- Does this case really concern my company too, or only large enterprises?
- What exactly happened and which rules were violated?
- Are the GPS data of company vehicles really personal data?
- Is the Data Protection Authority really increasing checks, or is this an isolated case?
- What changes in practice: who does what when an employee request arrives?
- Three concrete scenarios: what happens in a manufacturing company, a professional firm, and an e-commerce business?
- What other similar cases has the Guarantor already sanctioned?
- What tools and approaches exist to securely manage employee requests?
- How to get started concretely: the steps to secure the management of employee requests?
- What are the most common mistakes that lead to fines like this?
- How to understand if your procedure is really working?
- So, is it worth investing in a GDPR audit for employee procedures?
- How we see it at SHM
- Frequently Asked Questions
- The Data Protection Authority fined a security company from Bologna 39,000 euros for failing to respond to a former employee's data access requests and for incomplete privacy notices regarding GPS systems.
- Any written request from an employee concerning their data counts as the exercise of GDPR access rights, even if it does not explicitly cite the law: ignoring it exposes you to a fine.
- In 2024 in Italy, GDPR fines almost quintupled compared to the previous year (from 25 to 122 million euros): the risk is not theoretical.
- The practical solution is a written procedure and an internal person in charge to handle requests within 30 days, keeping a record of every step.
A former employee asks to see the data collected about them via GPS. The company does not reply. Result: a 39,000 euro fine from the Data Protection Authority. And you don't need to be a big corporation to end up in the crosshairs.
Does this case really concern my company too, or only large enterprises?
It applies to any company with employees, no matter the size. The 39,000 euro fine hit a small security firm, not a huge multinational.
The company involved is La Patria S.p.A., a technological security and surveillance company based in Bologna. A former employee submitted two written requests to access documents related to the disciplinary proceedings that led to his dismissal, including geolocation data collected by the GPS of the company vehicle he used.
The company did not respond adequately. The Data Protection Authority — the Italian authority that oversees compliance with personal data protection rules — has launched an investigation and imposed a total fine of 39,000 euros, as reported by the EDPB (the European Data Protection Board) .
The key takeaway: you don't need to be big to get fined. You just need to lack an internal procedure to handle these requests.
| Your situation | Are you at risk? | why |
|---|---|---|
| Do you have employees with company vehicles equipped with GPS? | Yes | Geolocation data is personal data: a specific notice is required |
| You do not have a written procedure for responding to employee requests about their data | Yes | Without a procedure, the risk of not responding within 30 days is high |
| Your employee privacy policy is generic or copied from a template | Yes | Inaccurate privacy policies or policies with untracked data categories are a standalone violation |
| Do you already have a documented procedure and a designated internal manager | Partially | Verify that it also covers data collected by digital tools (badges, emails, GPS, software). |
| You have an active DPO (Data Protection Officer) and updated procedures | Low | Keep documentation updated with every new tool introduced |
What exactly happened and which rules were violated?
The company made three distinct mistakes: it failed to respond to access requests, it did not inform employees about GPS data processing, and it had a privacy notice listing data categories it did not process at all.
The Guarantor identified three separate violations, each with its own partial penalty.
| Violation | GDPR Article | Partial penalty | What the company should have done |
|---|---|---|---|
| Failure to respond to access requests from former employee | Art. 15 (right of access) | €22,000 | Respond within 30 days, or provide written justification for refusal with available remedies |
| No information provided to employees on the processing of company vehicle GPS data | Art. 13 (privacy policy) | €17,000 | Provide a specific document explaining what you collect, why, and for how long |
| Privacy notice with special categories of data (e.g., philosophical beliefs, sex life) never processed by the company | Art. 12 (transparency) | Included in the €17,000 | Remove any reference to data that is not actually processed from the privacy notice. |
An important detail: the Guarantor clarified that an employee does not need to cite the GDPR by name for their request to be considered an exercise of the right of access. A simple email asking "I want to see the data you have on me" is sufficient. If the company does not respond, it violates the law.
The company then corrected its procedures during the investigation — and this positively influenced the fine amount. The Guarantor did not impose additional corrective measures precisely because the violations had already ceased at the time of the ruling.
