Garante per la protezione dei dati personali (Italy) - 10229191

Garante per la protezione dei dati personali - 10229191
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 4(1) GDPR Article 4(7) GDPR Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(1)(e) GDPR Article 5(2) GDPR Article 6 GDPR Article 12 GDPR Article 13 GDPR Article 28 GDPR Article 29 GDPR Article 32 GDPR Article 58(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	04.03.2026
Fine:	190.000 EUR
Parties:	ITA Airways
National Case Number/Name:	10229191
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	ligialagev

The DPA fined an airline company €190,000 for unlawfully and excessively processing the personal data of a former member of its Board of Directors when performing a digital forensics investigation connected to the airline’s privatization process.

English Summary

Facts

The data subject served as chairman of the Board of Directors of an airline company (the controller), having been appointed by the Ministry of Economy and Finance on 18 June 2021. On 10 October 2022, an anonymous letter was delivered to a member of the controller's Board of Directors, containing a printed copy of an email exchange involving the data subject and two other company directors concerning the airline's privatisation process. Following this, the Board of Directors revoked the data subject's operational powers, and the shareholders' meeting subsequently revoked his appointment as chairman entirely.

The controller then commissioned a processor to conduct a digital forensics investigation. The processor extracted data from the data subject's email account, SharePoint, and OneDrive, creating a forensic image of the data subject's entire Microsoft Exchange database covering the period from at least July 2021 to March 2023 (approximately 21 months), before the anonymous tip. The processor then applied three keyword-based search criteria, defined by the controller, to the forensic image and produced a final report.

On 6 July 2023, the data subject filed a complaint with the DPA. In its responses to the DPA's requests for information, the controller stated that the processor had been engaged under a processing agreement pursuant to Article 28 GDPR, but acknowledged that it had been unable to locate a signed copy of that document.

Holding

First, the DPA held that the controller failed to adequately inform the data subject before processing his personal data, in violation of Articles 5(1)(a), 12, and 13 GDPR. The controller argued that its internal privacy notice and IT usage policy had been published on its intranet and were known to the data subject given his role as chairman, pointing out that he had himself attached those documents to his complaint. The DPA rejected this argument. It noted that both documents were expressly directed at employees and collaborators, not board members, and that the controller had confirmed the data subject held a corporate appointment rather than an employment relationship.

The controller had therefore not demonstrated that these documents applied to the data subject or that he had received them before the processing started. The DPA further found that, in any event, the processing activities described in those documents were themselves not compliant with GDPR principles, meaning the documents could not have satisfied the requirements of Article 13 GDPR regardless of whether the data subject had seen them. On this basis, the DPA found a violation of Articles 5(1)(a), 12, and 13 GDPR.

Second, the DPA held that the controller violated Articles 6 and 28 GDPR by failing to have a valid data processing agreement in place with the processor. The controller was unable to produce a signed copy of the processing agreement and acknowledged as much during the hearing.

The DPA rejected the controller's argument that the unsigned document constituted a binding arrangement through the parties' conduct, holding that, without a formally executed agreement meeting the requirements of Article 28 GDPR, the processing carried out by the processor on the controller's behalf lacked a lawful basis under Article 6 GDPR.

Third, the DPA found that the processor's investigation violated the principles of purpose limitation, data minimisation, and storage limitation under Article 5(1)(b), (c), and (e) GDPR. The forensic image covered the data subject's entire Microsoft Exchange database from the creation of his account (at least July 2021) to 1st March 2023, encompassing data from well before the anonymous tip was received on 10 October 2022. The controller argued that applying specific keyword searches to the forensic image after its creation was sufficient to comply with the minimisation principle.

The DPA rejected this, holding that the access to and extraction of the entire database already constituted a processing operation in its own right, and that the subsequent filtering did not cure the initial over-collection. The DPA also dismissed the controller's argument that the data subject's seniority justified departing from ordinary data protection rules, emphasising that holding a senior corporate role does not extinguish an individual's right to data protection.

On these grounds, the DPA imposed a fine of €190,000 on the controller and ordered it to cease processing the data contained in the database, except insofar as strictly necessary for the purposes of judicial defence.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10229191]

Measure of March 4, 2026

Register of Measures
no. 151 of March 4, 2026

THE ITALIAN DATA PROTECTION AUTHORITY

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Members, and Councillor Luigi Montuori, Secretary General;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the "Code");

HAVING SEEN the complaint filed by Mr. XX pursuant to Article 77 of the Regulation against Italia Trasporto Aereo S.p.A.;

HAVING EXAMINED the documentation in the file;

HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Regulation of the Guarantor No. 1/2000;

REPORTER: Dr. Agostino Ghiglia;

WHEREAS

1. The complaint filed with the Authority and the investigation.

On July 6, 2023, Mr. XX filed a complaint pursuant to Article 77 of the Regulation. 77 of the Regulation against Italia Trasporto Aereo S.p.A. (hereinafter also "ITA" or the "Company").

In the complaint, the complainant alleged that he had served as XX on the Board of Directors of ITA, appointed by the Ministry of Economy and Finance as Sole Shareholder, effective June 18, 2021, with the assignment of certain responsibilities in key areas of the Company. However, following disagreements and disagreements with the CEO and certain members of the Board of Directors regarding the implementation of the Company's privatization, the assigned responsibilities were revoked by resolution of the Board of Directors on October 20, 2022, and the role of Chairman and member of the Board of Directors was revoked by resolution of the ITA Shareholders' Meeting on November 16, 2022.

According to the complaint, the Company allegedly processed data relating to the complainant in violation of personal data protection regulations; Specifically, it was alleged that the revocation of the powers and positions in question was based on ITA's acquisition of emails, documents, and information contained in the email address assigned to the complainant ("XX") and in the email addresses of two other Company executives. This was done through digital forensics conducted by a third party following the anonymous receipt, in a sealed envelope, on October 10, 2022, of a copy of an email dated October 8, 2022, exchanged between the complainant, the two aforementioned executives, and an external consultant, regarding the Company's privatization.

With a note dated November 22, 2023, the Office invited the complainant to regularize the complaint and, on that occasion, considered that, with regard to certain aspects raised in the complaint, there were no grounds for the Authority to adopt a measure, given Articles. 140-bis, 142, 143, 160-bis of the Code, and Articles 8, 9, and 11 of the Internal Regulation of the Guarantor No. 1 of 2019, dismissed the complaint, with reference to the questions relating to the alleged violation of Articles 32, 33, 34, and 28 in relation to a third-party company. This is because, following examination of the complaint submitted to the Guarantor and the attached documentation, pertaining to the civil challenge to the aforementioned resolution of November 16, 2022, the Office deemed that the subject matter of the complaint was partially "overlapping" with that of the ongoing judicial appeal between the same parties, since pursuant to Article 140-bis, paragraph 2, of the Code, "a complaint to the Guarantor cannot be lodged if, for the same subject matter and between the same parties, a judicial authority has already been approached."

The aforementioned notice of November 22, 2023, was challenged by the appellant, pursuant to Articles 143, paragraph 4, and 152 of the Code, before the Court of Rome, and the proceedings are ongoing.

On December 5, 2023, the appellant, in response to the Department's request to regularize the situation on November 22, 2023, supplemented the complaint.

With regard to the matters for which the Office decided to initiate an investigation, on March 4, 2024, it submitted a request for information to the Company, pursuant to Article 157 of the Code.

The Company, in a note dated April 12, 2024, submitted its response and stated that:

- "The Company has consistently invested in a culture of data protection, implementing adequate measures and resources to prevent and mitigate potential risks to data subjects and carrying out numerous training, review, analysis, research, and communication initiatives, while also systematically engaging external and specialized legal advisors to gather recommendations and opinions" (see note dated April 12, 2024, p. 2);

- "Two proceedings are currently pending between the Complainant and ITA before the Civil Court of Rome. These concern, respectively, the [Complainant]'s challenge to the resolution of the Board of Directors of October 20, 2022, regarding the revocation of the operational powers of the President [Complainant] and the challenge to the resolution of the ITA Shareholders' Meeting of November 16, 2022, regarding the revocation of the Complainant's positions at ITA. Furthermore, criminal proceedings are also pending before the Court of Rome against the [Complainant] following a complaint filed by ITA for the alleged crime provided for by Article 2634 of the Civil Code." (see cited note, p. 2);

- "The facts at issue in the complaint must be viewed within the context of the aforementioned proceedings" (see cited note, p. 2);

- "The Complainant did not have a managerial employment relationship with ITA, but rather solely a corporate role" (see footnote cited, p. 2);

- "The Complainant had been fully informed of the nature of the processing to which his personal data would be subjected, - given that the policies are made public on the company intranet, even though the Complainant in question cannot be classified as a data subject among the Company's employees, as [...] no employment relationship existed between the parties" (see footnote cited, pp. 2, 3);

- "As of the date of this writing, it is confirmed that the email account assigned to the Complainant [...] has been deactivated" (see footnote cited, p. 3);

- "In accordance with ITA's internal procedures, the email account assigned to the Complainant was disabled on November 16, 2022, at 7:47 PM, and an automatic reply was set up at the same time. Anyone writing to [the Complainant] received an automatic reply informing them that the mailbox was no longer active and requesting them to contact the President directly. At this stage, although the account was able to receive emails, technical measures were implemented to ensure that the employer could not access the account and any communications received" (see note cited, pp. 3, 4);

- "On March 8, 2023, the mailbox was permanently deactivated, and on November 8, 2023, the account was deleted from the Company's archives. The contents of the email archive, however, were not deleted due to the litigation hold status to which it was subjected in consideration of ITA's need to defend itself in the proceedings cited in the preamble" (see note cited above, p. 4);

- "With reference to the checks conducted on the account, prior to its deactivation, however, it is important to note that [following an internal report of wrongdoing, ITA entrusted a leading consulting firm with the task of analyzing the computer data relating to the mailbox, SharePoint, and OneDrive accounts belonging to the current Complainant, aimed at acquiring further evidence in order to evaluate any appropriate action to protect the Company and its sole shareholder, the Ministry of Economy and Finance" (see note cited, p. 4);

- "To this end, the consultants contacted the Information Technology representative, designated by the Company, to initiate data security operations. Specifically, on March 1, 2023, the Company's IT representative logged in (using his administrative credentials) to the Microsoft Purview administrative portal (the space for managing the compliance needs of the IT infrastructure connected to Microsoft 365) to create a specific process within the Microsoft eDiscovery application. This was done to identify the data present in the aforementioned Microsoft applications (email, SharePoint, OneDrive) and subsequently export it. This activity was carried out by the IT representative under the supervision of the consultants to ensure that the extraction operations were carried out correctly from a technical and IT perspective. On the extracted data, the consultants, applying specific keys and search criteria predefined by the Company, proceeded to conduct targeted searches for commercially sensitive data and information" (see note cited, pp. 4, 5);

- "The Complainant's email account is currently retained, with the so-called litigation hold mode activated, for the sole purpose of providing evidence, given the ongoing disputes cited in the introduction. Generally, however, when an employee leaves the company (or, more generally, when the need for an email account ceases), the account is placed in disabled mode for 30 days, with the simultaneous activation of an automatic reply message and the data controller's ability to read it" (see footnote cited, p. 5);

- "The Company does not perform backups of its email archives but adopts the alternative measure of redundancy, resulting in data replication across multiple systems. Therefore, at present, no backup copies have been made of the Complainant's email account" (see footnote cited, pp. 5, 6);

- "Over the years, and from the very first days of the Company's operations, two key documents were prepared to fulfill the information obligation towards data subjects/employees. This applies both to ordinary processing activities, which normally occur during the employment relationship, and to any checks for more pathological cases. The two documents cited are the Policy on the correct and safe use of IT equipment and ICT resources (hereinafter, the "Policy") and the Information on the processing of personal data of employees pursuant to Articles 13 and 14 of the Regulation [...] (hereinafter, the "Information"). Although the two documents cited above are not specifically addressed to the Corporate Bodies, it is important to keep in mind that the behaviors [...] described therein have constituted the guidelines that the Company has always followed, including with respect to XX [the current complainant]" (see note cited, p. 6);

- "There is no doubt whatsoever that the disclosure obligation has been fulfilled, given that the current Complainant has proven, by the records, that he was aware of the aforementioned documents, which were made available on the company intranet! In fact, it was [the Complainant] himself who produced them in the context of this procedure, attaching them to the complaint pursuant to Article 77 of the GDPR" (see note cited above, p. 7).

