Garante per la protezione dei dati personali (Italy) - 10233328

GPDP - 10233328
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(1)(d) GDPR Article 5(1)(e) GDPR Article 12 GDPR Article 13 GDPR Article 15 GDPR Article 88 GDPR Art. 114 d. lgs. 196/2003
Type:	Complaint
Outcome:	Upheld
Started:	20.06.2023
Decided:
Published:
Fine:	50,000 EUR
Parties:	ITAS Mutua S.p.a.
National Case Number/Name:	10233328
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	carloc

The DPA fined an insurance company €50,000 for providing a former employee with an incomplete copy of the contents of his email account, and for violations related to the storage of metadata and the handling of inactive email accounts.

English Summary

Facts

The case involves an insurance company (the controller) and a former employee (the data subject).

After the end of the employment relationship, the data subject informally asked the controller to access his nominative email. At first, the controller denied access to the email account. Instead, the controller sorted out the contents of the account as “personal” and “non-personal communications” and provided the data subject with a copy of the “personal” communications only.

The data subject later reiterated his request by formally filing a request to receive a copy of all the contents of his email account. In the communications that followed, controller and data subject arranged to a meet in which the data subject would go through his email under supervision (allegedly to protect confidential information) and find the emails, of which he needed a copy.

Even after the meeting, the data subject was only provided with part of the data set: the controller witheld or redacted some of the data, allegedly to protect the data of third parties and to protect its trade secrets. So, the data subject filed a complaint with the DPA, claiming that his access request was not properly honored.

In its defense, the controller pointed to Article 15(4) GDPR: “the right to obtain a copy (...) shall not adversely affect the rights and freedoms of others”. In the controller’s view, the rights of others included both the protection of the data of third parties, and the protection of trade secrets. On these grounds, the controller claimed that it rightfully witheld certain data from the data subjecs.

In the procedure that followed, the DPA investigated not only the controller’s response to the access request but also its handling of employees’ email accounts in general as well as its policies for the retention of email metadata.

Holding

Overall, the DPA held that the controller violated Articles 5(1), 12, 13, 15, and 88 GDPR as well as Article 114 of the Italian data protection code. The DPA issued a €50,000 fine and ordered the controller to stop the infringements.

On the access request

First of all, the DPA clarified that the right to privacy, as sanctioned by Article 8 of the European Convention on Human Rights (ECHR), also covers an invidual’s workplace email. For this reason, the controller had no grounds to pre-emptively sort out the contents of the data subject’s email account.

Likewise, the DPA clarified that the distinction between “personal” and “non-personal” emails was flawed. In the DPA’s view, even strictly professional emails constituted personal data for the data subject, as long as they had transited through his email. So, the data subject had a right to receive a copy of the data under the GDPR.

With regards to Article 15(4) GDPR, the DPA conceded that a controller could, in principle, withold certain information from the response to an access request, in order to protect trade secrets or personal data data of third parties.

However, the DPA held that a controller may only rely on this exemption when it can prove, on a case-by-case basis, that honoring an access request would actually compromise trade secrets or the data of third parties. The controller failed to do so in the case at hand: rather, it merely invoked the protection of trade secrets and the privacy of third parties as generic preoccupations. On these grounds, the DPA held that the controller unlawfully witheld data from the data subject.

The DPA also observed that redacting personal data from certain emails was entirely unnecessary, as the data subject was himself a part of the communications and, presumably, already knew the redacted names.

On these grounds, the DPA held that the controller unlawfully violated Article 12 and 15 GDPR.

On the storage of inactive email accounts

As mentioned above, the investigation also touched on the controller’s general handling of employees’ emails. During the procedure the DPA found that at the end of the employment relationship, the controller first deactivated the email accounts of former employees and then backed up the contents for five years.

The controller claimed that this storage period was both necessary and proportionate. In this regard, the controller noted that as an insurance company, it needed to preserve information in order to demonstrate compliance with sector-specific regulation.

The DPA, however, held that backups of email accounts are not suitable systems for document retention, as they cannot guarantee that documents remain unaltered. Furthermore, the DPA noted that such backups required the controller to sift through employees’ personal communication in order to recover documents. In the DPA’s eyes, this practice was excessively invasive of the privacy of former employees.

For these reasons, the DPA held that the controller violated Articles 5(1)(b), (c), and (e) GDPR. The DPA also found that the controller failed to inform employees that their inactive email accounts would be stored for five years, in violation of the controller’s transparency obligations under Article 13 GDPR.

On the storage of email metadata

The DPA finally looked into the controller’s handling of email metadata. The investigation found that the controller stored metadata logs for 12 months. The controller claimed that the practice was needed to both ensure the security of the company’s information system, and to defend the controller’s rights against “abuses”.

The DPA held that the controller held metadata for too long. Additionally, the DPA held that the controller violated Article 88 GDPR by processing metadata logs for purposes other than those, permitted under Italian labor law.

On these grounds, the DPA held that the controller violated Articles 5(1) and 88 GDPR as well as Article 114 of the Italian data protection code.

Comment

The findings on metadata retention can be better understood in light of the DPA’s (somewhat convoluted) case law and guidelines on both workplace surveillance and email metadata retention.

In Italian law, workplace surveillance is broadly regulated by the so-called “Workers’ Statute” (law 300/1970). The DPA frequently refers to the Statute in workplace surveillance cases: in the DPA’s view, when workplace surveillance violates the Statute, the processing of personal data also violates the GDPR’s principle of lawfulness as well as Article 88 GDPR (i.e. the "opening clause" for national employment law).

Under Article 4 of the Statute, any system, which may result in the remote surveillance of workers, must (with narrow exemptions) meet two requirements:

• First, the system must be implemented only for the purposes listed by the Statute itself (namely: organisational and production needs; workplace safety; and the protection of company assets)
• Second, the system requires either an agreement with trade union representatives or an authorization from the National Labor Inspectorate.

As mentioned above, the Statue allows for narrow exemptions to the authorization regime of Article 4. The DPA holds that such exemptions may cover, among others, the retention of email metadata, on the conditions that the retention period is reasonable. In this regard, the DPA’s guidelines cite 21 days as the upper boundary for storing email metadata (albeit as a mere rule-of-thumb). In the case at hand, the controller grossly violated this term by storing the data for a year.

Furthermore, in this case the controller stored email logs for two distinct purposes: protecting its information system, and “preventing abuses”. In the DPA’s view, the latter purpose did not fall among the lawful purposes of workplace surveillance listed by the Statute. On these grounds, the DPA found a distinct violation: the controller processed data for an unlawful purpose, in violation of the purpose limitation principle.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

SEE ALSO Newsletter of April 15, 2026


[web doc. no. 10233328]

Measure of March 12, 2026

Register of Measures
No. 165 of March 12, 2026

THE ITALIAN DATA PROTECTION AUTHORITY

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Members, and Dr. Claudio Filippi, Deputy Secretary General;

CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the "Code");

HAVING SEEN the complaint filed by Mr. XX, pursuant to Article 77 of the Regulation, against ITAS Mutua;

HAVING EXAMINED the documentation in the file;

HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Regulation of the Guarantor No. 1/2000;

RAPPORTEUR: Professor Ginevra Cerrina Feroni;

WHEREAS

1. The initiation of the preliminary investigation following the filing of the complaint.

In his complaint filed with this Authority on July 20, 2023, Mr. XX reported a violation of personal data protection regulations by ITAS Mutua (hereinafter "the Company"), his former employer. Specifically, the complaint consisted of a response deemed inappropriate to the request to exercise his rights pursuant to Article 15 of the Regulation.

In particular, the complainant stated that, following the termination of his employment relationship with the Company, he requested access to the personal documents and folders stored on his computer and in the company email address used during his employment (certified emails dated May 2, 2022 and May 9, 2022).

During meetings held at the Company's headquarters on May 6, 2022, and May 26, 2022, the Company allowed desktop access and the retrieval of personal documents, but email access was denied for unspecified technical reasons.

During the meeting held on June 16, 2022, the Company delivered "only personal mail, such as exchanges with family members, personal CUs, and expense reimbursements," while "other work-related emails and/or documents deemed by ITAS representatives to be non-personal" were not delivered (minutes of the meeting of June 16, 2022).

The complainant, therefore, filed a request to exercise his rights pursuant to art. 15 of the Regulation, formally requesting the Company to receive "a copy of all emails in the email inbox (...) from March 1, 2021 onwards" as well as other documentation pertaining to the employment relationship (request dated July 15, 2022).

A further meeting was then scheduled, during which the Company "delivered to the interested party a USB stick containing the requested documentation (...)", reserving the right to provide the emails identified during the meeting at a later date, "duly anonymized with regard to personal data pertaining to third parties" (minutes of September 22, 2022).