Are the GPS data of company vehicles really personal data?
Yes. The Privacy Authority confirmed that a company vehicle's location is personal data because it can be indirectly linked to the employee driving it.
Many companies install GPS systems on company vehicles for logistical or security reasons, without realizing they are collecting personal data. But if the vehicle is assigned to a specific employee — even just for shifts — their location is data that directly concerns them.
This means that all GDPR rules apply: clear information is required before the employee starts using the vehicle, a valid legal basis for processing, and an adequate response if the employee asks to see that data.
The same principle applies to other common monitoring tools in companies: access badges, video surveillance systems, productivity software that records computer activity. The Guarantor has already sanctioned similar cases related to company email — such as the €50,000 fine to the Lombardy Region for retaining employee email metadata for 90 days, the first operational application of the 2024 Guidelines on metadata, documented by the Data Protection Observatory .
| Company tool | Does it generate personal data? | Specific privacy notice requested? |
|---|---|---|
| GPS on company vehicles | Yes | Yes |
| On-site video surveillance | Yes | Yes |
| Access badge | Yes | Yes |
| Company email (metadata) | Yes | Yes |
| Attendance management software | Yes | Yes |
| Company phone with tracking | Yes | Yes |
Is the Data Protection Authority really increasing checks, or is this an isolated case?
Checks are on a steady rise. In 2024, GDPR fines in Italy almost quintupled compared to the previous year, and employee access rights are one of the most monitored areas.
The numbers speak for themselves. In 2024, the Privacy Authority adopted 835 collegial measures, of which 468 were corrective or punitive, handling over 4,000 complaints — an average of 11 per day, according to the Annual report 2024 of the Privacy Guarantor . In 2025 there were 807 enforcement actions, with fines totaling over 37 million euros and 2,415 data breach notifications, 10% more than the previous year, as reported by Ritalia.it .
On the European front, last year the EDPB coordinated a specific enforcement action on the right of access (Article 15 GDPR) involving 30 national authorities and 1,185 companies of various sectors and sizes, as documented in EDPB report on coordinated action . The issue is not marginal: it is a declared priority of the European authorities.
The case of the BBVA fine of 5.5 million euros — analyzed in the article BBVA fine: what are the risks of ignoring opt-out — shows that the Guarantor does not stop at small cases. And the case Uber at 825 million Confirm that automated decisions about workers are an area of very high regulatory attention.
What changes in practice: who does what when an employee request arrives?
You need a clear internal process with defined roles. Without it, the risk of exceeding the 30 days required by law is almost certain.
- 1 · Employee or former employee Send the request They can do it via email, letter, or even verbally. They don't need to mention the GDPR. They just need to ask to see their data or documents concerning them.
- 2 · HR Manager or privacy contact person Log the request within 24 hours Every request must be logged with the date of receipt. From that moment, the 30 days allowed by law to respond begin.
- 3 · Privacy contact / legal Evaluate what to provide Identify the processed data concerning the requester. If there are limitations (e.g., third-party data), document them in writing.
- 4 · HR manager or legal counsel Responds within 30 days Provide the requested data or communicate in writing the reason for the refusal and the available remedies (complaint to the Data Protection Authority or judicial appeal).
- 5 · Privacy contact person Archive all documentation Keep the request, the response, and any intermediate communication. In case of an inspection, this documentation is proof of compliance.
Three concrete scenarios: what happens in a manufacturing company, a professional firm, and an e-commerce business?
The risk varies depending on the tools used, but the structure of the problem is always the same: data collected without an adequate privacy notice and no procedure to respond to requests.
