principles and criteria of delegation, the "prevention of forms of social exclusion and supervision of operators, with the provision of an absolute ban on private and public operators from any investigation or in any way processing of data or pre-selection of workers, even with their consent", in relation to information referring to "trade union or political affiliation, religious belief, sex, sexual orientation, marital or family status, or pregnancy, as well as any disputes with previous employers", as well as the ban "on collecting, storing or disseminating information on workers that are not strictly related to their professional aptitudes and their job placement”).

This specific provision, therefore, constitutes an integral part of a system of protection of the privacy of the interested party, in the workplace, in the face of (significant) risks of discrimination which, starting from the original regulation of 1970, has implemented the Community directives on equal treatment and non-discrimination in the labour market (see Council Directive 2000/43/EC of 29 June 2000 implementing the principle of equal treatment between persons irrespective of racial or ethnic origin and Council Directive 2000/78/EC of 27 November 2000 establishing a general framework for equal treatment in employment and occupation, transposed into our legal system with Legislative Decree 9/7/2003, no. 216, Implementation of Directive 2000/78/EC on equal treatment in employment and occupation).

: The Guarantor, on the other hand, has already considered the violation of the rule to be integrated in the event of use, within the disciplinary procedure, of data relating to "special categories", taken from a dating website, acquired by the employer following a report by some employees (Provv. 24/4/2024, n. 268, web doc. n. 10021491, where it has established that "the information relating to the activities and behaviors undertaken by the employee, outside the performance of his duties and tasks, and not interfering, even indirectly, with the performance of the work, pertain to the private life of the worker, the protection of which is guaranteed by the regulatory framework at supranational level (see art. 8, par. 2, of the European Convention on Human Rights and art. 7 of the Charter of Fundamental Rights of the European Union and, for data protection aspects, cons. 1 of the Regulation) as well as by national and European provisions, stratified in the time, which aim to prevent penalizing differentiations in the delicate work and professional context (see, for example, art. 15, law 20 May 1970, no. 300; art. 6 of law 5 June 1990, no. 135, which prohibits employers from carrying out investigations aimed at ascertaining the existence of a state of HIV positivity; see also, Court of Justice of the European Union, judgment of 12 January 2023, case C 356/21; see also Cass. civ. sez. I – 15 December 2020, no. 28646, spec. p. 5.5.). In this framework, there are also the rules protecting the privacy and dignity of the interested party-worker, with guarantees that translate into limitations on management power, and in particular, those that, since 1970, prohibit the employer, public and private, to collect and in any case "process" data that are not relevant to the task performed or information "on facts that are not relevant for the purposes of assessing the professional aptitude of the worker" unless "these are characteristics that affect the methods of carrying out the work activity or that constitute an essential and determining requirement for the purposes of carrying out" the same (see the combined provisions of art. 8 of Law no. 300 of 20 May 1970 and art. 10 of Legislative Decree no. 276 of 10 September 2003, referred to in art. 113 of the Code, "Data collection and relevance")".

In this regard, it is important to highlight that the previous decision of the Guarantor (Provv. 20/4/2017, n. 202), recalled by the Company's defense, concerns a case different from the one in question in these proceedings (an employee had submitted to the employer a report relating to the receipt of a union-type communication, received via email, attached to the report).

Finally, it is noted in this regard, ad abundantiam, that the adoption, by the Company, in December 2020, of the company "Social media policy" (Annex 4, Company response 2/10/2024), does not eliminate the unlawfulness of the conduct in the terms indicated above.

This is because the aforementioned “policy” contains indications that have not been disregarded by the complainant (“Do not improperly disclose company content”; “Distinguish the personal sphere from company representation”; “Remember not to improperly disclose company content, such as photos, videos of you or other employees or workplaces and company locations, including elements that reproduce the company logo”), considering, first of all, that the complainant, who did not hold senior or representative roles, did not expressly mention the name of the Company by associating images and comments of felled trees with the latter’s activities.

In any case, the company policy adopted in terms of “social media” can only be read (and interpreted) in light of the principles and provisions of the legal system in the terms indicated.

The processing carried out by the Company in the terms described above therefore occurred, for the reasons set out above, in violation of Articles 5, paragraph 1, letter a) and 88 of the Regulation and of Article 113 of the Code, also given the unusability of personal data processed in violation of the relevant regulations on the processing of personal data (see art. 2-decies of the Code), given that once it became aware that the data transmitted concerned facts not relevant for the purposes of assessing the professional aptitude of the employee, the Company should have refrained from using them.