On August 7, 2024, the Department sent the Company a second request for information, seeking further information regarding certain specific profiles.

The Company, in a note dated September 30, 2024, provided its response and, on that occasion, stated that:

- "Following the activation of disabled mode, the email inbox (i.e., the Complainant's digital profile required to access his email inbox) was made inaccessible to any user with the relevant credentials, although it remained enabled to receive emails. This prevented the Complainant from logging in and possibly modifying the contents of his account [...] In the event of new emails being received, an automatic reply message was sent, in which the sender was invited to contact the Complainant by telephone, since the latter could no longer access his email inbox. In any case, any communications received during this phase are contained in the email inbox but cannot be read by anyone with the authentication credentials" (see note dated September 30, 2024 cited, pp. 2, 3);

- "The Complainant's account was permanently deactivated on March 8, 2023, placed on RRL (employment termination), and can no longer log in to the network, and the mailbox no longer receives messages. Therefore, anyone who should have sent communications to the address in question would have received an error message and no longer an automatic response like the one preset by the Company during the disabling phase" (see note cited, p. 3);

- "The cancellation that occurred on November 8, 2023, involved the permanent deletion of the account [assigned to the complainant] from the ITA systems. Therefore, the system no longer contains any information except for the contents of the email inbox, as the litigation hold flag is still active due to the ongoing legal disputes with the Complainant, as already mentioned in the Note. However, it is essential to emphasize that this mode was not enabled at the same time as the cancellation on November 8, 2023, but rather, it occurred shortly after the activation of the disable mode, specifically on November 17, 2022, at 6:14:29 PM" (see note cited above, p. 3);

- "ITA's inaccessibility to the Complainant's email account in disable mode was ensured by the following measures: • the Company did not know the password to access the Complainant's email account […] it is impossible for ITA to access the email accounts of its employees and collaborators, as it does not have the relevant credentials, which are personalized by each user upon initial access; • in addition […], disable mode prevents any access to the email account for which it is activated, and this block is effective against any person who may have access to the credentials of the affected account (for example, any personal assistants and/or secretarial staff); • it is understood that Microsoft makes certain features available only to the System Administrator to be able to access/extract the contents of the mailbox" (see note cited, p. 4);

- "The internal report referred to in the Note [of feedback previously sent by the Company] occurred on October 10, 2022, when an anonymous letter in a sealed envelope containing a printed copy of an email exchange was delivered to a member of the Company's Board of Directors" (see note cited, p. 4);

- "This report therefore triggered the investigation, culminating in forensic work" (see note cited, p. 5);

- "The Company engaged the external consultant PricewaterhouseCoopers Business Services S.r.l. (the "Supplier" or "PWC") to acquire and subsequently analyze certain IT data of ITA, after conducting a specific in-depth analysis of the employment law aspects related to the transaction. The appointed Supplier, with the support of the Company's Information Technology ("IT") representative, extracted the digital data constituting the scope of the activity (the "Medium Copy"); in other words, it created a forensic image of the entire Microsoft Exchange IT database attributable to the Complainant ("Relevant Data"). Specifically, this scope was identified with reference to the period between the creation of the Complainant's email account and March 1, 2023" (see note cited, pp. 5, 6);

- "On March 1, 2023, the Company's IT representative logged into the Microsoft administrative portal in the "eDiscovery/Compliance" section, entering his administrative credentials to create a specific process within the Microsoft eDiscovery application that would allow the export of Relevant Data. It is important to emphasize that during the execution of the operations, the Supplier assisted the IT representative to verify the methodological accuracy and rigor adopted" (see note cited, p. 6);

- "Following the extraction and subsequent transmission of the Relevant Data by the Company, PWC performed the following activities: a) first, using the NUIX forensic software, it applied three (3) specific search criteria to the Medium Copy, identified to answer the questions posed by the Company ("Criteria"); b) following this application of the Criteria, it analyzed the results, selecting only those elements deemed to be of direct interest to the questions posed by the Company; c) finally, it included only these essential elements in the final report, always taking into account ITA's interest expressed through the questions originally posed. It is emphasized that when submitting the final report on the activities performed, the Supplier did not produce any digital copies of the Relevant Data for the Company's benefit" (see cited note, pp. 6, 7);

- "Following the conclusion of the project, which occurred with the finalization of the final report on March 24, 2023 ("Final Report"), a copy of the Relevant Data was retained in the Supplier's archives for a limited period of one month following the end of the activities. Subsequently, the Half Copy and the data processed in the NUIX environment were deleted from PWC's IT systems, and to date, the only document retained by the Supplier is the Final Report" (see cited note, p. 7);

- “Targeted searches on the Relevant Data were conducted by applying the three (3) Criteria defined by the Supplier in agreement with the Company. Specifically, the following keywords were applied: […] “Legal Advisors” or “Legal Advisor” without applying a time filter […] “Financial Advisor” or “financial advisors” or “Engagement Letter”, Without applying a time filter […] Alternatively: “Sardinia”; “Sardinia”; “Sardinia”; “Sardinia”; “Cagliari”; “CAG”; “AZ 330”; “AZ330”; “Without applying a time filter” (see cited note, pp. 7, 8);

- “The task of carrying out the research activities in the manner described for the identification of possible illicit conduct was entrusted to the company PriceWaterhouseCoopers Business Services S.r.l. (“PwC”). For the performance of its services, PwC has been designated as a data processor pursuant to Article 28 of the Regulation, as set out in the appointment agreement (see footnote cited, p. 8);

- "As a partial correction to the provisions of the Policy [on the correct and secure use of IT equipment and ICT resources], ITA does not make data backup copies. To ensure availability and resilience, the email service provider Microsoft ensures that each mailbox database is hosted in a database availability group and replicated in geographically separate data centers within the same area" (see footnote cited, p. 9).

The Company also attached, to the note dated September 30, 2024, a copy of the document entitled "Information on the processing of personal data of employees pursuant to Articles 15 and 16 of the GDPR." 13 and 14 of Regulation (EU) 2016/679 issued by ITA.

2. Initiation of the procedure for the adoption of corrective and sanctioning measures by the Authority.

Based on the statements made and the documentation produced during the investigation, the Office notified the Company of the initiation of the corrective and sanctioning procedure, pursuant to Article 166, paragraph 5, of the Code, for the violation of Articles 5, paragraph 1, letters a), b), c), and e), 6, 12, 13, and 28 of the Regulation (note dated January 29, 2025).

With the defense briefs submitted on February 27, 2025, pursuant to Article 18 of Law No. 689/1981 and Article 166, paragraph 6 of the Code, the Company declared that:

- regarding the contested violation of art. 5, paragraphs 1, 12 and 13 of the Regulation, the Company believes that, given the senior role of the complainant, who became XX as of June 18, 2021, with responsibilities in key sectors for the Company, "it is extremely unlikely that the Complainant, effectively acting in the name and on behalf of the Company and, therefore, as the legal representative pro tempore of the data controller, did not have all the information relating to the personal data processing carried out by the latter. The clarification regarding the recipients of the Information and Policy, provided by the Company in the first response to the Authority sent on April 11, should be read in this light.Indeed, it cannot be argued that these documents were not known to the Company's top management simply because they were not expressly addressed to the Corporate Bodies, but rather to employees and collaborators" (see note dated February 27, 2025, cited above, p. 3);

- moreover, it was "the [complainant] himself who produced both the Information and the Policy in the context of these proceedings, attaching them to the complaint [...]. It seems at least dubious for a (former) legal representative of the data controller to claim to be unaware of the characteristics of the processing carried out by the data controller himself for the sole reason that the documents containing the necessary information are not expressly addressed to the hybrid category of corporate bodies to which he belonged!" (see cited note, p. 3);

- "with specific reference to the content of the information provided to the data subject, (...) it must be considered that the data subject has received (...) adequate information (...) in accordance with the procedures established by law, pursuant to Articles 12 and 13 of the GDPR. In this sense, (...) these documents contain clear and precise information on the processing carried out during the forensic analysis of the Complainant's personal data. More specifically, the Policy expressly mentions the possibility that the Company may process personal data contained in company email accounts, or on other technological devices, "for the purpose of conducting internal checks/audits aimed at determining whether or not unlawful acts/fraud have been committed of which the company has become aware, including through reports" (Policy, pp. 4-5, letter D) (see footnote cited, p. 4);

- the Policy itself specifies that "the processing of information and data relating to the use of IT equipment and ICT resources by users, including temporary storage, may occur for one of the purposes described below: [...] if the processing is necessary to detect unlawful acts [...]; if the processing is indispensable for the exercise or defense of a right in judicial and/or administrative proceedings” (Policy, p. 17, par. 6) and that the only exception to the standard method of conducting anonymous and aggregated checks applies in the event of gross negligence (“If, despite this, such conduct should still take place, ITA will follow the provisions described below to carry out the necessary checks, with the exception of cases where gross misconduct is detected”, Policy, p. 17, par. 6), such as that which, in ITA's opinion, the complainant would have committed, potentially to the detriment of the Company (see cited note, pp. 4-5);

- with regard to the alleged violation of Articles 6 and 28 of the Regulation, due to the failure to sign the document “Deed of Appointment as Data Processor pursuant to Article 28 of European Regulation No. 2016/679 of the European Parliament and of the Council of 27 April 2016”. 2016, as well as European Commission Implementing Decision No. 2021/915 of 4 June 2021,” produced by ITA during the proceedings, “the Company carried out all necessary checks to locate the signed document and be able to prove that there was a regulation of the processing entrusted to the PwC data controller. The search, however, was unsuccessful” (see cited note, p. 5);