The correspondence in the email account was finally delivered to the complainant on September 29, 2022, "redacted of many elements."

In light of the above, the Office submitted a request for information to the Company pursuant to art. 157 of the Code (note dated 08/11/2023), to which the Company responded in a note dated 06/12/2023, stating that:

-    "On 04/11/2022, the company email account assigned to the interested party was deactivated with the activation of the automatic reply message addressed to third parties, and was then permanently deleted on 04/25/2022";

-    "On 05/26/2022 and 06/16/2022, specific meetings took place in which the [complainant] was able not only to recover his personal belongings, but also to access his email inbox (...). To this end, the Company performed a restore from the backup system on a dedicated laptop";

-    “Nonetheless, on July 15, 2022, the interested party submitted, through his legal representative, a request for access to personal data pursuant to Article 15 of the GDPR, requesting copies of various documentation. (…)”;

-    “On September 22, 2022, a further appointment was held to allow the [complainant] access to his email inbox. He was informed that this meeting would take place side by side to ensure that the complainant did not come into possession of confidential company data and information, allowing access and copies only of the personal data relating to the interested party.”

Regarding the methods and retention periods for messages sent to company email accounts, the Company noted that:

- "Upon termination of employment, the email databases are deactivated through a dedicated automated Identity & Access Management system. Disabling the account triggers an automatic message to all senders. The email account remains deactivated for 14 days and is then automatically deleted from the online systems, remaining stored in the backup system for 5 years."

- "As an employee of the Company, the complainant received the information on the processing of personal data upon hiring, in accordance with the applicable regulations at the time."

- "In addition to the privacy notice, the complainant also received the deed of appointment as data processor pursuant to Article 30 of the Code (...); due to the specific role held by [the complainant], on October 20, 2021, the Company provided the complainant with the deed of appointment as "Internal Contact Person to Support the DPO," receiving further specific instructions regarding the data processing activities assigned to him."

The note also included, as an attachment, the notice, signed by the complainant on January 23, 2012, and the appointment as data processor pursuant to Article 30 of the Code. 30 of the Code (in the wording prior to the amendments introduced by Legislative Decree No. 101 of August 10, 2018), and the appointment of "Internal Contact Person to Support the DPO," dated October 20, 2021, in addition to the document containing the "Rules for the Use of Company Tools" dated June 28, 2019.

In particular, an examination of the document containing the "Rules for the Use of Company Tools" (Annex 4 to the note dated December 6, 2023) revealed that:

- "Upon termination of the employment relationship, the email inbox will be blocked for incoming and outgoing messages. The content of the email will be blocked and access will be permitted only to the data controller or, upon his/her mandate, the IT technical assistant, only for access to data for the possible protection of the rights of the data subject or the data controller" (point 5.22 of the aforementioned Rules);

- "For this reason, the data controller/authorized data processor is informed that the transmission is controlled by the data controller and that the messages sent and received are automatically saved on company IT systems for the time necessary to fulfill the indicated purposes. Subsequently, they will be retained and not further processed, as documented in our Data Processing Register. The retention period may vary significantly based on: the purpose, the type of data processed, and legal obligations (...)" (point 5.23 of the Rules cited);

- "ITAS, in compliance with the provisions of the Privacy Guarantor (...) and Article 4 of the Workers' Statute (...), may carry out checks on the electronic tools granted for use (PCs and archived data, email, Internet access, telephone, etc.) if necessary" (paragraph 7, no. 1, Rules cited).

In light of the above, the Office submitted a further request for information, pursuant to Article 13 of the GDPR. 157 of the Code, requesting information on the purposes, methods (with particular reference to timeframes), and legal basis for the retention of messages sent to company email accounts assigned to employees, as well as any compliance with the industry regulations regarding remote monitoring pursuant to Article 4 of Law No. 300 of 1970, referred to in Article 114 of the Code (note dated April 3, 2024).

The Company, in its note dated May 2, 2024, stated that:

- "Messages sent to employees' email accounts are retained with adequate security measures following a risk assessment, as documented in the Data Processing Register. Email backups are retained for a maximum period of five years. The Data Controller (...) intended to retain the data within the indicated timeframes, deeming them appropriate for compliance with the principles of necessity, relevance, and non-excessiveness."

- "The purposes for which a five-year retention period was chosen are based on the need to preserve the company's information assets in relation to the supervisory activity to which it is subject, considering the statutory limitation periods arising from an insurance company's core business."

- "Emails, having legal and commercial relevance, are therefore only retained, without any further processing (...) for the time necessary to ensure the ability, where requested by the Data Controller, to fulfill the stated purposes. Indeed, retention in offline systems alone, without further processing, guarantees that the content of emails, as well as attachments, as forms of correspondence guaranteed by constitutional secrecy, are not subject to access, unless the needs for the purposes indicated are met (...)";

- "With reference to checks on email accounts (...) it is specified that, despite the possibility of such checks being provided for in company policies (see paragraph 7, point 2, letter a. and following of the document Rules for the Use of IT Tools), remote checks to verify workers' activities have never been carried out, either during or after the employment relationship has ended."

2. The initiation of the procedure for the adoption of corrective and sanctioning measures by the Authority.

In light of the above, the Office notified the Company of the initiation of the sanctioning procedure, pursuant to Article 166, paragraph 5, of the Code (note dated August 26, 2024), for violation of Articles 5, paragraph 1, letter a) and 88 in relation to Article 114 of the Code, Article 5, paragraph 1, letter a) in relation to Articles 13, 5, paragraph 1, letters b), c), and e), 12, paragraphs 3, and 15 of the Regulation.

On September 24, 2024, the Company submitted its defense briefs pursuant to Article 18 of Law No. 689/1981, in which it observed that:

- "ITAS believes that the right of access to data, as formulated on July 15, 2022, was adequately verified within the one-month deadline as required by Article 12 of the Regulation, with a certified email dated August 10, 2022, followed by the in-person meeting on September 22, 2022, necessary due to the large amount of data requested by the applicant."

- “During the month of May 2022, the [complainant], no longer employed by the company, asked to be able to recover only his personal belongings, including the “personal electronic folders on his desk and in his email” (see certified email dated May 23, 2022); on May 26, 2022, and June 16, 2022, specific meetings took place in which the [complainant] was able to recover not only his personal belongings, but also his personal emails through a restore from the company backup system performed by the System Administrator (…) with the supplier XX, who proceeded to recover the email database (which was not completely successful on May 26, 2022, but was then successfully completed on June 16, 2022) via a restore directly to the Microsoft Exchange server (…)”;

- "Therefore, access to and copying of "only correspondence of a strictly personal nature" occurred during the pre-application phase pursuant to Article 15 of the Regulation, because the [complainant] had initially limited his request to only "personal electronic folders on his desk and in his email" (...); therefore, no exclusion was adopted by ITAS, nor was there any "prior identification of the [correspondence] by internal company personnel" since the [complainant] had access, during the aforementioned meetings, to the email inbox and was able to select and identify the relevant emails himself."

- "Only on July 15, 2022, did the interested party, through his lawyer, submit a request for access to personal data pursuant to Article 15 of the GDPR, requesting a copy of the entire company email inbox since March 1, 2021 (...)";

- "ITAS, by virtue of the principles cited in the Guidelines [on data subject rights no. 1/2022], the significant amount of data requested (i.e., a copy of the email address), the fact that the data also involved confidential company information (...), and the existence of a company backup, legitimately proposed an in-person meeting on the date chosen by the complainant (...). The complainant was advised that this meeting would take place in a face-to-face setting to ensure that he did not come into possession of confidential company information, in accordance with the Regulation and the EDPB."

- "Everything was duly minuted and signed by the [complainant], who never contested anything regarding the access procedures, not even in the minutes, and who waited outside the meeting for a few minutes only because the ITAS delegates for the operation needed to assess whether and what to anonymize to protect the rights of third parties and company secrets, as expressly provided for in Recital 63 of the Regulation and also in the Guidelines."

- "ITAS did not carry out any unlawful controls on the employee. (...) We would like to point out that the undersigned company accessed the [complainant's] data only to respond to the access request and never carried out any controls on the employee's activities. Moreover, the employee has been a former employee since April 8, 2022 (prior to the request for privacy access in July 2022 and the events of September 2022), thus not violating Article 4 of the Workers' Statute. (...) We would like to point out that no controls were ever carried out on the account in transit (...)";

- With regard to the retention of logs and emails in transit, "ITAS is aware of the need to more strictly apply the principle of data minimization and, as already indicated in the two briefs, has initiated a process aimed at updating both various company procedures regarding the protection of personal data (...) and revising the information pursuant to Art. 13 of the GDPR (Doc. 12 already filed with the first brief of December 2023) and the authorization for processing pursuant to Art. 29 of the GDPR (Doc. 8 already filed with the first brief of December 2023) issued to all employees."