4. Conclusions: declaration of unlawfulness of the processing. Corrective measures pursuant to art. 58, par. 2, Regulation.

For the above reasons, the Authority believes that the declarations, documentation and reconstructions provided by the data controller during the investigation do not allow the findings notified by the Office with the act initiating the procedure to be overcome and that they are therefore unsuitable to allow the archiving of this proceeding, since none of the cases provided for by art. 11 of the Regulation of the Guarantor no. 1/2019 apply.

The processing of personal data carried out by the Company and in particular the use of communications of the interested party made on the Messenger and WhatsApp platforms as well as comments and opinions inserted on the closed Facebook page; to carry out two disciplinary disputes, is in fact unlawful, in the terms set out above, in relation to Articles 5, paragraph 1, letters a), b) and c), 6 and 88 of the Regulation and Article 113 of the Code.

The violation, ascertained in the terms set out in the motivation, cannot be considered "minor", taking into account the nature of the multiple violations ascertained, which concerned the general principles of processing and the more specific provisions on data collection and relevance.

The Authority also took into account the high level of seriousness of the violation in light of all the relevant factors in the specific case, and, in particular, the nature and seriousness of the violation, taking into account the nature, object or purpose of the processing in question as well as the number of data subjects harmed by the damage and the level of damage suffered by them.

The Authority also took into account the criteria relating to the intentional or negligent nature of the infringement and the categories of personal data affected by the infringement, as well as the manner in which the supervisory authority became aware of the infringement (see Article 83, paragraph 2 and Recital 148 of the Regulation), as well as the aggravating and mitigating circumstances relevant to the specific case.

Therefore, given the corrective powers attributed by Article 58, paragraph 2 of the Regulation, an administrative pecuniary sanction is provided for pursuant to Article 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i) of the Regulation).

5. Adoption of the injunction order for the application of the administrative pecuniary sanction and the accessory sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).

At the end of the proceedings, it appears that Autostrade per l’Italia S.p.A. has violated Articles 5, paragraph 1, letters a), b) and c), 6 and 88 of the Regulation and Article 113 of the Code.

Violation of the aforementioned provisions will result in the application of the administrative pecuniary sanction provided for by Article 83, paragraph 5, letters a) and d) of the Regulation, by adopting an injunction order (Article 18, Law No. 689 of 24 November 1981).

The Guarantor, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction provided for by Article 83 of the Regulation, by adopting an injunction order (art. 18. L. 24 November 1981 n. 689), in relation to the processing of personal data carried out by Autostrade per l’Italia S.p.A., which has been found to be unlawful, in the terms set out above

Deemed it necessary to apply paragraph 3 of art. 83 of the Regulation where it provides that “If, in relation to the same processing or connected processing, a data controller […] violates, with intent or negligence, several provisions of this Regulation, the total amount of the administrative pecuniary sanction shall not exceed the amount specified for the most serious violation”, the total amount of the sanction is calculated so as not to exceed the maximum amount set out in the same art. 83, par. 5.

With reference to the elements listed in art. 83, par. 2 of the Regulation for the purposes of applying the administrative pecuniary sanction and the related quantification, considering that the level of seriousness of the violation is high, taking into account that the sanction must "in any case [be] effective, proportionate and dissuasive" (Article 83, paragraph 1 of the Regulation), it is represented that, in the specific case, the following circumstances were considered:

a) in relation to the nature of the violation, this concerned cases punished more severely pursuant to Article 83, paragraph 5 of the Regulation due to the interest protected by the violated rules (general principles of processing and more specific provisions on data collection and relevance);

b) in relation to the seriousness of the violation, the nature of the processing was taken into consideration, which concerned communications from the data subject, carried out on the Messenger and WhatsApp platforms, as well as comments and opinions entered on the closed Facebook page;

c) in relation to the number of data subjects actually involved, the circumstance that the violation concerned a data subject was taken into consideration;

d) with reference to the intentional or negligent nature of the violation and the degree of responsibility of the owner, the objective elements of the Company's conduct and the degree of responsibility of the same were taken into consideration, which violated the obligation of diligence provided for by the law and did not comply with the data protection regulations, in relation to a plurality of provisions;

e) as an aggravating factor, it was considered that the Company was the recipient of the provision of the Guarantor no. 529 of 16/11/2023, following the ascertainment of the violation of articles 12 and 15 of the Regulation (failure to respond to the exercise of rights by the interested parties in the work context);

f) as a mitigating factor, in favor of the Company, the cooperation with the Supervisory Authority was taken into account, also with regard to the sending of documentation relating to the proceedings pending before the ordinary judicial authority, in order to be able to assess the applicability of art. 140-bis of the Code.