- “the data processing agreement that was produced constitutes an annex to the broader contract signed between ITA and PwC, such that it forms an integral and substantial part of it. It should therefore be borne in mind that the parties' intentions could not differ on the content of that document and that, on the contrary, it constitutes, even in the absence of a signature, the terms of the agreements between the parties and the owner's obligations towards the data controller" (see note cited p. 6);

- "the previous responses provided by ITA in relation to the requests for information formulated by the Authority illustrated in detail the methods by which the supplier PwC had performed the services commissioned from it. The description of these methods […] appears consistent with the instructions given by the owner in the designation deed pursuant to art. 28 of the GDPR produced at that time, even if not signed by the parties, and, even more so, with best practices and the highest standards aimed at protecting the rights of data subjects in any case, balancing them with ITA's need to be able to actively seek evidence to defend itself in court against proven and serious conduct that has occurred to the detriment of the Company" (see note cited, p. 6);

- "the absence of a signed designation deed [is] in any case to be considered overcome by the conclusive conduct of both parties, data controller and data processor, who have regulated their respective roles and have interpreted, each for their part, in full and strict compliance with that shared framework of rules" (see note cited, p. 7);

- with regard to the alleged violation of Article 5, paragraph 1, letters b), c), and e) of the Regulation, "the digital forensics activity was carried out by PwC on behalf of ITA in compliance with the standards and industry best practices, as well as in line with the Company's internal procedures, as highlighted in the Policy and the Disclosure. Specifically, the extraction of digital data contained in the Microsoft Exchange database relating to [complainant] was not limited to the time period corresponding to the period of performance of XX's office on the Board of Directors of ITA for a very specific reason. The Company should, in fact, have conducted all necessary investigations to verify the validity of the findings of the anonymous report received by ITA" (see note cited, pp. 7-8);

- "the retention of the contents of the then President's email account cannot follow the ordinary retention rules that must apply to all employees. And this is even more true at a time in history, such as that in which the [complainant] held the position of XX, in which ITA and its sole shareholder, the Ministry of Economy and Finance, were engaged in managing the privatization process, including the related search for a commercial partner on the international market” (see note cited, p. 8);

- “PwC did not send any digital copy of the Forensic Image to the Company, but only the final report of the operations, containing only the essential selection of the results of the investigations” (see note cited, p. 9);

- “the breach would have concerned exclusively one data subject, against whom the digital forensics activities were carried out. In any case, the personal data made available to ITA do not belong to the special categories referred to in Article 9, paragraph 1, of the GDPR.” 1, GDPR, nor do they concern criminal convictions, offenses, or related security measures” (see note cited, p. 9);

- “any form of intent or representation of possible violations of the personal data protection legislation must be excluded, as they can only be considered, at most, as consequences of purely negligent conduct” (see note cited, pp. 9, 10);

- “it is required to evaluate […] the context in which the Company had to react to the seriousness of the circumstances that had arisen, of which the Company became aware exclusively through the anonymous report submitted in a sealed envelope, as well as the consequent and absolute necessity for the Company to proceed with internal investigations, resulting in the digital forensics activities entrusted to PwC, in order to adequately protect the public position of ITA, seriously exposed to prejudicial consequences, including in the context of the search for a private partner” (see note cited, p. 10);

- “the Company has dedicated significant resources to disseminating a solid culture of data protection, adopting measures and tools aimed at preventing and reducing potential risks to data subjects. Of relevance here, these include, inter alia: i) the adoption of internal procedures aimed at the proper management of processes with a significant potential impact on personal data protection (data breach management policy; personal data retention policy; internal procedure for the proper use of ICT tools and systems); ii) the appointment and related instructions for those authorized to process personal data pursuant to Articles 29 of the GDPR and 2 of the Privacy Code; iii) the appointment of a Data Protection Officer; (iv) the preparation of detailed and timely corporate policies on data protection issues" (see note cited, pp. 10, 11).

On March 26, 2025, the hearing of the party requested by the party itself took place, during which it was stated, among other things, that:

- "the second verification, which took place on March 1, 2023, concerned only the [complainant's] account";

- the Company "is aware that it was able to better manage the process of appointing the data controller and is willing to make amends for it."

On May 29, 2025, the Company, in response to the reservation expressed during the hearing, sent what it called an "extract of the final report" prepared by Price Waterhouse Coopers Business Services S.r.l.

3. The outcome of the investigation and the procedure for adopting corrective measures and sanctions.

Following an examination of the statements made by the parties during the proceedings, as well as the documentation acquired—with the exception of the matters archived with the notice of November 22, 2023, which, consequently, were not subject to investigation—it appears that the Company, as data controller, has carried out certain processing operations that do not comply with the regulations on personal data protection.

In this regard, it is noted that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Garante, falsely declares or certifies information or circumstances, or produces false documents or records, is liable pursuant to Article 168 of the Code, "False declarations to the Garante and interruption of the performance of the Garante's duties or exercise of its powers."

3.1. The applicable regulatory framework.

The processing of personal data must be carried out in accordance with the principles set out in Article 5 of the Regulation, including the principle of transparency and the principle of fairness (Article 5(1)(a) of the Regulation).

Article 5(2) of the Regulation provides that "the controller shall be responsible for compliance with paragraph 1 and be able to demonstrate compliance with it ('accountability')."

Article 6 of the Regulation sets out the exhaustive list of conditions for the lawfulness of processing for so-called "common" data.

According to Article 12 of the Regulation, "the controller shall take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14, and any communication referred to in Articles 15 to 22 and Article 34 relating to processing, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language [...]. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. If requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means."

Article 13 of the Regulation requires the controller to provide the data subject with at least the information relating to processing contained in that provision. This must be done before the processing is carried out.

Article 13 Article 28 of the Regulation provides, among other things, that "processing by a processor shall be governed by a contract or other legal act under Union or Member State law, which is binding on the processor with respect to the controller and which specifies the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller."

3.2. Violation of Articles 5(1)(a), 12, and 13 of the Regulation.

First, it should be clarified that, regardless of the nature of the relationship between the Company and the complainant, the processing of the data subject's personal data is attributable to the Company, which acted as controller, as defined in Article 4(1)(b). 7 of the Regulation ("data controller: the natural or legal person, [...] who, alone or jointly with others, determines the purposes and means of the processing of personal data").

The preliminary investigation revealed that the Company accessed the computer data "relating to the mailbox, SharePoint, and OneDrive belonging to the [...] Complainant," including through digital forensics conducted by Price Waterhouse Coopers Business Services S.r.l., in order to acquire evidence of possible unlawful conduct by the Complainant to be used in legal proceedings to protect the Company and its sole shareholder, the Ministry of Economy and Finance (see note dated September 30, 2024, pp. 5, 6).

In light of the processing carried out, it was found that the Company had not adequately informed the data subject before the processing began, nor had the data subject otherwise become aware of it before the processing began.

The Company has not proven that the documents "Information on the Processing of Employee Personal Data Pursuant to Articles 13 and 14 of EU Regulation 2016/679," "Main Security Rules and the Use of Information Systems," and "Policy on the Correct and Safe Use of IT Equipment and ICT Resources," nor any other similar information documents, were provided to the complainant before the processing in question was carried out.

In this regard, the Company's argument that the production of such documents as an attachment to the complaint constitutes evidence that the complainant was aware of their content before the processing was carried out, and therefore that the Company fulfilled its disclosure obligation, must be rejected. Nor does the fact that the complainant served as the Company's legal representative constitute, in itself, evidence that the provisions of Article 13 of the Regulation were properly fulfilled. 13 of the Regulation (see note dated February 27, 2025, p. 3).

Furthermore, while the Company confirmed during the investigation that the cited documents did not concern the processing of data of positions such as that held by the complainant, who, as it specified, "did not have a subordinate employment relationship of a managerial nature with ITA but merely held a corporate role" (see note dated April 12, 2023, p. 2) (this fact is also evident from a reading of the same documents, which are expressly addressed to employees and collaborators), on the other hand, while maintaining that "the conduct [...] described therein constituted the guidelines that the Company has always followed, including with respect to XX [current complainant]" (see note dated April 12, 2024, p. 6), the Company did not provide evidence that the content of the cited documents also applies to the complainant's data.

Furthermore, no evidence was provided of the publication of the aforementioned documents on the company intranet, nor that, through such publication, the complainant would have become aware of the processing in question.

In any case, the analysis above shows that the information documents prepared by the Company, entitled "Information on the Processing of Employees' Personal Data Pursuant to Articles 13 and 14 of EU Regulation 2016/679" and "Policy on the Correct and Safe Use of IT Equipment and ICT Resources," describe certain processing activities that do not comply with personal data protection regulations.

In particular, with reference to the specific subject of this provision, the provisions of point D "legitimate interest of the Data Controller" of the aforementioned information (pp. 4, 5) are not considered to be compliant with the general principles regarding the protection of personal data, a point referred to by the Company (see note 27/02/2025, p. 4) where it is specified that "your personal data may also be processed, without the need for your consent, in the following cases: - for the purposes of carrying out internal checks/audits aimed at ascertaining the possible commission of unlawful acts/fraud and/or alleged violations of obligations related to the employment relationship of which the company has become aware, including through reports, in accordance with company regulations and in compliance with the principles established by the legislation on the protection of personal data; - in compliance with the applicable legislation, your personal data possibly present in email messages contained in the company mailbox(es) assigned to you for use, as well as on the technological equipment that the company will make available to you, may be processed for the purposes of carrying out checks internal investigations/audits aimed at determining whether or not illegal/fraudulent acts of which the company has become aware have occurred, including through reports and/or alleged violations of obligations related to the employment relationship.

Furthermore, again with reference to the specific subject of this provision, certain activities described in the document "Policy on the correct and safe use of IT equipment and ICT resources" (pp. 16 and 17) are also deemed not to comply with the general principles of data processing (see "in the event that incorrect and/or contrary behavior to this policy persists, ITA will carry out appropriate checks on an individual basis, reserving the right to take appropriate measures").

In this regard, it is emphasized that the rationale behind the provisions of art. 13 of the Regulation is to provide data subjects with clear, data protection-compliant information on the processing that the data controller will implement with respect to the personal data of the individuals to whom they refer. Therefore, in order to comply with the provisions of the aforementioned article, it is not sufficient to inform the data subject of the essential characteristics of the processing; the information provided must describe processing operations that are per se lawful, and therefore compliant with, among other things, the principles of lawfulness, data minimization, and storage limitation (see "Guidelines for e-mail and internet," Order No. 13 of March 1, 2007, Web Document No. 1387522).

The processing of personal data carried out by the Company must therefore be considered unlawful as it violates Articles 5, paragraph 1, letter a), the transparency principle, and Articles 12 and 13 of the Regulation.