With a communication dated January 16, 2026, the Company waived the hearing initially requested pursuant to Art. 18 of Law No. 689/1981.

3. The outcome of the investigation and the procedure for the adoption of corrective and disciplinary measures pursuant to Art. 58, paragraph 2 of the Regulation.

Following an examination of the statements made by the parties during the proceedings, as well as the documentation acquired, it has been established that the Company, identified as the data controller pursuant to Article 4, paragraph 7, of the Regulation, has carried out processing operations that do not comply with the provisions on the protection of personal data.

In this regard, it is noted that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false documents or records, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority."

3.1 Violation of Articles 12 and 15 of the Regulation.

With reference to the violation of Articles 12 and 15 of the Regulations, it is necessary to preliminarily examine the subject matter of the complaint submitted by the complainant on July 15, 2022, and the feedback provided by the Company, both through communications dated August 10, 2022 and September 21, 2022, and during the meeting held at the company headquarters, as reported in the minutes of September 22, 2022.

The Company correctly observes that the complainant's initial requests were limited to the recovery of personal documents stored on his computer and email (see emails dated May 2, 9, and 23, 2022); however, it must also be noted that these requests were only partially granted, as access to the complainant's email inbox was not possible due to technical issues (as shown in the minutes of the meeting of May 26, 2022).

For this reason, the interested party made a further request on June 1, 2022, requesting a copy of all emails. This was followed by a meeting on June 16, 2022, during which, however, the complainant "was given only personal emails, such as exchanges with family members, personal CUs, and expense reimbursements. Other emails relating to work activities and/or containing documents deemed by ITAS representatives to be non-personal are not delivered" (minutes of the meeting of June 16, 2022).

The Company's decision to limit the scope of documents to be delivered to the complainant to personal emails only is further reiterated in the email of September 21, 2022, when, in anticipation of the following day's meeting, the Company clarified to the complainant that "the request to receive a copy of 'all emails in the inbox' [subject of the request of July 15, 2022] falls outside the right of access pursuant to Article 15 of the GDPR. (...) the data and information in the inbox are the property of ITAS, and your client's request must be limited to the personal data contained in the inbox."

The Company further stated that, during the meetings held at the company headquarters, "the interested party had access to the inbox and was able to select and identify the emails of interest himself." In any case, it is documented that the correspondence was not immediately delivered to the complainant, as the Company conducted a thorough check to identify and anonymize any third-party data and business secrets it may contain.

Given the above, some clarifications are necessary regarding the subject matter of the request to exercise rights, which, in this case, primarily concerns the content of the company email address, an individualized form of email used by the complainant during the employment relationship.

In this regard, it is appropriate to recall the consistent position of the European Court of Human Rights, which, in certain rulings (also cited in the Authority's decisions), has observed that the boundary between the work/professional sphere and the strictly private sphere cannot always be clearly drawn. Therefore, Article 8 of the ECHR, which protects privacy, must be considered applicable to the workplace as well.

Electronic communications exchanged in the workplace therefore also fall within the notions of "private life" and "correspondence" referred to in the aforementioned Article 8 (see the decisions Niemietz v. Germany, 16/12/1992 (rec. no. 13710/88), esp. para. 29; Copland v. UK, 03/04/2007 (rec. no. 62617/00), esp. para. 41; Bărbulescu v. Romania [GC], 05/09/2017 (rec. no. 61496/08), esp. paras. 70-73; Antović and Mirković v. Montenegro, 28/11/2017 (rec. no. 70838/13), esp. paras. 41-42).

The protection of privacy therefore also extends to the workplace, given that, precisely during the performance of work and/or professional activities, relationships develop in which the worker's personality is expressed (see Articles 2 and 41, paragraph 2, of the Constitution).

Therefore, data processing carried out using information technology within the employment relationship must comply with respect for fundamental rights and freedoms, as well as the dignity of the data subject, for the protection of workers and third parties (see Recommendation CM/Rec (2015)5 of the Committee of Ministers to Member States on the processing of personal data in the employment context, especially point 3).

Consistent with this approach, in the provision containing "Guidelines for e-mail and the Internet," the Authority noted that "The content of e-mail messages—as well as external communication data and attached files—concerns forms of correspondence protected by guarantees of confidentiality, also constitutionally protected, whose rationale lies in protecting the essential core of human dignity and the full development of the personality in social groups" (provision of 01/03/2007, no. 13, web doc. no. 1387522, point 5.2, letter b). This approach has also been reiterated in measures adopted by the Authority as part of specific investigations into specific cases (see measures: No. 8 of January 16, 2025, web doc. No. 10110927; No. 732 of November 27, 2024, web doc. No. 10101221; No. 353 of September 29, 2021, web doc. No. 9719914).

In light of the above, the Company's decision to pre-screen the content of emails on the data subject's individualized email account in order to limit access to "strictly personal" communications must be considered contrary to the principles of personal data protection. This was based on the mistaken belief that correspondence held on the company account was fully and exclusively available to the company.

In this regard, in light of the definitions of "personal data" and "processing" set forth in Article 4, paragraphs 1 and 2, of the Regulation, which necessarily also include data relating to work activities, communications in transit on an individualized account are inevitably attributable to the account holder's personal data.

Furthermore, the Company's further obscuring and anonymizing of the content of the complainant's correspondence, in response to the need to protect the rights of third parties and the business secrets contained in the emails, must also be considered unlawful.

In fact, given the cases expressly provided for by the Regulation, in which the right of access may be limited only in the case of manifestly unfounded or excessive requests (Article 12, paragraph 5, of the Regulation) and in the case of protection of third party rights (Article 15, paragraph 4, of the Regulation), it should be noted that none of the circumstances envisaged by the regulation apply in this case.

In particular, with regard to the protection of the rights and freedoms of others, Recital 63 specifies that these rights also include industrial and business secrets and intellectual property, particularly copyrights protecting software.

However, "the general concern that, by complying with the access request, the rights and freedoms of others may be adversely affected is not sufficient to invoke Article 15(4) of the GDPR. The data controller must be able to demonstrate that, in the specific situation, the rights or freedoms of others would actually be adversely affected" (Guidelines 1/2022 on the Rights of Data Subjects - Right of Access, point 172).

In this case, among other things, it is noted that the data relating to third parties were contained in communications received and known by the data subject, which is why the blackout activity performed on such information appears unnecessary. Regarding the disclosure of business secrets, it is noted that the Company has not produced any factual evidence to demonstrate that access to the correspondence by the data subject could actually result in serious harm to the rights and freedoms, such as disclosure or the theft of business secrets.

The Company must therefore be confirmed to have violated the provisions of Articles 12 and 15 of the Regulation, given that the interested party has not yet been provided with adequate and complete information regarding the data contained in his individualized company email address, which is still available to the Company.

3.2 Violation of Articles 5, paragraph 1, letters a), b), c), e), and 13 of the Regulation.

As part of the investigation, it emerged that the Company retains the emails that transit through its employees' company accounts, through a backup of the email address ordered for a period of five years, in order to "preserve the company's information assets in relation to the supervisory activity to which it is subject" (note dated 02/05/2024 and further specified in the defense briefs dated 24/09/2024).

First of all, it should be noted that the specific backup activity required by the Company for the content of email accounts assigned to employees was not contemplated or regulated in any of the information documents prepared for employees.

It follows, therefore, that data subjects were not given access to the actual processing activity performed on emails in transit through their accounts, nor to the retention periods, the purposes of such processing, and the related legal grounds.

This conduct is therefore contrary to the principle of fairness and transparency (Article 5, paragraph 1, letter a) of the Regulation), which, in the context of employment relationships, is expressed through the provision of appropriate information (Article 13 of the Regulation).

In this case, in fact, the information provided in the documents (Annexes 6 and 12 to the note dated 12/06/2023) and the document containing the "Rules for the Use of IT Tools" (Annex 4 to the aforementioned note) contain only information regarding email retention, which, among other things, clearly differs from one another with respect to the retention periods for the data collected and the specific purposes pursued.

In particular, the information provided to employees (Annex 6 to the note dated 12/06/2023) states, in a very general manner, that "the company generally retains employee data for a period of ten years from the termination of the employment relationship, unless a different retention period is established (for example, in the event of litigation or to fulfill a legal obligation) which could be shorter or longer than this period."

However, the document containing "Rules for the Use of IT Tools" states that "the retention period [of email] may vary significantly based on: purpose, type of data processed, legal obligations (...)", in addition to the fact that access to the email content of a departing employee is required "for the potential protection of the rights of the data subject or the data controller" (chapter 5, paragraphs 22-23 of the cited document).