It is also believed that, in this case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness to which the Authority must adhere in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the economic conditions of the offender, determined on the basis of the revenues achieved by the Company with reference to the ordinary financial statements for the year 2023, the latest available, are relevant.

In light of the elements indicated above and the assessments carried out, it is believed, in this case, that the administrative sanction of the payment of a sum equal to 420,000 (four hundred and twenty thousand) euros should be applied to Autostrade per l’Italia S.p.A.

In this context, it is believed that pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Guarantor no. 1/2019, this chapter containing the injunction order should be published on the website of the Guarantor.

This is in consideration of the type of violations found which concerned the processing of data contained in private communications of the complainant in violation of the confidentiality of communications as well as comments and opinions expressed on facts not relevant for the purposes of assessing the professional aptitude of the worker.

CONSIDERING ALL THE ABOVE, THE GUARANTOR

pursuant to art. 57, par. 1, letter f) and 83 of the Regulation, notes the unlawfulness of the processing carried out by Autostrade per l’Italia S.p.A., in the person of its legal representative, with registered office in Via Alberto Bergamini, 50, Rome (RM), C.F. 07516911000, within the terms set out in the reasons, for the violation of art. 5, par. 1, letters a), b) and c), 6 and 88 of the Regulation and art. 113 of the Code;

ORDERS

Autostrade per l’Italia S.p.A. pursuant to art. 58, par. 2, letter i) of the Regulation, to pay the sum of Euro 420,000 (four hundred and twenty thousand) as an administrative pecuniary sanction for the violations indicated in this provision;

ORDERS

therefore the same Company to pay the aforementioned sum of Euro 420,000 (four hundred and twenty thousand), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive actions pursuant to art. 27 of Law no. 689/1981. It is recalled that the right of the offender to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the sanction imposed, within the deadline referred to in art. 10, paragraph 3, of Legislative Decree no. 150 of 1.9.2011 provided for the filing of the appeal as indicated below (art. 166, paragraph 8, of the Code);

ORDERS

- pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Regulation of the Guarantor no. 1/2019, the publication of the injunction order on the website of the Guarantor;

- pursuant to art. 154-bis, paragraph 3 of the Code and art. 37 of the Regulation of the Guarantor no. 1/2019, the publication of this provision on the website of the Guarantor;

- pursuant to art. 17 of Regulation no. 1/2019, the annotation of the violations and measures adopted in accordance with art. 58, par. 2 of the Regulation, in the internal register of the Authority provided for by art. 57, par. 1, letter u) of the Regulation.

Pursuant to art. 78 of the Regulation, as well as articles 152 of the Code and 10 of Legislative Decree no. 150/2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same art. 10, within thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad.

Catanzaro, 21 May 2025

THE PRESIDENT
Stanzione

THE REPORTER
Ghiglia

THE ACTING SECRETARY GENERAL
Filippi

SEE ALSO Newsletter of 25 June 2025

[web doc. no. 10143261]

Provision of 21 May 2025

Register of provisions
no. 288 of 21 May 2025

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Dr. Claudio Filippi, Acting Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the “Regulation”);

SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter the “Code”);

HAVING SEEN the complaint filed by Ms. XX against Autostrade per l’Italia S.p.A.;

HAVING EXAMINED the documentation in the files;

HAVING SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000;

REPORTER Dr. Agostino Ghiglia;

WHEREAS

1. The complaint against the Company and the investigative activity.

With a complaint dated 20 May 2024, regularized on 30 July 2024, Ms. XX complained of alleged violations of the Regulation by Autostrade per l’Italia S.p.A. (hereinafter, the Company), with particular reference to the processing of certain personal data used by the local unit of XX to raise two disciplinary charges against the complainant.

In particular, the complaint alleges that the disciplinary notice of 16 February 2024, issued by the XX Directorate, contains, among other things, reference to content taken from the complainant's Facebook social network profile, published on 16 and 21 January 2024.

Furthermore, with the same act initiating the disciplinary procedure, the Company contested the complainant for having used, in her capacity as President of a private association (XX), the company email account to send an email to the Director of XX.

A subsequent disciplinary notice of 21 March 2024, issued by the same Directorate, contains excerpts of conversations held by the complainant with a third party on 8, 9 and 17 January 2024, via the Messenger messaging app.