The Company's conduct also violated the principle of fairness (Article 5, paragraph 1, letter a), of the Regulation), given that providing adequate information, even in the context of relationships with corporate figures—such as, in this case, the Chairman of the Board of Directors—is an expression of the general principle of good faith and fairness.

The Company's conduct, therefore, violated Articles 5, paragraph 1, letter a) (principles of transparency and fairness), 12, and 13 of the Regulation.

3.3. Violation of Articles 6 and 28 of the Regulation

As emerged during the investigation, the Company engaged the external consulting firm Price Waterhouse Coopers Business Services S.r.l. to conduct digital forensics for the complainant.

The Company declared that Price Waterhouse Coopers Business Services S.r.l. processed the complainant's data, as data controller, on the basis of the document produced by the Company entitled "Deed of Appointment as Data Controller pursuant to Article 28 of European Regulation No. 2016/679 of the European Parliament and of the Council of 27 April 2016, as well as Implementing Decision No. 2021/915 of the European Commission of 4 June 2021" (Annex 1 to the note dated 30/09/2024).

However, it emerged that the aforementioned document was not signed by the parties. Nor was the Company able to locate or produce a signed copy of this document during the proceedings ("the Company carried out all necessary checks to locate the signed document and thus prove that there was a regulation governing the processing entrusted to the PwC data controller. However, the search was unsuccessful," see note dated February 27, 2025, p. 5).

Therefore, the document produced cannot serve as evidence of compliance with the provisions of Article 28 of the Regulation, regarding the designation of Price Waterhouse Coopers Business Services S.r.l. as data controller.

Furthermore, the Company's assertion that the lack of signature on the data processor appointment deed is invalidated by the fact that this document "constitutes an annex to the broader contract signed between ITA and PWC, thus constituting an integral and substantial part of it. It should therefore be noted that the parties' intentions could not differ on the content of that document and that, on the contrary, it constitutes, even in the absence of its signature, the terms of the agreements between the parties and the data controller's obligations towards the data processor" (see note dated February 27, 2025, p. 6).

Furthermore, the Company itself, during the hearing of March 26, 2025, acknowledged "that it was able to better manage the data processor appointment process and is willing to make amends for this."

In light of the above, it is recalled that the processing carried out by the data controller through the data processor is lawful if and to the extent, among other things, that the processor's appointment was made in compliance with Article 28 of the Regulation. If the procedure for appointing the processor has not been followed, the processing cannot be considered to be carried out in accordance with Article 6 of the Regulation, which establishes the conditions for lawfulness of processing, with regard to so-called shared data.

The conduct therefore violated Articles 6 and 28 of the Regulation.

3.4. Violation of Article 5, paragraph 1, letters b), c), and e) of the Regulation.

It was also found that the Company had processed the complainant's data in violation of data protection regulations, in particular because, through Price Waterhouse Coopers Business Services S.r.l., it had carried out processing operations in violation of Article 5, paragraph 1, letters c), and e). 1, letters b), c), and e), of the Regulation; in particular, "a forensic image of the entire Microsoft Exchange database relating to the Complainant (the "Relevant Data"). Specifically, this scope was identified with reference to the period between the creation of the Complainant's email account and March 1, 2023" (see note dated September 30, 2024, pp. 5, 6).

According to the Company's clarification, "the extraction of digital data contained in the Microsoft Exchange database relating to [the Complainant] was not limited to the time period corresponding to the period during which XX held office on the Board of Directors of ITA" (see note cited above, pp. 7-8).

The Company's assertion that the principles of data minimization and purpose limitation pursuant to Article 5, paragraph 1, letter a), were not violated is without merit. c) and b), as "following the processing of the Forensic Image, only three specific search criteria were applied, corresponding to the questions posed by the Company for the purposes of the investigation" and "the search results were carefully selected so that the Company could only access the elements of strict interest related to the questions posed, and in any case always in accordance with the purposes of the ongoing investigation" (see note dated February 27, 2025, p. 9).

Indeed, it emerged that the Company accessed the entire computer database relating to the complainant, containing data spanning a period of approximately 21 months, from at least July 2021 (as it emerged that the Company extracted some emails from July 2021, as evidenced by the extract from the final report prepared by Price Waterhouse Coopers Business Services S.r.l., submitted by the Company on May 29, 2025, following the hearing) until, as the Company itself stated, March 1, 2023.

Indeed, according to the Company's statement, "on March 1, 2023, the Company's IT representative accessed the Microsoft administrative portal in the "eDiscovery/Compliance" section, entering his administrative credentials, in order to create a specific process within the Microsoft eDiscovery application that would allow the export of Relevant Data" (see note dated September 30, 2024, p. 6).

In any case, the digital forensics activity, despite the Company specifying that the need to examine the complainant's data arose after receiving an anonymous report, did not exclusively concern the data and information acquired after the suspicion of unlawful conduct arose, but encompassed the entire set of data and information in the complainant's computer database, starting at least from July 2021 (i.e., shortly after he took up his duties for the Company) and even after his termination. This confirms that processing was already being carried out by the Company prior to receiving the report of October 10, 2022.

Furthermore, the Company's assertion that, in this case, "the retention of the content of the then President's email account cannot follow the ordinary retention rules that must apply to all employees" (see note dated February 27, 2025, p. 8) is deemed to be without merit.

Holding corporate offices, in fact, does not nullify the right to personal data protection. The need to comply with the general principles established by law and the requirement that the data controller, when carrying out processing operations, balance the rights and interests at stake, in compliance with the principle of proportionality, always exist, even when the data refers to the chairman of a board of directors.

Article 4 (1) specifies that the personal data being processed and for which the guarantees established by law are recognized is "any information relating to an identified or identifiable natural person ('data subject')".

It is also emphasized that the content of emails—as well as external communication data and attached files—even in the case of individualized corporate email accounts, concern forms of correspondence supported by guarantees of confidentiality also protected by the Constitution, whose rationale lies in protecting the essential core of human dignity and the full development of personality in social groups; Further protection is provided by criminal law provisions protecting the inviolability of confidentiality (Articles 2 and 15 of the Constitution; Constitutional Court, July 17, 1998, No. 281, and March 11, 1993, No. 81; Article 616, paragraph 4, of the Criminal Code; Article 49 of the Digital Administration Code).

In light of the above considerations, it is therefore believed that the Company's conduct violated the data minimization principle set forth in Article 5, paragraph 1, letter c), of the Regulation, according to which the data controller must process only data that is "adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed," and the purpose limitation principle, according to which "personal data shall be collected for specified, explicit, and legitimate purposes" (Article 5, paragraph 1, letter b), of the Regulation); as well as the principle of storage limitation, according to which data are retained for a period of time no longer than is necessary for the purposes for which they are processed (Article 5, paragraph 1, letter e) of the Regulation). (Principles also referred to, among others, in Decisions No. 472 of 17/07/2024, web doc No. 10053224; Decision No. 255 of 21/07/2022, web doc No. 9809466).

4. Conclusions: Unlawfulness of the processing. Corrective measures pursuant to Article 58, paragraph 2, of the Regulation.

For the above reasons, the Authority believes that the statements made by the data controller during the investigation do not allow the findings notified by the Office with the initiation of the proceeding to be overcome, with reference to Articles 5, paragraph 1, letter e) of the Regulation. Articles 6, 12, 13, and 28 of the Regulation, which are therefore inappropriate for the dismissal of this proceeding. Furthermore, none of the cases provided for in Article 11 of the Regulation No. 1/2019 apply to these matters.

The breach, established in accordance with the grounds set out in the grounds, cannot be considered "minor," taking into account the nature of the breach, which affected the general principles of processing, the obligation to provide adequate information, and the procedure for designating the data controller, the severity and duration of the breach itself, the degree of responsibility, and the manner in which the supervisory authority became aware of the breach (see Recital 148 of the Regulation).

It is recalled that, pursuant to Article 160-bis of the Code, "The validity, effectiveness, and usability in judicial proceedings of acts, documents, and provisions based on the processing of personal data that does not comply with the provisions of law or the Regulation remain governed by the relevant procedural provisions."

Given the corrective powers granted by Article 58, paragraph 2 of the Regulation, in light of the circumstances of the specific case, the following are ordered:

the processing of data contained in the computer database relating to the complainant is prohibited, except as necessary for the exclusive purpose of protecting rights in court, for the time necessary for this purpose, within the limits set out in Article 160-bis of the Code (Article 58, paragraph 2, letter g) of the Regulation);

the application of an administrative pecuniary sanction pursuant to Article 58, paragraph 2, letter g) of the Regulation; 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i) of the Regulation).

It is also believed that the conditions set out in Article 17 of Regulation No. 1/2019 are met.

5. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).

Following the outcome of the proceedings, it appears that Italia Trasporto Aereo S.p.A. violated Articles 5, paragraph 1, letters a), b), c), and e), 6, 12, 13, and 28 of the Regulation.

Violation of the aforementioned provisions is subject to the application of the administrative pecuniary sanction provided for in Article 83, paragraph 4, letter i). (a) and paragraph 5, letters (a) and (b) of the Regulation by issuing an injunction order (Article 18, Law No. 689 of 24 November 1981).

Deemed it necessary to apply Article 83, paragraph 3 of the Regulation, which provides that "If, for the same or linked processing operations, a controller […] infringes several provisions of this Regulation, intentionally or negligently, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement." The total amount of the fine is calculated so as not to exceed the maximum fine provided for in the same Article 83, paragraph 5, of the Regulation.

With reference to the elements listed in Article 83, paragraph 1, 2 of the Regulation for the purposes of applying the administrative fine and its quantification, taking into account that the fine must "in any case be effective, proportionate and dissuasive" (Article 83, paragraph 1 of the Regulation), it is noted that, in this case, the following circumstances were considered:

a) in relation to the nature and severity of the violation, it concerned situations punished more severely pursuant to Article 83, paragraph 5 of the Regulation (the general principles of processing and the obligation to provide information);

b) in relation to the duration of the violation, it continued, with regard to the violation of Articles 5, paragraph 1, letters a), b), c), and e), 12 and 13 of the Regulation, from July 2021 until the present proceedings, while with regard to the violation of Articles 6 and 28 of the Regulation, from 1 March 2023 until the present proceedings;

c) the violations under investigation involved a single data subject (the complainant);

d) with regard to the intentional or negligent nature of the violation and the degree of responsibility of the data controller, the Company's conduct and its degree of responsibility for failing to comply with data protection regulations with respect to a number of provisions were taken into consideration;

e) the Company cooperated with the Authority throughout the proceedings.

Furthermore, it is believed that, given the aforementioned principles of effectiveness, proportionality, and dissuasiveness, which the Authority must adhere to in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the following factors are of primary importance in this case: the financial circumstances of the offender, determined on the basis of the Company's revenues, as per the ordinary financial statements for 2024, the latest available.

In light of the above elements and the assessments made, it is deemed appropriate, in this case, to impose an administrative sanction against Italia Trasporto Aereo S.p.A. in the amount of €190,000.00 (one hundred and ninety thousand).