Specifically, regarding the backup of email content, which is required for a particularly long period (equal to 5 years), the Company justified this choice by the need to safeguard its information assets in relation to the supervisory activity to which it is subject.

However, as already reiterated by the Authority in other provisions, "the legitimate need to ensure the preservation of documentation necessary for the ordinary conduct and continuity of business activity, including in relation to relationships with private and public entities, as well as on the basis of specific provisions of the law, is ensured, first and foremost, by the implementation of document management systems which − through the adoption of appropriate organizational and technological measures − identify the documents that, during the course of work activities, must be archived in ways that guarantee the characteristics of authenticity, integrity, reliability, legibility, and retrievability required by the applicable sector regulations. Email systems, by their very nature, do not ensure these characteristics" (see provision no. 732 of 27 November 2024, web doc no. 10101221, no. 263 of 22/06/2023, web doc. no. 9920814, provision no. 53 of 01/02/2018, web doc. no. 8159221 and provision no. 214 of 29/10/2020, web doc. 9518890).

It is therefore appropriate for the Company to implement measures and techniques that ensure the ordinary and efficient management of corporate document flows, in compliance with current regulations, and that are less invasive of the data subjects' right to privacy, thereby avoiding access to the content of communications received on the accounts assigned to employees and collaborators.

This is also based on the assumption that the exchange of electronic correspondence, whether or not unrelated to work, on an individualized company account is an operation that also allows access to personal information relating to the data subject and third-party senders of communications whose confidentiality expectations are, in this specific case, inadequately protected (see "Guidelines of the Italian Data Protection Authority for Electronic Mail and the Internet," cited above, especially point 5.2, letter b).

The preservation of company emails by backing up the content of emails, contrary to what is believed, constitutes personal data processing, based on the definition of "processing" found in Article 4, paragraph 2 of the Regulation ("any operation or set of operations such as collection, recording, organization, ..., storage, ... consultation, ...").

Therefore, believing that the storage of emails offline does not constitute the processing of personal data is an incorrect interpretation that fails to take into account the broader definition of processing provided by the Regulation.

That said, given that this processing is carried out by the Company for an extended period of time (equal to 5 years), it must be held unlawful due to a violation of the principles of data minimization, purpose limitation, and storage limitation (Article 5, paragraph 1, b), c), and e) of the Regulation). As mentioned, this activity, which continues for a significant period of time, is neither necessary nor proportionate to the purpose of ensuring business continuity (see Decision No. 53 of February 1, 2018, web doc. 8159221).

All of the above must also be considered applicable to the additional processing carried out by the Company on Internet browsing logs. In this case, the aforementioned Company Rules provide for a 12-month retention period for Internet browsing log files, for purposes related to the proper functioning of the IT system, the protection of company assets, and also "to defend its rights against abuses provided for by law," in addition to the possibility of access by authorized personnel (chapter 7, paragraph 2, letter b) of the aforementioned Rules).

As highlighted on numerous occasions by the Italian Data Protection Authority (most recently, see Decision No. 613 of 09/10/2025, Web Document No. 10185435), where log file retention is intended to ensure IT security, the data controller, in application of the principle of storage limitation (Article 5, paragraph 1, letter e) of the Regulation), must identify an appropriate time frame, with respect to the objective of detecting and mitigating any security incidents, promptly adopting appropriate countermeasures (see also, in this regard, "Guideline Document. Computer programs and services for managing email in the workplace and processing metadata," Decision No. 06/06/2024, Web Document No. 10026277).

In this case, among other things, based on the Company Rules, this processing is also carried out for the purposes of defending rights, or for purposes other than those necessary to ensure IT security. The retention of log files for the purpose of defending rights in court, however, represents a suitable tool available to the employer for monitoring employee activity (see section 3.3 below).

In light of the overall framework for personal data protection, the processing carried out by the Company in relation to the retention of Internet browsing log files is also unlawful, as it violates the principles of data minimization, purpose limitation, and storage limitation set forth in Article 5, paragraph 1, letters b), c), and e) of the Regulation.

3.3. Violation of Articles 5, paragraph 1, letter a), and 88 of the Regulation and Article 114 of the Code.

The Company's internal policies governing the management of email and Internet use are also relevant for compliance with the applicable regulations set forth in Law No. 300/1970.

Several passages in the document containing the "Rules for the Use of IT Tools" acknowledge that the data controller (or designated IT assistants) may access email content and Internet browsing logs for various purposes (see chapters 5, paragraphs 22-23, and 7).

Although the Company, in its defense briefs, denied having carried out any checks on the content of the complainant's email (and, in general, those of its employees) and that it accessed the email solely for the purpose of responding to the complainant's request for access, these circumstances in themselves are not sufficient to exclude the applicability of the remote monitoring provisions set forth in Law No. 300/1970 to the specific case. 300/1970, precisely by virtue of what is represented in company policies.

Article 4 of Law No. 300/1970, as is well known, provides for a specific safeguard procedure in the event of the use of "tools that also allow for remote monitoring of workers' activities," which "may be used exclusively for organizational and production needs, for workplace safety, and for the protection of company assets," "subject to a collective agreement stipulated by the union representative body or by company union representatives," or, in the absence of an agreement, "subject to authorization from the local office of the National Labor Inspectorate."

In the case at hand, both email backups and the storage of Internet browsing logs are potentially suitable tools for monitoring employee activity because they allow the processing (i.e., the collection, as part of the employment relationship, and the retention for an extended period of time) of personal information and data relating to workers, in the absence of the guarantees established by law.

Therefore, given that, with regard to the processing described in the "Rules for the Use of IT Tools," the Company does not appear to have verified the actual existence of the mandatory purposes indicated in Article 4 of Law No. 300/1970 (with particular reference to so-called defensive purposes) nor, following this verification, activated the guarantee procedure provided for by the aforementioned sector legislation, the violation of Articles 5, paragraph 1, letter a) and 88 of the Regulation must be considered confirmed, as referred to in Article 114 of the Code ("Guarantees regarding remote monitoring") as a condition for the lawfulness of personal data processing carried out in the context of the employment relationship.

4. Conclusions: Declaration of unlawfulness of the processing. Corrective measures pursuant to Article 58, paragraph 2, of the Regulation.

For the above reasons, the Authority believes that the statements made by the data controller during the investigation do not address the concerns notified by the Office in the initiation of the proceedings and are therefore unsuitable for dismissal of this proceeding. Furthermore, with regard to these matters, none of the cases provided for by Article 11 of the Guarantor Regulation No. 1/2019 apply.

The processing of personal data carried out by ITAS Mutua is unlawful, in the terms set out above, as it violates Articles 5, paragraph 1, letters a), b), c), e), 13, 12, 15, and 88 of the Regulation and Article 114 of the Code.

The breach established in the terms set out in the grounds cannot be considered "minor," given the nature of the multiple breaches identified, which concerned the general principles of data processing and the more specific provisions on remote monitoring, the severity and duration of the breach itself, the degree of responsibility, and the manner in which the supervisory authority became aware of the breach (see Recital 148 of the Regulation).

Given the corrective powers granted by Article 58, paragraph 2, of the Regulation, in light of the circumstances of the specific case, we order:

- to allow the complainant full access to the content of the correspondence contained in the individualized company email account used during the employment relationship;

- to align the company policies and the processing described with the personal data protection legislation as referred to in paragraphs 3.2 and 3.3;

- to impose an administrative fine pursuant to Article 58, paragraph 2, of the Regulation. 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i), of the Regulation).

Finally, it is believed that the conditions set out in Article 17 of the Guarantor Regulation No. 1/2019 are met.

5. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).

As a result of the proceedings, it appears that ITAS Mutua violated Articles 5, paragraph 1, letters a), b), c), and e), 13, 12, 15, and 88 of the Regulation, and Article 114 of the Code. Violation of the aforementioned provisions is subject to the application of the administrative pecuniary sanction provided for in Article 83 of the Regulation.

The Garante, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of 24 November 1981) in relation to the processing of personal data carried out by ITAS Mutua, which has been found to be unlawful, in the terms set out above.

Having deemed it necessary to apply Article 83, paragraph 3 of the Regulation, which provides that "If, in relation to the same or linked processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative pecuniary sanction shall not exceed the amount specified for the most serious infringement," the total amount of the sanction is calculated so as not to exceed the maximum amount established by the same Article 83, paragraph 1. 5.