Illustrative examples: the numbers and situations are meant to show the reasoning, they are not real customer data.
| Company type | Tools that generate personal data of employees | Main risk | What to do right away |
|---|---|---|---|
| Manufacturing company with vehicle fleet | GPS on vans, access badges, video surveillance in the warehouse | No specific notice for GPS and video surveillance; unmanaged access requests. | Update the privacy policy for each tool; designate a contact person for requests |
| Professional firm (accountant, lawyer) | Company email, management software, possible remote access | Email metadata retained for too long; no procedure for collaborator requests. | Verify email log retention times; create a written procedure |
| E-commerce with warehouse and logistics team | Order management software, badges, possible GPS on riders | Generic notices that do not cover operational data; ignored requests from former employees. | Map all staff-related processing; update role-based notices |
What other similar cases has the Guarantor already sanctioned?
Employees' right of access is one of the most impacted areas. Recent cases show that the Authority intervenes on companies of all sizes and sectors.
The Garante's 2024 annual report it points out that measures in the workplace context mainly concern email, video surveillance, and AI-based systems. The EDPB 2024 report on the right of access highlighted seven major challenges for businesses, including a lack of documented internal procedures and mixed interpretations of the limits on the right of access.
| Company / Organization | Fine | Main violation |
|---|---|---|
| La Patria S.p.A. (security, Bologna) | €39,000 | Failure to respond to access requests; absent GPS policy |
| Lombardy Region | €50,000 | Employee email metadata retained for 90 days without adequate legal basis |
| Hera Comm | €5,800,000 | GDPR violations in the use of scoring systems, including art. 15 |
| EstEnergy | €1,400,000 | GDPR violations in the use of scoring systems, including art. 15 |
| Cerved | €400,000 | GDPR violations in the use of scoring systems, including art. 15 |
| Experian | €120,000 | GDPR violations in the use of scoring systems, including art. 15 |
The highest penalties involve large-scale violations, but cases like La Patria show that SMEs are not safe either. The issue of digital compliance is increasingly intertwined with AI, as the article shows AI and compliance in ad campaigns , the default settings of digital tools can generate violations without the company noticing.
What tools and approaches exist to securely manage employee requests?
There are three levels of intervention: internal procedures, staff training, and external support. The choice depends on the size of the company and the complexity of the processing.
| Approach | Suitable for | Indicative cost | Main limitation |
|---|---|---|---|
| Written internal procedure + designated contact person | SMEs with few employees and simple treatments | Low (internal time) | Requires continuous updating as the tools used change |
| HR and legal training on GDPR in the employment relationship | Companies with a structured HR team | Medium | Does not replace legal advice for complex cases |
| External audit + privacy policy update | SMEs with monitoring tools (GPS, badges, video surveillance) | Medium-high | One-time investment, to be updated every 1-2 years |
| External DPO (Data Protection Officer) | Companies with complex processing or legally required | Variable (ongoing contract) | Requires a DPO with knowledge of the specific sector |
How to get started concretely: the steps to secure the management of employee requests?
We start with a mapping of all tools that collect employee data, then we build a procedure and train those who need to apply it.
- 1 · Management / HR Map all tools that collect data on employees GPS, ID badges, video surveillance, emails, management software, company apps. For each one: what it collects, for how long, who accesses it.
- 2 · Legal counsel / privacy consultant Check and update the privacy notices Each tool must have its own specific privacy notice. Remove references to data categories that you do not actually process.
- 3 · HR / designated contact Create a written procedure for access requests Who receives the request, who evaluates it, who replies, and by when. Include a standard reply template for the most common cases.
- 4 · HR / management Train staff who manage employees HR managers, team leaders, and anyone who might receive a request must know what to do and to whom to forward it.
- 5 · Privacy contact person Test the procedure with a simulation Simulate an access request and verify that the process works within the expected timeframe. Document the outcome.
- 6 · Management Schedule an annual review Whenever you introduce a new digital tool, update the mapping and privacy notices. Don't wait for a check from the Data Protection Authority.
What are the most common mistakes that lead to fines like this?
The most frequent mistakes are three: ignoring requests because they do not explicitly cite the GDPR, using generic privacy notices copied from templates, and failing to update documentation when introducing new tools.
- Ignoring the request because "it is not formal". The Data Protection Authority made it clear that mentioning the GDPR isn't necessary. Any written request from an employee about their data triggers the obligation to reply within 30 days.
- Use a generic privacy notice for all employees. If you use GPS, video surveillance, or monitoring software, each tool requires a dedicated section in the privacy notice.