In this context, it is deemed necessary that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, this Chapter (and therefore the entire Chapter 5) containing the injunction order be published on the Authority's website.

This is in consideration of the type of violations identified, which concerned the general principles of data processing, the obligation to provide adequate information, and the procedure for designating the data processor.

NOW WITH ALL THE FOREGOING, THE GUARANTOR

pursuant to Article 57, paragraph 1, letter 143 of the Code, for violation of Articles 5, paragraph 1, letters a), b), c), and e), 6, 12, 13, and 28 of the Regulation.

ORDERS

pursuant to Article 58, paragraph 2, letter g), of the Regulation, the processing of data contained in the computer database relating to the complainant is prohibited, except as necessary for the exclusive purpose of protecting rights in court, for the time necessary for this purpose, within the limits set forth in Article 160-bis of the Code; ... 58, paragraph 2, letter i), of the Regulations, to pay the sum of €190,000.00 (one hundred and ninety thousand) as an administrative fine for the violations indicated in this order;

ORDERS

also that Italia Trasporto Aereo S.p.A. pay the aforementioned sum of €190,000.00 (one hundred and ninety thousand) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981.

It is recalled that the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half the fine imposed, within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of the appeal as indicated below (Article 166, paragraph 8, of the Code);

ORDERS

- pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, the publication of the injunction order on the website of the Data Protection Authority;

- pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Regulation of the Data Protection Authority No. 1/2019, the publication of this provision on the website of the Data Protection Authority;

- pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and measures adopted in accordance with Article 58, paragraph 2 of the Regulation, in the internal register of the Authority provided for by Article 57, paragraph 1, letter b). u) of the Regulations.

Pursuant to Article 78 of the Regulations, Articles 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days of the date of notification of the decision itself, or sixty days if the appellant resides abroad.

Rome, March 4, 2026

THE PRESIDENT
Stanzione

THE REPORTER
Ghiglia

THE SECRETARY GENERAL
Montuori

[web doc. No. 10229191]

Decision of March 4, 2026

Register of Decisions
No. 151 of March 4, 2026

THE ITALIAN DATA PROTECTION AUTHORITY

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Members, and Councillor Luigi Montuori, Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter, the "Code");

SEEN the complaint submitted by Mr. XX pursuant to Article 77 of the Regulation against Italia Trasporto Aereo S.p.A.;

HAVING EXAMINED the documentation in the file;

HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Guarantor's Regulation No. 1/2000;

REPORTER: Dr. Agostino Ghiglia;

WHEREAS

1. The complaint submitted to the Authority and the investigation.

On July 6, 2023, Mr. XX filed a complaint pursuant to Article 77 of the Regulation against Italia Trasporto Aereo S.p.A. (hereinafter also "ITA" or the "Company").

In the complaint, the complainant alleged that he had served as XX on the Board of Directors of ITA, appointed by the Ministry of Economy and Finance as Sole Shareholder, effective June 18, 2021, with the assignment of certain responsibilities in key areas of the Company. However, following disagreements and disagreements with the CEO and certain members of the Board of Directors regarding the implementation of the Company's privatization, the assigned responsibilities were revoked by resolution of the Board of Directors on October 20, 2022, and the role of Chairman and member of the Board of Directors was revoked by resolution of the ITA Shareholders' Meeting on November 16, 2022.

According to the complaint, the Company allegedly processed data relating to the complainant in violation of personal data protection regulations; In particular, it was complained that the revocation of the powers and positions in question was based on the acquisition, by ITA, of emails, documents and information contained in the email address assigned to the complainant (“XX”) and in the email addresses of two other managers of the Company, through a digital forensics activity entrusted to a third party following the receipt, anonymously and in a sealed envelope, on 10 October 2022, of a copy of an email dated 8 October 2022 exchanged between the complainant, the two aforementioned managers and an external consultant, relating to the privatization operation of the Company.

With a note dated November 22, 2023, the Office invited the complainant to settle the complaint. On that occasion, considering that, with respect to certain aspects raised in the complaint, there were no grounds for the Authority to take action, given Articles 140-bis, 142, 143, and 160-bis of the Code, and Articles 8, 9, and 11 of the Guarantor's Internal Regulation No. 1 of 2019, the Office dismissed the complaint, with reference to the questions relating to the alleged violation of Articles 32, 33, 34, and 28 in relation to a third-party company. This is because, following examination of the complaint submitted to the Guarantor and the attached documentation, relating to the civil challenge to the aforementioned resolution of November 16, 2022, the Office deemed that the subject matter of the complaint was partially "overlapping" with that of the judicial appeal pending between the same parties, since pursuant to Article 140-bis, paragraph 2, of the Code, "a complaint to the Guarantor cannot be lodged if, for the same subject matter and between the same parties, a judicial authority has already been seized."

The aforementioned notice of November 22, 2023, was challenged by the complainant, pursuant to Articles 143, paragraph 4, and 152 of the Code, before the Court of Rome, and the proceedings are still ongoing.

On December 5, 2023, the complainant, in response to the Department's request to regularize its position on November 22, 2023, supplemented the complaint.

Regarding the matters for which the Office decided to initiate an investigation, on March 4, 2024, it submitted a request for information to the Company, pursuant to Article 157 of the Code.

The Company, in a note dated April 12, 2024, provided its response, declaring that:

- "The Company has consistently invested in a culture of data protection, implementing adequate measures and resources to prevent and mitigate potential risks to data subjects and implementing numerous training, review, analysis, research, and communication initiatives, while also systematically engaging with external and specialized legal advisors to gather recommendations and opinions" (see note dated April 12, 2024, p. 2);

- "Two proceedings are currently pending between the Complainant and ITA before the Civil Court of Rome. These concern, respectively, the [Complainant]'s challenge to the resolution of the Board of Directors of October 20, 2022, regarding the revocation of the operational powers of the President [Complainant] and the challenge to the resolution of the ITA Shareholders' Meeting of November 16, 2022, regarding the revocation of the Complainant's positions at ITA. Furthermore, criminal proceedings are also pending before the Court of Rome against the [Complainant] following a complaint filed by ITA for the alleged crime provided for by Article 2634 of the Civil Code." (see cited note, p. 2);

- "The facts at issue in the complaint must be viewed within the context of the aforementioned proceedings" (see cited note, p. 2);

- "The Complainant did not have a managerial employment relationship with ITA, but rather solely a corporate role" (see footnote cited, p. 2);

- "The Complainant had been fully informed of the nature of the processing to which his personal data would be subjected, - given that the policies are made public on the company intranet, even though the Complainant in question cannot be classified as a data subject among the Company's employees, as [...] no employment relationship existed between the parties" (see footnote cited, pp. 2, 3);

- "As of the date of this writing, it is confirmed that the email account assigned to the Complainant [...] has been deactivated" (see footnote cited, p. 3);

- "In accordance with ITA's internal procedures, the email account assigned to the Complainant was disabled on November 16, 2022, at 7:47 PM, and an automatic reply was set up at the same time. Anyone writing to [the Complainant] received an automatic reply informing them that the mailbox was no longer active and requesting them to contact the President directly. At this stage, although the account was able to receive emails, technical measures were implemented to ensure that the employer could not access the account and any communications received" (see note cited, pp. 3, 4);

- "On March 8, 2023, the mailbox was permanently deactivated, and on November 8, 2023, the account was deleted from the Company's archives. The contents of the email archive, however, were not deleted due to the litigation hold status to which it was subjected in consideration of ITA's need to defend itself in the proceedings cited in the preamble" (see note cited above, p. 4);

- "With reference to the checks conducted on the account, prior to its deactivation, however, it is important to note that [following an internal report of wrongdoing, ITA entrusted a leading consulting firm with the task of analyzing the computer data relating to the mailbox, SharePoint, and OneDrive accounts belonging to the current Complainant, aimed at acquiring further evidence in order to evaluate any appropriate action to protect the Company and its sole shareholder, the Ministry of Economy and Finance" (see note cited, p. 4);

- "To this end, the consultants contacted the Information Technology representative, designated by the Company, to initiate data security operations. Specifically, on March 1, 2023, the Company's IT representative logged in (using his administrative credentials) to the Microsoft Purview administrative portal (the space for managing the compliance needs of the IT infrastructure connected to Microsoft 365) to create a specific process within the Microsoft eDiscovery application. This was done to identify the data present in the aforementioned Microsoft applications (email, SharePoint, OneDrive) and subsequently export it. This activity was carried out by the IT representative under the supervision of the consultants to ensure that the extraction operations were carried out correctly from a technical and IT perspective. On the extracted data, the consultants, applying specific keys and search criteria predefined by the Company, proceeded to conduct targeted searches for commercially sensitive data and information" (see note cited, pp. 4, 5);

- "The Complainant's email account is currently retained, with the so-called litigation hold mode activated, for the sole purpose of providing evidence, given the ongoing disputes cited in the introduction. Generally, however, when an employee leaves the company (or, more generally, when the need for an email account ceases), the account is placed in disabled mode for 30 days, with the simultaneous activation of an automatic reply message and the data controller's ability to read it" (see footnote cited, p. 5);

- "The Company does not perform backups of its email archives but adopts the alternative measure of redundancy, resulting in data replication across multiple systems. Therefore, at present, no backup copies have been made of the Complainant's email account" (see footnote cited, pp. 5, 6);

- "Over the years, and from the very first days of the Company's operations, two key documents were prepared to fulfill the information obligation towards data subjects/employees. This applies both to ordinary processing activities, which normally occur during the employment relationship, and to any checks for more pathological cases. The two documents cited are the Policy on the correct and safe use of IT equipment and ICT resources (hereinafter, the "Policy") and the Information on the processing of personal data of employees pursuant to Articles 13 and 14 of the Regulation [...] (hereinafter, the "Information"). Although the two documents cited above are not specifically addressed to the Corporate Bodies, it is important to keep in mind that the behaviors [...] described therein have constituted the guidelines that the Company has always followed, including with respect to XX [the current complainant]" (see note cited, p. 6);

- "There is no doubt that the disclosure obligation has been fulfilled, given that the current Complainant has proven, by the records, that he was aware and aware of the aforementioned documents, which were made available on the company intranet! Indeed, it was [the Complainant] himself who produced them in the context of this procedure, attaching them to the complaint pursuant to Article 77 of the GDPR" (see note cited, p. 7).

On August 7, 2024, the Department sent the Company a second request for information, in order to acquire further information regarding certain specific aspects.