With reference to the elements listed in Article 83, paragraph 2, of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must "in any case be effective, proportionate, and dissuasive" (Article 83, paragraph 1 of the Regulation), it is noted that, in this case, the following circumstances were considered:

Regarding the nature, severity, and duration of the violation, the nature of the violation, which concerned provisions protecting the exercise of data protection rights and more specific provisions protecting data subjects in the context of employment relationships, was considered relevant. Regarding the duration of the violation, the fact that the data relating to the content of email and internet browsing activities are retained for a considerable period of time and that the complainant did not receive a full response to the request for access submitted on July 15, 2022, must be considered relevant;

With regard to the intentional or negligent nature of the violation and the degree of liability of the data controller, the Company's conduct and its degree of liability were taken into consideration, which still does not comply with data protection regulations, specifically with regard to the retention of email and internet browsing data.

The party's level of cooperation during the investigation and the lack of specific precedents were taken into account in favor of the data controller.

Furthermore, it is believed that, taking into account the aforementioned principles of effectiveness, proportionality, and dissuasiveness, which the Authority must adhere to in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the following are of primary relevance in this case: the financial situation of the offender, determined based on the Company's turnover, as reported in the financial statements for 2024.

In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose an administrative fine of €50,000.00 (fifty thousand) against ITAS Mutua.

In this context, it is also believed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Guarantor Regulation No. 1/2019, this chapter containing the injunction order should be published on the Garante's website.

This is in consideration of the conduct that is particularly harmful to the rights of the data subject, which occurred in violation of the general principles of personal data protection.

NOW THAT, THE GUARANTOR

pursuant to Article 57, paragraph 1, letter f), of the Regulation, finds the processing carried out by LT S.p.A., represented by its legal representative pro tempore, with registered office in Trento, Piazza delle Donne Lavoratrici no. 2, VAT no. 00110750221, to be unlawful due to the violation of Articles 5, paragraph 1, letters a), b), c), e), 13, 12, 15, and 88 of the Regulation and Article 114 of the Code;

pursuant to Article 58, paragraph 2, letter f), Article 15, paragraph 4, letter d), of the Regulations, requires the Company to comply, within 90 days of notification of this provision, with the provisions set forth in paragraph 4 of this decision, while also requiring it to provide, within the aforementioned deadline, an adequately reasoned response pursuant to Article 157 of the Code. Failure to provide such response may result in the application of the administrative pecuniary sanction provided for in Article 83, paragraph 5, letter e), of the Regulations;

ORDERS

Pursuant to Article 58, paragraph 2, letter i), of the Regulations, the Company to pay the sum of €50,000.00 (fifty thousand) as an administrative pecuniary sanction for the violations indicated in this provision;

HEREBY ORDER

therefore, the same Company to pay the aforementioned sum of €50,000.00 (fifty thousand), according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981.

It is hereby stated that pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half of the fine imposed within the deadline set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, for filing an appeal as indicated below.

ORDERS

pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/20129, the publication of the injunction order on the Italian Data Protection Authority's website;

pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Italian Data Protection Authority Regulation No. 1/20129, the publication of this provision on the Italian Data Protection Authority's website;

pursuant to Article 17 of Regulation No. 1/2019, the recording of violations and measures adopted pursuant to Article 58, paragraph 2 of the Regulation in the Authority's internal register provided for by Article 57, paragraph 1, letter u) of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150/2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days of the date of notification of the provision itself, or sixty days if the appellant resides abroad.

Rome, March 12, 2026

THE PRESIDENT
Stanzione

THE REPORTER

THE DEPUTY SECRETARY GENERAL
Filippi

SEE ALSO Newsletter of April 15, 2026


[web doc. no. 10233328]

Provision of March 12, 2026

Register of Provisions
no. 165 of March 12, 2026

THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Members, and Dr. Claudio Filippi, Deputy Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018, hereinafter, the "Code");

SEEN the complaint filed by Mr. XX, pursuant to Article 77 of the Regulation, against ITAS Mutua;

HAVING EXAMINED the documentation in the file;

HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Guarantor's Regulation No. 1/2000;

REPORTER: Professor Ginevra Cerrina Feroni;

WHEREAS

1. The initiation of the preliminary investigation following the submission of the complaint.

With the complaint filed with this Authority on July 20, 2023, Mr. XX reported a violation of the personal data protection regulations implemented by ITAS Mutua (hereinafter "the Company"), his former employer, consisting, in particular, in the response deemed inappropriate to the request to exercise the rights submitted pursuant to Article 15 of the Regulation.

Specifically, the complainant stated that, following the termination of his employment with the Company, he requested access to his personal documents and folders on his computer and in the company email address used during his employment (certified email dated May 2, 2022 and May 9, 2022).

During meetings held at the Company's headquarters on May 6, 2022, and May 26, 2022, the Company allowed desktop access and the retrieval of personal documents, but email access was denied for unspecified technical reasons.

During the meeting held on June 16, 2022, the Company delivered "only personal mail, such as exchanges with family members, personal CUs, and expense reimbursements," while "other work-related emails and/or documents deemed by ITAS representatives to be non-personal" were not delivered (minutes of the meeting of June 16, 2022).

The complainant therefore filed a request to exercise his rights pursuant to Article 15 of the Regulations, formally requesting the Company to receive "copies of all emails in his inbox (...) from March 1, 2021 onwards," as well as other documentation pertaining to his employment relationship (request dated July 15, 2022).

A further meeting was then scheduled, during which the Company "delivered to the interested party a USB stick containing the requested documentation (...)", reserving the right to provide the emails identified during the meeting at a later date, "duly anonymized with respect to personal data pertaining to third parties" (minutes of 22/09/2022).

The correspondence contained in the email account was finally delivered to the complainant on 29/09/2022, "redacted of many elements."

In light of the above, the Office formulated a request for information from the Company pursuant to art. 157 of the Code (note dated 08/11/2023), to which the Company responded in a note dated 06/12/2023, stating that:

-    "On 04/11/2022, the company email account assigned to the interested party was deactivated with the activation of the automatic reply message addressed to third parties, and was then permanently deleted on 04/25/2022";

-    "On 05/26/2022 and 06/16/2022, specific meetings took place in which the [complainant] was able not only to recover his personal belongings, but also to access his email inbox (...). To this end, the Company performed a restore from the backup system on a dedicated laptop";

-    “Nonetheless, on July 15, 2022, the interested party submitted, through his legal representative, a request for access to personal data pursuant to Article 15 of the GDPR, requesting copies of various documentation. (…)”;

-    “On September 22, 2022, a further appointment was held to allow the [complainant] access to his email inbox. He was informed that this meeting would take place side by side to ensure that the complainant did not come into possession of confidential company data and information, allowing access and copies only of the personal data relating to the interested party.”

Regarding the methods and retention periods for messages sent to company email accounts, the Company noted that:

- "Upon termination of employment, the email databases are deactivated through a dedicated automated Identity & Access Management system. Disabling the account triggers an automatic message to all senders. The email account remains deactivated for 14 days and is then automatically deleted from the online systems, remaining stored in the backup system for 5 years."

- "As an employee of the Company, the complainant received the information on the processing of personal data upon hiring, in accordance with the applicable regulations at the time."

- "In addition to the privacy policy, the complainant also received the deed of appointment as data processor pursuant to art. 30 of the Code (...); due to the specific role held by [the complainant], on 20 October 2021, the Company provided the complainant with the deed of appointment as "Internal Contact Person to Support the DPO", receiving further specific instructions regarding the data processing activities assigned to the complainant."

The note also included, as an attachment, the information notice signed by the complainant on January 23, 2012, the appointment of the data processor pursuant to Article 30 of the Code (in the version prior to the amendments introduced by Legislative Decree No. 101 of August 10, 2018), and the appointment of the "Internal Contact Person to Support the DPO," dated October 20, 2021, as well as the document containing the "Rules for the Use of Company Tools" dated June 28, 2019.

Specifically, an examination of the document "Rules for the Use of Company Tools" (Annex 4 to the memo dated December 6, 2023) revealed that:

- "Upon termination of the employment relationship, the email inbox will be blocked for incoming and outgoing messages. The content of the email will be blocked, and access will be permitted only to the data controller or, upon his/her authorization, the IT technical assistant, solely for accessing data for the possible protection of the rights of the data subject or the data controller" (point 5.22 of the aforementioned Rules);

- "For this reason, the data processor/authorized data controller is informed that transmission is controlled by the data controller and that messages sent and received are automatically saved on company IT systems for the time necessary to fulfill the indicated purposes. Subsequently, they will be retained and not further processed, as documented in our Data Processing Register. The retention period may vary significantly based on: the purpose, the type of data processed, and legal obligations (...)" (point 5.23 of the aforementioned Rules);

- "ITAS, in accordance with the provisions of the Privacy Guarantor (...) and Article 4 of the Workers' Statute (...), may carry out checks on the electronic devices granted for use (PCs and archived data, email, Internet access, telephone, etc.) if necessary" (paragraph 7, no. 1, Rules cited).