- Include categories of data you do not process in the notice. As in the La Patria case, including references to "sex life data" or "philosophical beliefs" when you are not processing them is an autonomous violation.
- Do not appoint an internal manager. Without a clear contact person, requests get lost between departments and the 30-day deadline expires without anyone noticing.
- Do not keep documentation of managed requests. In case of an inspection, the proof of compliance is the documentation: request received, response sent, date.
How to understand if your procedure is really working?
There are simple indicators to monitor internally, without the need for sophisticated tools.
| Indicator | Goal | Red flag |
|---|---|---|
| Average response time to access requests | Under 30 days | Even a single request without a response within 30 days |
| Percentage of requests with documented response | 100% | Any request without written trace of the response |
| Updated notices after the introduction of new tools | Within 30 days of introduction | Tools active for more than 30 days without specific notice |
| HR staff trained on the procedure | 100% of the HR team and department heads | Managers who do not know who to forward a request to |
| Annual review of treatment mapping | Once a year | Mapping stalled for over 12 months |
So, is it worth investing in a GDPR audit for employee procedures?
It is worth it if you have employees with GPS vehicles, badges, video surveillance, or monitoring software and you've never checked the specific privacy policies for these tools. The risk of a penalty is real, and the investment in an audit is far lower than the minimum fine.
A middle ground you already have an employee privacy notice but you haven't updated it in the last 12 months or you've introduced new digital tools without updating it. A targeted internal check is enough to reduce the risk.
Not yet if you have an active DPO, documented and updated procedures, and you've already checked the privacy policies for each data collection tool. Just keep doing regular checks and you're good to go.
How we see it at SHM
For us, GDPR compliance in the employment relationship isn't a bureaucratic issue: it's a sign of how well a company truly knows its digital processes. Those who don't know what data they collect about their employees — and how — usually don't know it for their customers either.
We have worked with companies that used complex digital tools (management software, monitoring platforms, access systems) without ever mapping the data these tools generated. The starting point was never the fine: it was understanding what was really happening in internal processes. From there, building clear procedures was much simpler.
If you want to understand where you are exposed, the first step is an audit of your existing procedures. We can help you structure it, train your HR team, and integrate GDPR request management into your current operational workflows. You can find our services at automation and optimization of business processes and of training on AI and digital tools for companies among our main activities. For a direct comparison, Write to us .
You can learn more about the European regulatory context in the article dedicated to the topic Project management and technology , where we collect the most relevant cases for Italian SMEs.
Frequently Asked Questions
No. The Guarantor has clarified that any written request from an employee asking to see their data triggers the obligation to respond within 30 days. It is not necessary to cite Article 15 of the GDPR or use technical terms. Even a simple informal email is sufficient.
The GDPR provides for a deadline of 30 days from the receipt of the request. In complex cases, the deadline can be extended by another 60 days, but the employee must be informed of the extension within the first 30 days. If no response is given at all, the law is violated regardless of the case's complexity.
Yes. The Guarantor confirmed that the position of a company vehicle is personal data when the vehicle is assigned to a specific employee, because its position can be indirectly traced back to that person. Therefore, specific information is required before the employee starts using the vehicle.
You can refuse, but you must do so in writing, stating the reasons for refusal and informing the employee of the available remedies: filing a complaint with the Data Protection Authority or taking legal action. An unmotivated refusal is equivalent to a non-response and constitutes a GDPR violation.
It depends on what it contains. A generic privacy policy is not enough if the company uses specific tools like GPS, video surveillance, access badges, or monitoring software. Each of these tools requires a dedicated section explaining what is collected, why, and for how long. Including categories of data that are not actually processed is also a violation.
Yes. The case of La Patria S.p.A. proves it: the fine of 39,000 euros was issued to an SME in the security sector, not a large corporation. The Guarantor's investigations often start from individual complaints, and a single dissatisfied employee is enough to initiate proceedings.
The fine doesn't come because the company acted in bad faith: it comes because no one had ever written down who had to reply, to whom, and by when.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