The Company, in a letter dated September 30, 2024, provided its response and, on that occasion, stated that:

- "Following the activation of disabled mode, the email inbox (i.e., the Complainant's digital profile required to access his email inbox) was made inaccessible to any user with the relevant credentials, although it remained enabled to receive emails. This action prevented the Complainant from logging in and possibly modifying the content of his account [...] In the event of new emails being received, an automatic reply message was sent, in which the sender was invited to contact the Complainant by telephone, since the latter could no longer access his email inbox. In any case, any communications received during this phase are contained in the email inbox but cannot be read by anyone with the authentication credentials." (seeNote 30/09/2024 cited, pp. 2, 3);

- "The Complainant's account was permanently deactivated on March 8, 2023, placed in RRL (employment relationship termination) and can no longer log in to the network, and the mailbox no longer receives messages. Therefore, anyone who should have sent communications to the address in question would have received an error message and no longer an automatic response like the one preset by the Company during the disabling phase" (see note cited, p. 3);

- "The cancellation that occurred on November 8, 2023, involved the permanent deletion of the account [assigned to the complainant] from the ITA systems. Therefore, the system no longer contains any information except for the contents of the email inbox, as the litigation hold flag is still active due to the ongoing legal disputes with the Complainant, as already mentioned in the Note. However, it is essential to emphasize that this mode was not enabled at the same time as the cancellation on November 8, 2023, but rather, it occurred shortly after the activation of the disable mode, specifically on November 17, 2022, at 6:14:29 PM" (see note cited above, p. 3);

- "ITA's inaccessibility to the Complainant's email account in disable mode was ensured by the following measures: • the Company did not know the password to access the Complainant's email account […] it is impossible for ITA to access the email accounts of its employees and collaborators, as it does not have the relevant credentials, which are personalized by each user upon initial access; • in addition […], disable mode prevents any access to the email account for which it is activated, and this block is effective against any person who may have access to the credentials of the affected account (for example, any personal assistants and/or secretarial staff); • it is understood that Microsoft makes certain features available only to the System Administrator to be able to access/extract the contents of the mailbox" (see note cited, p. 4);

- "The internal report referred to in the Note [of feedback previously sent by the Company] occurred on October 10, 2022, when an anonymous letter in a sealed envelope containing a printed copy of an email exchange was delivered to a member of the Company's Board of Directors" (see note cited, p. 4);

- "This report therefore triggered the investigation, culminating in forensic work" (see note cited, p. 5);

- "The Company engaged the external consultant PricewaterhouseCoopers Business Services S.r.l. (the "Supplier" or "PWC") to acquire and subsequently analyze certain IT data of ITA, after conducting a specific in-depth analysis of the employment law aspects related to the transaction. The appointed Supplier, with the support of the Company's Information Technology ("IT") representative, extracted the digital data constituting the scope of the activity (the "Medium Copy"); in other words, it created a forensic image of the entire Microsoft Exchange IT database attributable to the Complainant ("Relevant Data"). Specifically, this scope was identified with reference to the period between the creation of the Complainant's email account and March 1, 2023" (see note cited, pp. 5, 6);

- "On March 1, 2023, the Company's IT representative logged into the Microsoft administrative portal in the "eDiscovery/Compliance" section, entering his administrative credentials to create a specific process within the Microsoft eDiscovery application that would allow the export of Relevant Data. It is important to emphasize that during the execution of the operations, the Supplier assisted the IT representative to verify the methodological accuracy and rigor adopted" (see note cited, p. 6);

- "Following the extraction and subsequent transmission of the Relevant Data by the Company, PWC performed the following activities: a) first, using the NUIX forensic software, it applied three (3) specific search criteria to the Medium Copy, identified to answer the questions posed by the Company ("Criteria"); b) following this application of the Criteria, it analyzed the results, selecting only those elements deemed to be of direct interest to the questions posed by the Company; c) finally, it included only these essential elements in the final report, always taking into account ITA's interest expressed through the questions originally posed. It is emphasized that when submitting the final report on the activities performed, the Supplier did not produce any digital copies of the Relevant Data for the Company's benefit" (see cited note, pp. 6, 7);

- "Following the conclusion of the project, which occurred with the finalization of the final report on March 24, 2023 ("Final Report"), a copy of the Relevant Data was retained in the Supplier's archives for a limited period of one month following the end of the activities. Subsequently, the Half Copy and the data processed in the NUIX environment were deleted from PWC's IT systems, and to date, the only document retained by the Supplier is the Final Report" (see cited note, p. 7);

- “Targeted searches on the Relevant Data were conducted by applying the three (3) Criteria defined by the Supplier in agreement with the Company. Specifically, the following keywords were applied: […] “Legal Advisors” or “Legal Advisor” without applying a time filter […] “Financial Advisor” or “financial advisors” or “Engagement Letter”, Without applying a time filter […] Alternatively: “Sardinia”; “Sardinia”; “Sardinia”; “Sardinia”; “Cagliari”; “CAG”; “AZ 330”; “AZ330”; “Without applying a time filter” (see cited note, pp. 7, 8);

- “The task of carrying out the research activities in the manner described for the identification of possible illicit conduct was entrusted to the company PriceWaterhouseCoopers Business Services S.r.l. (“PwC”). For the performance of its services, PwC has been designated as a data processor pursuant to Article 28 of the Regulation, as set out in the appointment agreement (see footnote cited, p. 8);

- "As a partial correction to the provisions of the Policy [on the correct and secure use of IT equipment and ICT resources], ITA does not make data backup copies. To ensure availability and resilience, the email service provider Microsoft ensures that each mailbox database is hosted in a database availability group and replicated in geographically separate data centers within the same area" (see footnote cited, p. 9).

The Company also attached, to the note dated September 30, 2024, a copy of the document entitled "Information on the processing of personal data of employees pursuant to Articles 15 and 16 of the GDPR." 13 and 14 of Regulation (EU) 2016/679 issued by ITA.

2. Initiation of the procedure for the adoption of corrective and sanctioning measures by the Authority.

Based on the statements made and the documentation produced during the investigation, the Office notified the Company of the initiation of the corrective and sanctioning procedure, pursuant to Article 166, paragraph 5, of the Code, for the violation of Articles 5, paragraph 1, letters a), b), c), and e), 6, 12, 13, and 28 of the Regulation (note dated January 29, 2025).

With the defense briefs submitted on February 27, 2025, pursuant to Article 18 of Law No. 689/1981 and Article 166, paragraph 6 of the Code, the Company declared that:

- regarding the contested violation of art. 5, paragraphs 1, 12 and 13 of the Regulation, the Company believes that, given the senior role of the complainant, who became XX as of June 18, 2021, with responsibilities in key sectors for the Company, "it is extremely unlikely that the Complainant, effectively acting in the name and on behalf of the Company and, therefore, as the legal representative pro tempore of the data controller, did not have all the information relating to the personal data processing carried out by the latter. The clarification regarding the recipients of the Information and Policy, provided by the Company in the first response to the Authority sent on April 11, should be read in this light. Indeed, it cannot be argued that these documents were not known to the Company's top management simply because they were not expressly addressed to the Corporate Bodies, but rather to employees and collaborators" (see note 27/02/2025 cited, p. 3);

- furthermore, it was "the [complainant] himself who produced both the Information and the Policy in the context of these proceedings, attaching them to the complaint [...]. It seems at least dubious for a (former) legal representative of the data controller to claim to be unaware of the characteristics of the processing carried out by the data controller himself for the sole reason that the documents containing the necessary information are not expressly addressed to the hybrid category of corporate bodies to which he belonged!" (see note cited, p. 3);

- "with specific reference to the content of the information provided to the data subject, (...) it must be considered that the data subject was able to receive (...) adequate information (...) according to the methods established by law, pursuant to Articles 12 and 13 of the GDPR. In this sense, (…) these documents contain clear and precise information on the processing carried out during the forensic analysis activity involving the Complainant's personal data.More specifically, the Policy expressly mentions the possibility that the Company may process personal data contained in company email accounts, or on other technological devices, "for the purpose of conducting internal checks/audits aimed at determining whether or not unlawful acts/fraud have been committed of which the company has become aware, including through reports" (Policy, pp. 4-5, letter D) (see footnote cited, p. 4);

- the Policy itself specifies that "the processing of information and data relating to the use of IT equipment and ICT resources by users, including temporary storage, may occur for one of the purposes described below: [...] if the processing is necessary to detect unlawful acts [...]; if the processing is indispensable for the exercise or defense of a right in judicial and/or administrative proceedings” (Policy, p. 17, par. 6) and that the only exception to the standard method of conducting anonymous and aggregated checks applies in the event of gross negligence (“If, despite this, such conduct should still take place, ITA will follow the provisions described below to carry out the necessary checks, with the exception of cases where gross misconduct is detected”, Policy, p. 17, par. 6), such as that which, in ITA's opinion, the complainant would have committed, potentially to the detriment of the Company (see cited note, pp. 4-5);

- with regard to the alleged violation of Articles 6 and 28 of the Regulation, due to the failure to sign the document “Deed of Appointment as Data Processor pursuant to Article 28 of European Regulation No. 2016/679 of the European Parliament and of the Council of 27 April 2016”. 2016, as well as European Commission Implementing Decision No. 2021/915 of 4 June 2021,” produced by ITA during the proceedings, “the Company carried out all necessary checks to locate the signed document and be able to prove that there was a regulation of the processing entrusted to the PwC data controller. The search, however, was unsuccessful” (see cited note, p. 5);

- “the data processing agreement that was produced constitutes an annex to the broader contract signed between ITA and PwC, such that it forms an integral and substantial part of it. It should therefore be borne in mind that the parties' intentions could not differ on the content of that document and that, on the contrary, it constitutes, even in the absence of a signature, the terms of the agreements between the parties and the owner's obligations towards the data controller" (see note cited p. 6);

- "the previous responses provided by ITA in relation to the requests for information formulated by the Authority illustrated in detail the methods by which the supplier PwC had performed the services commissioned from it. The description of these methods […] appears consistent with the instructions given by the owner in the designation deed pursuant to art. 28 of the GDPR produced at that time, even if not signed by the parties, and, even more so, with best practices and the highest standards aimed at protecting the rights of data subjects in any case, balancing them with ITA's need to be able to actively seek evidence to defend itself in court against proven and serious conduct that has occurred to the detriment of the Company" (see note cited, p. 6);

- "the absence of a signed designation deed [is] in any case to be considered overcome by the conclusive conduct of both parties, data controller and data processor, who have regulated their respective roles and have interpreted, each for their part, in full and strict compliance with that shared framework of rules" (see note cited, p. 7);

- with regard to the alleged violation of Article 5, paragraph 1, letters b), c), and e) of the Regulation, "the digital forensics activity was carried out by PwC on behalf of ITA in compliance with the standards and industry best practices, as well as in line with the Company's internal procedures, as highlighted in the Policy and the Disclosure. Specifically, the extraction of digital data contained in the Microsoft Exchange database relating to [complainant] was not limited to the time period corresponding to the period of performance of XX's office on the Board of Directors of ITA for a very specific reason. The Company should, in fact, have conducted all necessary investigations to verify the validity of the findings of the anonymous report received by ITA" (see note cited, pp. 7-8);

- "the retention of the contents of the then President's email account cannot follow the ordinary retention rules that must apply to all employees. And this is even more true at a time in history, such as that in which the [complainant] held the position of XX, in which ITA and its sole shareholder, the Ministry of Economy and Finance, were engaged in managing the privatization process, including the related search for a commercial partner on the international market” (see note cited, p. 8);