In light of the above, the Office submitted a further request for information, pursuant to Article 157 of the Code, requesting information on the purposes, methods (with particular reference to timeframes), and legal grounds for the retention of messages sent via company email accounts assigned to employees, as well as any compliance with the sector regulations regarding remote monitoring pursuant to Article 4 of Law No. 300 of 1970, referred to in Article 114 of the Code (note dated April 3, 2024).

In its memo dated May 2, 2024, the Company stated that:

- "Messages transiting through employee email accounts are retained with adequate security measures following a risk assessment, as documented in the Processing Register. Email backups are retained for a maximum period of five years. The Data Controller (...) intended to maintain retention within the indicated timeframes, deeming them appropriate for compliance with the principles of necessity, relevance, and non-excessiveness."

- "The purposes for which the five-year retention period was chosen are based on the need to preserve the company's information assets in relation to the supervisory activity to which it is subject, considering the legal limitation periods arising from the core business of an insurance company."

- "Email messages, having legal and commercial relevance, are therefore only stored, without any further processing (...) for the time necessary to ensure the possibility, where requested by the Data Controller, of fulfilling the stated purposes. Indeed, storage in offline systems alone, without further processing, guarantees that the content of email messages, as well as attachments, as forms of correspondence guaranteed by constitutional secrecy, are not subject to access, unless the needs for the purposes indicated exist (...)";

- "With regard to checks on email accounts (...), it is specified that despite the possibility of such checks being provided for in company policies (see paragraph 7, point 2, letter a. and following of the document Rules for the Use of IT Tools), remote checks have never been carried out to verify workers' activities, either during or after the employment relationship has ended."

2. The initiation of the procedure for the adoption of corrective and sanctioning measures by the Authority.

In light of the above, the Office notified the Company of the initiation of the sanctioning procedure, pursuant to Article 166, paragraph 5, of the Code (note dated August 26, 2024), for violation of Articles 5, paragraph 1, letter a) and 88 in relation to Article 114 of the Code, Article 5, paragraph 1, letter a) in relation to Articles 13, 5, paragraph 1, letters b), c), and e), 12, paragraphs 3, and 15 of the Regulation.

On September 24, 2024, the Company submitted its defense briefs pursuant to Article 18 of Law No. 689/1981, in which it observed that:

- "ITAS believes that the right of access to data, as formulated on July 15, 2022, was adequately verified within the one-month deadline as required by Article 12 of the Regulation, with a certified email dated August 10, 2022, followed by the in-person meeting on September 22, 2022, necessary due to the large amount of data requested by the applicant."

- “During the month of May 2022, the [complainant], no longer employed by the company, asked to be able to recover only his personal belongings, including the “personal electronic folders on his desk and in his email” (see certified email dated May 23, 2022); on May 26, 2022, and June 16, 2022, specific meetings took place in which the [complainant] was able to recover not only his personal belongings, but also his personal emails through a restore from the company backup system performed by the System Administrator (…) with the supplier XX, who proceeded to recover the email database (which was not completely successful on May 26, 2022, but was then successfully completed on June 16, 2022) via a restore directly to the Microsoft Exchange server (…)”;

- "Therefore, access to and copying of "only correspondence of a strictly personal nature" occurred during the pre-application phase pursuant to Article 15 of the Regulation, because the [complainant] had initially limited his request to only "personal electronic folders on his desk and in his email" (...); therefore, no exclusion was adopted by ITAS, nor was there any "prior identification of the [correspondence] by internal company personnel" since the [complainant] had access, during the aforementioned meetings, to the email inbox and was able to select and identify the relevant emails himself."

- "Only on July 15, 2022, did the interested party, through his lawyer, submit a request for access to personal data pursuant to Article 15 of the GDPR, requesting a copy of the entire company email inbox since March 1, 2021 (...)";

- "ITAS, by virtue of the principles cited in the Guidelines [on data subject rights no. 1/2022], the significant amount of data requested (i.e., a copy of the email address), the fact that the data also involved confidential company information (...), and the existence of a company backup, legitimately proposed an in-person meeting on the date chosen by the complainant (...). The complainant was advised that this meeting would take place in a face-to-face setting to ensure that he did not come into possession of confidential company information, in accordance with the Regulation and the EDPB."

- "Everything was duly minuted and signed by the [complainant], who never contested anything regarding the access procedures, not even in the minutes, and who waited outside the meeting for a few minutes only because the ITAS delegates for the operation needed to assess whether and what to anonymize to protect the rights of third parties and company secrets, as expressly provided for in Recital 63 of the Regulation and also in the Guidelines."

- "ITAS did not carry out any unlawful controls on the employee. (...) We would like to point out that the undersigned company accessed the [complainant's] data only to respond to the access request and never carried out any controls on the employee's activities. Moreover, the employee has been a former employee since April 8, 2022 (prior to the request for privacy access in July 2022 and the events of September 2022), thus not violating Article 4 of the Workers' Statute. (...) We would like to point out that no controls were ever carried out on the account in transit (...)";

- With regard to the retention of logs and emails in transit, "ITAS is aware of the need to more strictly apply the principle of data minimization and, as already indicated in the two briefs, has initiated a process aimed at updating both various company procedures regarding the protection of personal data (...) and revising the information pursuant to Art. 13 of the GDPR (Doc. 12 already filed with the first brief of December 2023) and the authorization for processing pursuant to Art. 29 of the GDPR (Doc. 8 already filed with the first brief of December 2023) issued to all employees."

With a communication dated January 16, 2026, the Company waived the hearing initially requested pursuant to Art. 18 of Law No. 689/1981.

3. The outcome of the investigation and the procedure for the adoption of corrective and disciplinary measures pursuant to Art. 58, paragraph 2 of the Regulation.

Following an examination of the statements made by the parties during the proceedings, as well as the documentation acquired, it has been established that the Company, identified as the data controller pursuant to Article 4, paragraph 7, of the Regulation, has carried out processing operations that do not comply with the provisions on the protection of personal data.

In this regard, it is noted that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false documents or records, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority."

3.1 Violation of Articles 12 and 15 of the Regulations.

With regard to the violation of Articles 12 and 15 of the Regulations, it is necessary to preliminarily examine the subject matter of the complaint submitted by the complainant on July 15, 2022, and the feedback provided by the Company, both through communications dated August 10, 2022 and September 21, 2022, and during the meeting held at the company headquarters, as reported in the minutes of September 22, 2022.

The Company correctly observes that the complainant's initial requests were limited to the recovery of personal documents stored on the computer and email (see emails dated May 2, 9, and 23, 2022); However, it should also be noted that these requests were only partially granted, as access to the complainant's email inbox was prevented due to technical issues (as evidenced by the minutes of the meeting of May 26, 2022).

For this reason, the interested party made a further request on June 1, 2022, requesting a copy of all emails. This was followed by a meeting on June 16, 2022, during which, however, the complainant "is given only personal emails, such as exchanges with family members, personal CUs, and expense reimbursements. Other emails relating to work activities and/or containing documents deemed by ITAS representatives to be non-personal are not delivered" (minutes of the meeting of June 16, 2022).

The Company's decision to limit the scope of documents to be delivered to the complainant to personal emails only is further reiterated in the email of September 21, 2022, when, in anticipation of the following day's meeting, the Company clarified to the complainant that "the request to receive a copy of 'all emails in the inbox' [subject of the request of July 15, 2022] falls outside the right of access pursuant to Article 15 of the GDPR. (...) the data and information in the inbox are the property of ITAS, and your client's request must be limited to the personal data contained in the inbox."

The Company further stated that, during the meetings held at the company headquarters, "the interested party had access to the inbox and was able to select and identify the emails of interest himself." In any case, it is documented that the correspondence was not immediately delivered to the complainant, as the Company conducted a thorough check to identify and anonymize any third-party data and business secrets it may contain.

Given the above, some clarifications are necessary regarding the subject matter of the request to exercise rights, which, in this case, primarily concerns the content of the company email address, an individualized form of email used by the complainant during the employment relationship.

In this regard, it is appropriate to recall the consistent position of the European Court of Human Rights, which, in certain rulings (also cited in the Authority's decisions), has observed that the boundary between the work/professional sphere and the strictly private sphere cannot always be clearly drawn. Therefore, Article 8 of the ECHR, which protects privacy, must be considered applicable to the workplace as well.