- “PwC did not send any digital copy of the Forensic Image to the Company, but only the final report of the operations, containing only the essential selection of the results of the investigations” (see note cited, p. 9);

- “the breach would have concerned exclusively one data subject, against whom the digital forensics activities were carried out. In any case, the personal data made available to ITA do not belong to the special categories referred to in Article 9, paragraph 1, of the GDPR.” 1, GDPR, nor do they concern criminal convictions, offenses, or related security measures” (see note cited, p. 9);

- “any form of intent or representation of possible violations of the personal data protection legislation must be excluded, as they can only be considered, at most, as consequences of purely negligent conduct” (see note cited, pp. 9, 10);

- “it is required to evaluate […] the context in which the Company had to react to the seriousness of the circumstances that had arisen, of which the Company became aware exclusively through the anonymous report submitted in a sealed envelope, as well as the consequent and absolute necessity for the Company to proceed with internal investigations, resulting in the digital forensics activities entrusted to PwC, in order to adequately protect the public position of ITA, seriously exposed to prejudicial consequences, including in the context of the search for a private partner” (see note cited, p. 10);

- “the Company has dedicated significant resources to disseminating a solid culture of data protection, adopting measures and tools aimed at preventing and reducing potential risks to data subjects. Of relevance here, these include, inter alia: i) the adoption of internal procedures aimed at the proper management of processes with a significant potential impact on personal data protection (data breach management policy; personal data retention policy; internal procedure for the proper use of ICT tools and systems); ii) the appointment and related instructions for those authorized to process personal data pursuant to Articles 29 of the GDPR and 2 of the Privacy Code; iii) the appointment of a Data Protection Officer; (iv) the preparation of detailed and timely corporate policies on data protection issues" (see note cited, pp. 10, 11).

On March 26, 2025, the hearing of the party requested by the party itself took place, during which it was stated, among other things, that:

- "the second verification, which took place on March 1, 2023, concerned only the [complainant's] account";

- the Company "is aware that it was able to better manage the process of appointing the data controller and is willing to make amends for it."

On May 29, 2025, the Company, in response to the reservation expressed during the hearing, sent what it called an "extract of the final report" prepared by Price Waterhouse Coopers Business Services S.r.l.

3. The outcome of the investigation and the procedure for adopting corrective measures and sanctions.

Following an examination of the statements made by the parties during the proceedings, as well as the documentation acquired—aside from the matters archived with the notice of November 22, 2023, which, consequently, were not subject to investigation—it appears that the Company, as data controller, has carried out certain processing operations that do not comply with the regulations on the protection of personal data.

In this regard, it is noted that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false documents or records, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority."

3.1. The applicable regulatory framework.

The processing of personal data must be carried out in accordance with the principles set forth in Article 5 of the Regulation, including the principle of transparency and the principle of fairness (Article 5, paragraph 1, of the GDPR). (a) of the Regulation).

Article 5(2) of the Regulation provides that "the controller shall be responsible for and able to demonstrate compliance with paragraph 1 ('accountability')".

Article 6 of the Regulation sets out an exhaustive list of the conditions for lawfulness of processing for so-called common data.

According to Article 12 of the Regulation, "the controller shall take appropriate measures to provide the data subject with any information referred to in Articles 13 and 14, and any communication referred to in Articles 15 to 22 and Article 34 relating to processing, in a concise, transparent, intelligible and easily accessible form, using clear and plain language […]. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. Where requested by the data subject, the information may be provided orally, provided that the data subject's identity is proven by other means."

Article 13 of the Regulation requires the data controller to provide the data subject with at least the information relating to the processing set out in that provision. This must be done before the processing is carried out.

Article 28 of the Regulation provides, among other things, that "processing by a processor shall be governed by a contract or other legal act under Union or Member State law, binding on the processor with respect to the controller and setting out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller."

3.2. Violation of Articles 5(1)(a), 12, and 13 of the Regulation.

First, it should be noted that, regardless of the nature of the relationship between the Company and the complainant, the processing of the data subject's personal data is attributable to the Company, which acted as data controller, according to the definition in Article 4, paragraph 1, no. 7 of the Regulation ("data controller: the natural or legal person [...] who, alone or jointly with others, determines the purposes and means of the processing of personal data").

The preliminary investigation revealed that the Company accessed the computer data "relating to the mailbox, SharePoint, and OneDrive accounts of the [...] Complainant," including through digital forensics performed by Price Waterhouse Coopers Business Services S.r.l. In order to obtain evidence of possible unlawful conduct by the same to be used in legal proceedings to protect the Company and its sole shareholder, the Ministry of Economy and Finance (see note dated September 30, 2024, pp. 5, 6).

Given the processing carried out, it was found that the Company had not adequately informed the data subject before it was implemented, nor that the data subject had otherwise become aware of it before the processing began.

The Company has not proven that the documents "Information on the Processing of Employees' Personal Data Pursuant to Articles 13 and 14 of EU Regulation 2016/679," "Main Security Rules and the Use of Information Systems," and "Policy on the Correct and Safe Use of IT Equipment and ICT Resources," nor any other similar information documents, had been provided to the complainant before the processing in question was implemented.

In this regard, the Company's argument that the production of such documents as an attachment to the complaint constitutes evidence that the complainant was aware of the relevant content before the processing was carried out, and therefore that the Company fulfilled its disclosure obligation, must be rejected. Nor does the fact that the complainant served as the Company's legal representative constitute, in itself, evidence that the provisions of Article 13 of the Regulation were properly fulfilled (see note dated February 27, 2025, p. 3).

Furthermore, while the Company confirmed during the investigation that the cited documents did not concern the processing of data of positions such as that held by the complainant, who, as it specified, "did not have a subordinate employment relationship of a managerial nature with ITA but merely held a corporate role" (see note dated April 12, 2023, p. 2) (this fact is also evident from a reading of the same documents, which are expressly addressed to employees and collaborators), on the other hand, while maintaining that "the conduct [...] described therein constituted the guidelines that the Company has always followed, including with respect to XX [current complainant]" (see note dated April 12, 2024, p. 6), the Company did not provide evidence that the content of the cited documents also applies to the complainant's data.

Furthermore, no evidence was provided of the publication of the aforementioned documents on the company intranet, nor that, through such publication, the complainant would have become aware of the processing in question.

In any case, the analysis above shows that the information documents prepared by the Company, entitled "Information on the Processing of Employees' Personal Data Pursuant to Articles 13 and 14 of EU Regulation 2016/679" and "Policy on the Correct and Safe Use of IT Equipment and ICT Resources," describe certain processing activities that do not comply with personal data protection regulations.

In particular, with reference to the specific subject of this provision, the provisions of point D "legitimate interest of the Data Controller" of the aforementioned information (pp. 4, 5) are not considered to be compliant with the general principles regarding the protection of personal data, a point referred to by the Company (see note 27/02/2025, p. 4) where it is specified that "your personal data may also be processed, without the need for your consent, in the following cases: - for the purposes of carrying out internal checks/audits aimed at ascertaining the possible commission of unlawful acts/fraud and/or alleged violations of obligations related to the employment relationship of which the company has become aware, including through reports, in accordance with company regulations and in compliance with the principles established by the legislation on the protection of personal data; - in compliance with the applicable legislation, your personal data possibly present in email messages contained in the company mailbox(es) assigned to you for use, as well as on the technological equipment that the company will make available to you, may be processed for the purposes of carrying out checks internal investigations/audits aimed at determining whether or not illegal/fraudulent acts of which the company has become aware have occurred, including through reports and/or alleged violations of obligations related to the employment relationship.

Furthermore, again with reference to the specific subject of this provision, certain activities described in the document "Policy on the correct and safe use of IT equipment and ICT resources" (pp. 16 and 17) are also deemed not to comply with the general principles of data processing (see "in the event that incorrect and/or contrary behavior to this policy persists, ITA will carry out appropriate checks on an individual basis, reserving the right to take appropriate measures").

In this regard, it is emphasized that the rationale behind the provisions of art. 13 of the Regulation is to provide data subjects with clear, data protection-compliant information on the processing that the data controller will implement with respect to the personal data of the individuals to whom they refer. Therefore, in order to comply with the provisions of the aforementioned article, it is not sufficient to inform the data subject of the essential characteristics of the processing; the information provided must describe processing operations that are per se lawful, and therefore compliant with, among other things, the principles of lawfulness, data minimization, and storage limitation (see "Guidelines for e-mail and internet," Order No. 13 of March 1, 2007, Web Document No. 1387522).

The processing of personal data carried out by the Company must therefore be considered unlawful as it violates Articles 5, paragraph 1, letter a), the transparency principle, and Articles 12 and 13 of the Regulation.

The Company's conduct also violated the principle of fairness (Article 5, paragraph 1, letter a), of the Regulation), given that providing adequate information, even in the context of relationships with corporate figures—such as, in this case, the Chairman of the Board of Directors—is an expression of the general principle of good faith and fairness.

The Company's conduct, therefore, violated Articles 5, paragraph 1, letter a) (principles of transparency and fairness), 12, and 13 of the Regulation.

3.3. Violation of Articles 6 and 28 of the Regulation

As emerged during the investigation, the Company engaged the external consulting firm Price Waterhouse Coopers Business Services S.r.l. to carry out digital forensics for the complainant.

The Company declared that Price Waterhouse Coopers Business Services S.r.l. processed the complainant's data, as data controller, on the basis of the document produced by the Company entitled "Deed of Appointment as Data Controller pursuant to Article 28 of European Regulation No. 2016/679 of the European Parliament and of the Council of 27 April 2016, as well as Implementing Decision No. 2021/915 of the European Commission of 4 June 2021" (Annex 1 to the note dated 30/09/2024).

However, it emerged that the aforementioned document was not signed by the parties. Nor was the Company able to locate and produce a signed copy of this document during the proceedings ("The Company carried out all appropriate checks to locate the signed document and to be able to prove that there was a regulation of the processing entrusted to the PwC data controller. The search, however, was unsuccessful," see note dated 27 February 2025, p. 5).

Therefore, the document produced cannot serve as evidence of compliance with the provisions of Article 28 of the Regulation, regarding the designation of Price Waterhouse Coopers Business Services S.r.l. as data processor.

Furthermore, the Company's assertion that the lack of signature on the deed of appointment as data processor is compensated for by the fact that this document "constitutes an annex to the broader contract signed between ITA and PWC, such as to form an integral and substantial part thereof" is devoid of merit—and in any case lacking supporting evidence. It should therefore be borne in mind that the parties' intentions could not differ on the content of that document and that, on the contrary, it constitutes, even in the absence of its signature, the terms of the agreements between the parties and the data controller's obligations towards the data processor" (see note dated February 27, 2025, p. 6).