Electronic communications exchanged in the workplace therefore also fall within the notions of "private life" and "correspondence" referred to in the aforementioned Article 8 (see the decisions Niemietz v. Germany, 16/12/1992 (rec. no. 13710/88), esp. para. 29; Copland v. UK, 03/04/2007 (rec. no. 62617/00), esp. para. 41; Bărbulescu v. Romania [GC], 05/09/2017 (rec. no. 61496/08), esp. paras. 70-73; Antović and Mirković v. Montenegro, 28/11/2017 (rec. no. 70838/13), esp. paras. 41-42).

The protection of privacy therefore also extends to the workplace, given that, precisely during the performance of work and/or professional activities, relationships develop in which the worker's personality is expressed (see Articles 2 and 41, paragraph 2, of the Constitution).

Therefore, data processing carried out using information technology within the employment relationship must comply with respect for fundamental rights and freedoms, as well as the dignity of the data subject, for the protection of workers and third parties (see Recommendation CM/Rec (2015)5 of the Committee of Ministers to Member States on the processing of personal data in the employment context, especially point 3).

In line with this approach, in the provision containing “Guidelines for electronic mail and the Internet” the Authority observed that “The content of electronic mail messages – as well as the external data of communications and attached files – concern forms of correspondence supported by guarantees of confidentiality also protected by the Constitution, the rationale of which lies in protecting the essential core of human dignity and the full development of the personality in social groups” (provision of 01/03/2007, no. 13, web doc. no. 1387522, point 5.2, letter b). This approach has also been reiterated in measures adopted by the Authority as part of specific investigations into specific cases (see measures: No. 8 of January 16, 2025, web doc. No. 10110927; No. 732 of November 27, 2024, web doc. No. 10101221; No. 353 of September 29, 2021, web doc. No. 9719914).

In light of the above, the Company's decision to pre-screen the content of emails on the data subject's individualized email account in order to limit access to "strictly personal" communications must be considered contrary to the principles of personal data protection. This was based on the mistaken belief that correspondence held on the company account was fully and exclusively available to the company.

In this regard, in light of the definitions of "personal data" and "processing" set forth in Article 4, paragraphs 1 and 2, of the Regulation, which necessarily also include data relating to work activities, communications in transit on an individualized account are inevitably attributable to the account holder's personal data.

Furthermore, the Company's further obscuring and anonymizing of the content of the complainant's correspondence, in response to the need to protect the rights of third parties and the business secrets contained in the emails, must also be considered unlawful.

In fact, given the cases expressly provided for by the Regulation, in which the right of access may be limited only in the case of manifestly unfounded or excessive requests (Article 12, paragraph 5, of the Regulation) and in the case of protection of third party rights (Article 15, paragraph 4, of the Regulation), it should be noted that none of the circumstances envisaged by the regulation apply in this case.

In particular, with regard to the protection of the rights and freedoms of others, Recital 63 specifies that these rights also include industrial and business secrets and intellectual property, particularly copyrights protecting software.

However, "the general concern that, by complying with the access request, the rights and freedoms of others may be adversely affected is not sufficient to invoke Article 15(4) of the GDPR. The data controller must be able to demonstrate that, in the specific situation, the rights or freedoms of others would actually be adversely affected" (Guidelines 1/2022 on the Rights of Data Subjects - Right of Access, point 172).

In this case, among other things, it is noted that the data relating to third parties were contained in communications received and known by the data subject, which is why the blackout activity performed on such information appears unnecessary. Regarding the disclosure of business secrets, it is noted that the Company has not produced any factual evidence to demonstrate that access to the correspondence by the data subject could actually result in serious harm to the rights and freedoms, such as disclosure or the theft of business secrets.

The Company must therefore be confirmed to have violated the provisions of Articles 12 and 15 of the Regulation, given that the interested party has not yet been provided with adequate and complete information regarding the data contained in his individualized company email address, which is still available to the Company.

3.2 Violation of Articles 5, paragraph 1, letters a), b), c), e), and 13 of the Regulation.

As part of the investigation, it emerged that the Company retains the emails that transit through its employees' company accounts, through a backup of the email address ordered for a period of five years, in order to "preserve the company's information assets in relation to the supervisory activity to which it is subject" (note dated 02/05/2024 and further specified in the defense briefs dated 24/09/2024).

First of all, it should be noted that the specific backup activity required by the Company for the content of email accounts assigned to employees was not contemplated or regulated in any of the information documents provided to employees.

It follows, therefore, that data subjects were not given access to the actual processing activity performed on emails in transit through their accounts, nor to the retention periods, the purposes of such processing, and the related legal grounds.

This conduct is therefore contrary to the principle of fairness and transparency (Article 5, paragraph 1, letter a) of the Regulation), which, in the context of employment relationships, is expressed through the provision of appropriate information (Article 13 of the Regulation).

In this case, in fact, the information provided in the documents (Annexes 6 and 12 to the memo dated December 6, 2023) and the document containing the "Rules for the Use of IT Tools" (Annex 4 to the aforementioned memo) contain only information regarding email retention, which, among other things, clearly differs with respect to the retention periods for the data collected and the specific purposes pursued.

Specifically, the information provided to employees (Annex 6 to the memo dated December 6, 2023) states, in a very general manner, that "the company generally retains employee data for a period of ten years from the termination of the employment relationship, unless a different retention period is established (for example, in the event of litigation or to fulfill a legal obligation) which could be shorter or longer than this period."

However, the document containing "Rules for the Use of IT Tools" states that "the retention period [of email] may vary significantly based on: purpose, type of data processed, legal obligations (...)", in addition to the fact that access to the email content of a departing employee is required "for the potential protection of the rights of the data subject or the data controller" (chapter 5, paragraphs 22-23 of the cited document).

Specifically, regarding the backup of email content, which is required for a particularly long period (equal to 5 years), the Company justified this choice by the need to safeguard its information assets in relation to the supervisory activity to which it is subject.

However, as already reiterated by the Authority in other provisions, "the legitimate need to ensure the preservation of documentation necessary for the ordinary conduct and continuity of business activity, including in relation to relationships with private and public entities, as well as on the basis of specific provisions of the law, is ensured, first and foremost, by the implementation of document management systems which − through the adoption of appropriate organizational and technological measures − identify the documents that, during the course of work activities, must be archived in ways that guarantee the characteristics of authenticity, integrity, reliability, legibility, and retrievability required by the applicable sector regulations. Email systems, by their very nature, do not ensure these characteristics" (see provision no. 732 of 27 November 2024, web doc no. 10101221, no. 263 of 22/06/2023, web doc. no. 9920814, provision no. 53 of 01/02/2018, web doc. no. 8159221 and provision no. 214 of 29/10/2020, web doc. 9518890).

It is therefore appropriate for the Company to implement measures and techniques that ensure the ordinary and efficient management of corporate document flows, in compliance with current regulations, and that are less invasive of the data subjects' right to privacy, thereby avoiding access to the content of communications received on the accounts assigned to employees and collaborators.

This is also based on the assumption that the exchange of electronic correspondence, whether or not unrelated to work, on an individualized company account is an operation that also allows access to personal information relating to the data subject and third-party senders of communications whose confidentiality expectations are, in this specific case, inadequately protected (see "Guidelines of the Italian Data Protection Authority for Electronic Mail and the Internet," cited above, especially point 5.2, letter b).

The preservation of company emails by backing up the content of emails, contrary to what is believed, constitutes personal data processing, based on the definition of "processing" found in Article 4, paragraph 2 of the Regulation ("any operation or set of operations such as collection, recording, organization, ..., storage, ... consultation, ...").

Therefore, to believe that the storage of emails offline does not constitute the processing of personal data is an incorrect interpretation that fails to take into account the broader definition of processing provided by the Regulation.

That said, given that this processing is carried out by the Company for an extended period of time (equal to 5 years), it must be held unlawful due to a violation of the principles of data minimization, purpose limitation, and storage limitation (Article 5, paragraph 1, b), c), and e) of the Regulation). As mentioned, this activity, which continues for a significant period of time, is neither necessary nor proportionate to the purpose of ensuring business continuity (see Decision No. 53 of February 1, 2018, web doc. 8159221).

All of the above must also be considered applicable to the additional processing carried out by the Company on Internet browsing logs. In this case, the aforementioned Company Rules provide for a 12-month retention period for Internet browsing log files, for purposes related to the proper functioning of the IT system, the protection of company assets, and also "to defend its rights against abuses provided for by law," in addition to the possibility of access by authorized personnel (chapter 7, paragraph 2, letter b) of the aforementioned Rules).

As highlighted on numerous occasions by the Italian Data Protection Authority (most recently, see Decision No. 613 of 09/10/2025, Web Document No. 10185435), where log file retention is intended to ensure IT security, the data controller, in application of the principle of storage limitation (Article 5, paragraph 1, letter e) of the Regulation), must identify an appropriate time frame, with respect to the objective of detecting and mitigating any security incidents, promptly adopting appropriate countermeasures (see also, in this regard, "Guideline Document. Computer programs and services for managing email in the workplace and processing metadata," Decision No. 06/06/2024, Web Document No. 10026277).