Furthermore, the Company itself, during the hearing on March 26, 2025, acknowledged "that it could have better managed the process of appointing the data processor and is willing to make amends."

Considering this, it is recalled that the processing carried out by the controller through the data processor is lawful if and to the extent, among other things, that the appointment of the data processor was made in compliance with the provisions of Article 28 of the Regulation. If the procedure for appointing the data processor has not been followed, the processing cannot be considered to be carried out in compliance, with regard to so-called shared data, with Article 6 of the Regulation, which establishes the conditions for lawfulness of processing.

The conduct, therefore, violated Articles 6 and 28 of the Regulation.

3.4. Violation of Article 5, paragraph 1, letters b), c), and e) of the Regulation.

It was also found that the Company processed the complainant's data in violation of data protection regulations, specifically because, through Price Waterhouse Coopers Business Services S.r.l., it carried out processing operations in violation of Article 5, paragraph 1, letters b), c), and e), of the Regulation. Specifically, "a forensic image of the entire Microsoft Exchange database relating to the Complainant (the "Relevant Data") was created. Specifically, this scope was identified with reference to the period between the creation of the Complainant's email account and March 1, 2023" (see note dated September 30, 2024, pp. 5, 6).

According to the Company's statement, "the extraction of digital data contained in the Microsoft Exchange database relating to [the complainant] was not limited to the time period corresponding to the period during which XX held office on the Board of Directors of ITA" (see note cited, pp. 7-8).

The Company's assertion that the principles of data minimization and purpose limitation pursuant to Article 5, paragraph 1, letters c) and b), were not violated, is without merit, as "following the processing of the Forensic Image, only three specific search criteria were applied, corresponding to the questions posed by the Company for the purposes of the investigation" and "the search results were carefully selected so that the Company could only access the elements of strict interest related to the questions posed, and in any case always in accordance with the purposes of the ongoing investigation" (see note dated February 27, 2025, p. 9).

Indeed, it emerged that the Company accessed the entire computer database relating to the complainant, containing data spanning a period of approximately 21 months, from at least July 2021 (as it emerged that the Company extracted some emails from July 2021, as evidenced by the extract from the final report prepared by Price Waterhouse Coopers Business Services S.r.l., submitted by the Company on May 29, 2025, following the hearing) until, as the Company itself stated, March 1, 2023.

Indeed, according to the Company's statement, "on March 1, 2023, the Company's IT representative accessed the Microsoft administrative portal in the "eDiscovery/Compliance" section, entering his administrative credentials, in order to create a specific process within the Microsoft eDiscovery application that would allow the export of Relevant Data" (see note dated September 30, 2024, p. 6).

In any case, the digital forensics activity, despite the Company specifying that the need to examine the complainant's data arose after receiving an anonymous report, did not exclusively concern the data and information acquired after the suspicion of unlawful conduct arose, but encompassed the entire set of data and information in the complainant's computer database, starting at least from July 2021 (i.e., shortly after he took up his duties for the Company) and even after his termination. This confirms that processing was already being carried out by the Company prior to receiving the report of October 10, 2022.

Furthermore, the Company's assertion that, in this case, "the retention of the content of the then President's email account cannot follow the ordinary retention rules that must apply to all employees" (see note dated February 27, 2025, p. 8) is deemed to be without merit.

Holding corporate offices, in fact, does not nullify the right to personal data protection. The need to comply with the general principles established by law and the requirement that the data controller, when carrying out processing operations, balance the rights and interests at stake, in compliance with the principle of proportionality, always exist, even when the data refers to the chairman of a board of directors.

Article 4 (1) specifies that the personal data being processed and for which the guarantees established by law are recognized is "any information relating to an identified or identifiable natural person ('data subject')".

It is also emphasized that the content of emails—as well as external communication data and attached files—even in the case of individualized corporate email accounts, concern forms of correspondence supported by guarantees of confidentiality also protected by the Constitution, whose rationale lies in protecting the essential core of human dignity and the full development of personality in social groups; Further protection is provided by criminal law provisions protecting the inviolability of confidentiality (Articles 2 and 15 of the Constitution; Constitutional Court, July 17, 1998, No. 281, and March 11, 1993, No. 81; Article 616, paragraph 4, of the Criminal Code; Article 49 of the Digital Administration Code).

In light of the above considerations, it is therefore believed that the Company's conduct violated the data minimization principle set forth in Article 5, paragraph 1, letter c), of the Regulation, according to which the data controller must process only data that is "adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed," and the purpose limitation principle, according to which "personal data shall be collected for specified, explicit, and legitimate purposes" (Article 5, paragraph 1, letter b), of the Regulation); as well as the principle of storage limitation, according to which data are retained for a period of time no longer than is necessary for the purposes for which they are processed (Article 5, paragraph 1, letter e) of the Regulation). (Principles also referred to, among others, in Decisions No. 472 of 17/07/2024, web doc No. 10053224; Decision No. 255 of 21/07/2022, web doc No. 9809466).

4. Conclusions: Unlawfulness of the processing. Corrective measures pursuant to Article 58, paragraph 2, of the Regulation.

For the above reasons, the Authority believes that the statements made by the data controller during the investigation do not allow the findings notified by the Office with the initiation of the proceeding to be overcome, with reference to Articles 5, paragraph 1, letter e) of the Regulation. Articles 6, 12, 13, and 28 of the Regulation are therefore inappropriate for the dismissal of this proceeding. Furthermore, none of the cases provided for in Article 11 of the Regulation No. 1/2019 apply to these matters.

The breach, established in accordance with the grounds set out in the grounds, cannot be considered "minor," taking into account the nature of the breach, which affected the general principles of processing, the obligation to provide adequate information, and the procedure for designating the data controller, the severity and duration of the breach itself, the degree of responsibility, and the manner in which the supervisory authority became aware of the breach (see Recital 148 of the Regulation).

It is recalled that, pursuant to Article 11 of the Regulation, Article 160-bis of the Code provides, "The validity, effectiveness, and usability in judicial proceedings of acts, documents, and provisions based on the processing of personal data that does not comply with the provisions of law or the Regulation shall remain governed by the relevant procedural provisions."

Given the corrective powers granted by Article 58, paragraph 2 of the Regulation, in light of the circumstances of the specific case, the following is ordered:

the prohibition of processing the data contained in the computer database relating to the complainant, except as necessary for the exclusive purpose of protecting rights in court, for the time necessary for that purpose, within the limits set forth in Article 160-bis of the Code (Article 58, paragraph 2, letter g) of the Regulation);

the application of an administrative pecuniary sanction pursuant to Article 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i) of the Regulation).

It is also believed that the conditions set forth in Article 17 of Regulation No. 1/2019 are met.

5. Adoption of the injunction order for the application of the administrative pecuniary sanction and accessory sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).

Following the outcome of the proceedings, it appears that Italia Trasporto Aereo S.p.A. violated Articles 5, paragraph 1, letters a), b), c), and e), 6, 12, 13, and 28 of the Regulation.

Violation of the aforementioned provisions is subject to the application of the administrative pecuniary sanction provided for in Article 83, paragraph 4, letter a), and paragraph 5, letter c). (a) and (b) of the Regulation by issuing an injunction order (Article 18, Law No. 689 of 24 November 1981).

Deemed it appropriate to apply Article 83(3) of the Regulation, which provides that "If, for the same or linked processing operations, a controller […] infringes several provisions of this Regulation, intentionally or negligently, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement." The total amount of the fine is calculated so as not to exceed the maximum fine provided for in the same Article 83(5) of the Regulation.

With reference to the elements listed in Article 83, paragraph 2 of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must "in any case be effective, proportionate and dissuasive" (Article 83, paragraph 1 of the Regulation), it is noted that, in this case, the following circumstances were considered:

a) in relation to the nature and severity of the violation, it concerned cases punished more severely pursuant to Article 83, paragraph 5 of the Regulation (the general principles of processing and the obligation to provide information);

b) in relation to the duration of the violation, it continued, with regard to the violation of Articles 5, paragraph 1, letters a), b), c), and e), 12 and 13 of the Regulation, from July 2021 until the present proceedings, while with regard to the violation of Articles 5, paragraph 1, letters b), c), and e), 12 and 13 of the Regulation, it lasted from July 2021 until the present proceedings. 6 and 28 of the Regulation, from March 1, 2023 until the present proceedings;

c) the violations under investigation involved a single data subject (the complainant);

d) with regard to the intentional or negligent nature of the violation and the degree of responsibility of the data controller, the Company's conduct and its degree of responsibility for failing to comply with data protection regulations with respect to a number of provisions were taken into consideration;

e) the Company cooperated with the Authority throughout the proceedings.

Furthermore, it is believed that, given the aforementioned principles of effectiveness, proportionality, and dissuasiveness, which the Authority must adhere to in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the following are of primary importance in this case: the financial circumstances of the offender, determined on the basis of the Company's revenues, based on the ordinary financial statements for 2024, the latest available.

In light of the above elements and the assessments made, it is deemed appropriate, in this case, to impose an administrative sanction against Italia Trasporto Aereo S.p.A. in the amount of €190,000.00 (one hundred and ninety thousand).

In this context, it is deemed necessary that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, this Chapter (and therefore the entire Chapter 5) containing the injunction order be published on the Authority's website.

This is in consideration of the type of violations identified, which concerned the general principles of data processing, the obligation to provide adequate information, and the procedure for designating the data processor.

NOW WITH ALL THE FOREGOING, THE GUARANTOR

pursuant to Article 57, paragraph 1, letter 143 of the Code, for violation of Articles 5, paragraph 1, letters a), b), c), and e), 6, 12, 13, and 28 of the Regulation.

ORDERS

pursuant to Article 58, paragraph 2, letter g), of the Regulation, the processing of data contained in the computer database relating to the complainant is prohibited, except as necessary for the exclusive purpose of protecting rights in court, for the time necessary for this purpose, within the limits set forth in Article 160-bis of the Code; ... 58, paragraph 2, letter i), of the Regulations, to pay the sum of €190,000.00 (one hundred and ninety thousand) as an administrative fine for the violations indicated in this order;

ORDERS

also that Italia Trasporto Aereo S.p.A. pay the aforementioned sum of €190,000.00 (one hundred and ninety thousand) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981.

It is recalled that the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half the fine imposed, within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of the appeal as indicated below (Article 166, paragraph 8, of the Code);

ORDERS

- pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, the publication of the injunction order on the website of the Data Protection Authority;

- pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Regulation of the Data Protection Authority No. 1/2019, the publication of this provision on the website of the Data Protection Authority;

- pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and measures adopted in accordance with Article 58, paragraph 2 of the Regulation, in the internal register of the Authority provided for by Article 57, paragraph 1, letter b). u) of the Regulations.

Pursuant to Article 78 of the Regulations, Articles 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days of the date of notification of the decision itself, or sixty days if the appellant resides abroad.

Rome, March 4, 2026

THE PRESIDENT
Stanzione

THE REPORTER
Ghiglia

THE SECRETARY GENERAL
Montuori