In this case, among other things, based on the Company Rules, this processing is also carried out for the purposes of defending rights, or for purposes other than those necessary to ensure IT security. The retention of log files for the purpose of defending rights in court, however, represents a suitable tool available to the employer for monitoring employee activity (see section 3.3 below).

In light of the overall framework for personal data protection, the processing carried out by the Company in relation to the retention of Internet browsing log files is also unlawful, as it violates the principles of data minimization, purpose limitation, and storage limitation set forth in Article 5, paragraph 1, letters b), c), and e) of the Regulation.

3.3. Violation of Articles 5, paragraph 1, letter a), and 88 of the Regulation and Article 114 of the Code.

The Company's internal policies governing the management of email and Internet use are also relevant for compliance with the applicable regulations set forth in Law No. 300/1970.

Several passages in the document containing the "Rules for the Use of IT Tools" acknowledge that the data controller (or designated IT assistants) may access email content and Internet browsing logs for various purposes (see chapters 5, paragraphs 22-23, and 7).

Although the Company, in its defense briefs, denied having carried out any checks on the content of the complainant's email (and, in general, those of its employees) and that it accessed the email solely for the purpose of responding to the complainant's request for access, these circumstances in themselves are not sufficient to exclude the applicability of the remote monitoring provisions set forth in Law No. 300/1970 to the specific case. 300/1970, precisely by virtue of what is represented in company policies.

Article 4 of Law No. 300/1970, as is well known, provides for a specific safeguard procedure in the event of the use of "tools that also allow for remote monitoring of workers' activities," which "may be used exclusively for organizational and production needs, for workplace safety, and for the protection of company assets," "subject to a collective agreement stipulated by the union representative body or by company union representatives," or, in the absence of an agreement, "subject to authorization from the local office of the National Labor Inspectorate."

In the case at hand, both email backups and the storage of Internet browsing logs are potentially suitable tools for monitoring employee activity because they allow the processing (i.e., the collection, as part of the employment relationship, and the retention for an extended period of time) of personal information and data relating to workers, in the absence of the guarantees established by law.

Therefore, given that, in light of the processing described in the "Rules for the Use of IT Tools," the Company does not appear to have verified the actual existence of the mandatory purposes indicated in Article 4 of Law No. 300/1970 (with particular reference to so-called defensive purposes) nor, following this verification, activated the guarantee procedure provided for by the aforementioned sector legislation, the violation of Articles 5, paragraph 1, letter a) and 88 of the Regulation, which is referred to in Article 114 of the Code ("Guarantees regarding remote monitoring") as a condition for the lawfulness of the processing of personal data carried out in the context of the employment relationship, must be considered confirmed.

4. Conclusions: Declaration of unlawful processing. Corrective measures pursuant to Article 58, paragraph 2, of the Regulation.

For the above reasons, the Authority believes that the statements made by the data controller during the investigation do not address the concerns notified by the Office with the document initiating the proceedings and are therefore unsuitable for dismissing the present proceedings. Furthermore, with regard to these matters, none of the cases provided for by Article 11 of the Garante Regulation No. 1/2019 apply.

The processing of personal data carried out by ITAS Mutua is unlawful, in the terms set out above, as it violates Articles 5, paragraph 1, letters a), b), c), e), 13, 12, 15, and 88 of the Regulation and Article 114 of the Code.

The breach established in the terms set out in the grounds cannot be considered "minor," given the nature of the multiple breaches identified, which concerned the general principles of data processing and the more specific provisions on remote monitoring, the severity and duration of the breach itself, the degree of responsibility, and the manner in which the supervisory authority became aware of the breach (see Recital 148 of the Regulation).

Given the corrective powers granted by Article 58, paragraph 2, of the Regulation, in light of the circumstances of the specific case, we order:

- to allow the complainant full access to the content of the correspondence contained in the individualized company email account used during the employment relationship;

- to align the company policies and the processing described with the personal data protection legislation as referred to in paragraphs 3.2 and 3.3;

- to impose an administrative fine pursuant to Article 58, paragraph 2, of the Regulation. 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i), of the Regulation).

Finally, it is believed that the conditions set out in Article 17 of the Guarantor Regulation No. 1/2019 are met.

5. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).

As a result of the proceedings, it appears that ITAS Mutua violated Articles 5, paragraph 1, letters a), b), c), and e), 13, 12, 15, and 88 of the Regulation, and Article 114 of the Code. Violation of the aforementioned provisions is subject to the application of the administrative pecuniary sanction provided for in Article 83 of the Regulation.

The Garante, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of 24 November 1981) in relation to the processing of personal data carried out by ITAS Mutua, which has been found to be unlawful, in the terms set out above.

Having deemed it necessary to apply Article 83, paragraph 3 of the Regulation, which provides that "If, in relation to the same or linked processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative pecuniary sanction shall not exceed the amount specified for the most serious infringement," the total amount of the sanction is calculated so as not to exceed the maximum amount established by the same Article 83, paragraph 1. 5.

With reference to the elements listed in Article 83, paragraph 2, of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must "in any case be effective, proportionate, and dissuasive" (Article 83, paragraph 1 of the Regulation), it is noted that, in this case, the following circumstances were considered:

Regarding the nature, severity, and duration of the violation, the nature of the violation, which concerned provisions protecting the exercise of data protection rights and more specific provisions protecting data subjects in the context of employment relationships, was considered relevant. Regarding the duration of the violation, the fact that the data relating to the content of email and internet browsing activities are retained for a considerable period of time and that the complainant did not receive a full response to the request for access submitted on July 15, 2022, must be considered relevant;

With regard to the intentional or negligent nature of the violation and the degree of liability of the data controller, the Company's conduct and its degree of liability were taken into consideration, which still does not comply with data protection regulations, specifically with regard to the retention of email and internet browsing data.

The degree of cooperation provided during the investigation and the absence of specific precedents were taken into account in favor of the party.

Furthermore, it is believed that, given the aforementioned principles of effectiveness, proportionality, and dissuasiveness, which the Authority must adhere to in determining the amount of the fine (Article 83, paragraph 1, of the Regulation), the following are of primary importance in this case: the financial circumstances of the offender, determined based on the Company's turnover, as reported in the financial statements for 2024.

In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose an administrative fine of €50,000.00 (fifty thousand) against ITAS Mutua.

In this context, it is also believed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Guarantor No. 1/2019, this chapter containing the injunction should be published on the Guarantor's website.

This is in light of the conduct that is particularly harmful to the data subject's rights, which occurred in violation of the general principles of personal data protection.

NOW THAT THE AUTHORITY

pursuant to Article 57, paragraph 1, letter f), of the Regulation, finds the processing carried out by LT S.p.A., represented by its legal representative pro tempore, with registered office in Trento, Piazza delle Donne Lavoratrici no. 2, VAT no. 00110750221, to be unlawful due to the violation of Articles 5, paragraph 1, letters a), b), c), e), 13, 12, 15, and 88 of the Regulation and Article 114 of the Code;

pursuant to Article 58, paragraph 2, letter f), Article 15, paragraph 4, letter d), of the Regulations, requires the Company to comply, within 90 days of notification of this provision, with the provisions set forth in paragraph 4 of this decision, while also requiring it to provide, within the aforementioned deadline, an adequately reasoned response pursuant to Article 157 of the Code. Failure to provide such response may result in the application of the administrative pecuniary sanction provided for in Article 83, paragraph 5, letter e), of the Regulations;

ORDERS

Pursuant to Article 58, paragraph 2, letter i), of the Regulations, the Company to pay the sum of €50,000.00 (fifty thousand) as an administrative pecuniary sanction for the violations indicated in this provision;

HEREBY ORDER

therefore, the same Company to pay the aforementioned sum of €50,000.00 (fifty thousand), according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981.

It is hereby stated that pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half of the fine imposed within the deadline set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, for filing an appeal as indicated below.

ORDERS

pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/20129, the publication of the injunction order on the Italian Data Protection Authority's website;

pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Italian Data Protection Authority Regulation No. 1/20129, the publication of this provision on the Italian Data Protection Authority's website;

pursuant to Article 17 of Regulation No. 1/2019, the recording of violations and measures adopted pursuant to Article 58, paragraph 2 of the Regulation in the Authority's internal register provided for by Article 57, paragraph 1, letter u) of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150/2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad.

Rome, March 12, 2026

THE PRESIDENT
Stanzione

THE REPORTER

THE DEPUTY SECRETARY GENERAL
Filippi