- Does this case really affect my company too, or only large businesses?
- What exactly happened, and which rules were violated?
- Is the GPS data from company vehicles really personal data?
- Is the Garante really stepping up its checks, or is this an isolated case?
- What changes in practice: who does what when an employee request arrives?
- Three real-world scenarios: what happens in a manufacturing company, a professional firm and an e-commerce business?
- Which other similar cases has the Garante already penalized?
- What tools and approaches exist to handle employee requests securely?
- How do you get started: the steps to secure how you handle employee requests
- What are the most common mistakes that lead to fines like this?
- How can you tell if your procedure is really working?
- So, is it worth investing in an audit of your GDPR procedures for employees?
- How we see it at SHM
- Frequently Asked Questions
- The Garante fined a security company from Bologna €39,000 for failing to respond to a former employee's data access requests and for incomplete privacy notices on GPS systems.
- Any written request from an employee about their data counts as exercising the GDPR right of access, even if it doesn't explicitly cite the law: ignoring it exposes you to penalties.
- In 2024, GDPR fines in Italy nearly quintupled compared with the year before (from €25 million to €122 million): the risk is not theoretical.
- The practical solution is a written procedure and an internal owner who handles requests within 30 days, with every step recorded.
A former employee asks to see the data collected about him through GPS. The company doesn't respond. The result: a €39,000 fine from the Garante Privacy. And you don't need to be a large corporation to end up in its crosshairs.
Does this case really affect my company too, or only large businesses?
It affects any company with employees, regardless of size. The €39,000 fine landed on an SME in the security sector, not a multinational.
The company involved is La Patria S.p.A., a technological security and surveillance firm based in Bologna. A former employee submitted two written requests to access the documents related to the disciplinary proceeding that led to his dismissal, including the geolocation data collected by the GPS of the company vehicle he used.
The company did not respond adequately. The Garante Privacy, the Italian authority that oversees compliance with personal data protection rules, opened an investigation and imposed a total fine of €39,000, as reported by the EDPB (the European Data Protection Board).
The key point: you don't have to be big to be fined. You just need to lack an internal procedure for handling these requests.
| Your situation | Are you at risk? | why |
|---|---|---|
| You have employees with company vehicles equipped with GPS | Yes | Geolocation data is personal data: a specific privacy notice is required |
| You don't have a written procedure for responding to employee requests about their data | Yes | Without a procedure, the risk of missing the 30-day deadline is high |
| Your employee privacy notice is generic or copied from a template | Yes | Inaccurate notices, or ones listing data categories that aren't processed, are a standalone violation |
| You already have a documented procedure and a designated internal owner | Partially | Check that it also covers data collected by digital tools (badges, email, GPS, software) |
| You have an active DPO (Data Protection Officer) and up-to-date procedures | Low | Keep your documentation updated with every new tool you introduce |
What exactly happened, and which rules were violated?
The company made three distinct mistakes: it didn't respond to the access requests, it didn't inform employees about the processing of GPS data, and it had a notice listing data categories it didn't process at all.
The Garante identified three separate violations, each with its own partial fine.
| Violation | GDPR Article | Partial fine | What the company should have done |
|---|---|---|---|
| Failure to respond to the former employee's access requests | Art. 15 (right of access) | 22.000 € | Respond within 30 days, or give a written, reasoned refusal that lists the available remedies |
| No privacy notice to employees on the processing of company vehicle GPS data | Art. 13 (privacy notice) | 17.000 € | Provide a specific document explaining what is collected, why and for how long |
| Privacy notice listing special categories of data (e.g. philosophical beliefs, sex life) that the company never processed | Art. 12 (transparency) | Included in the €17,000 | Remove from the notice any reference to data that isn't actually processed |
One important detail: the Garante clarified that an employee doesn't have to cite the GDPR by name for their request to count as exercising the right of access. A simple email saying "I want to see the data you have on me" is enough. If the company doesn't respond, it breaks the law.
The company then corrected its procedures during the investigation, and this had a positive effect on the amount of the fine. The Garante imposed no additional corrective measures precisely because the violations had already ceased by the time of the decision.
Is the GPS data from company vehicles really personal data?
Yes. The Garante has confirmed that the location of a company vehicle is personal data because it can be indirectly traced back to the employee who drives it.
Many companies install GPS systems on company vehicles for logistics or safety reasons, without realizing they're collecting personal data. But if the vehicle is assigned to a specific employee, even just for shifts, its location is data that directly concerns that person.
This means all GDPR rules apply: you need a clear privacy notice before the employee starts using the vehicle, a valid legal basis for the processing, and an adequate response if the employee asks to see that data.
The same principle applies to other monitoring tools common in companies: access badges, video surveillance systems, productivity software that tracks activity on the computer. The Italian Data Protection Authority (Garante) has already penalized similar cases involving company email. One example is the €50,000 fine on Regione Lombardia for keeping employee email metadata for 90 days. It was the first operational application of the 2024 Guidelines on metadata, documented by the Osservatorio Data Protection.
| Company tool | Generates personal data? | Specific privacy notice required? |
|---|---|---|
| GPS on company vehicles | Yes | Yes |
| On-site video surveillance | Yes | Yes |
| Access badges | Yes | Yes |
| Company email (metadata) | Yes | Yes |
| Attendance management software | Yes | Yes |
| Company phone with location tracking | Yes | Yes |
Is the Garante really stepping up its checks, or is this an isolated case?
Inspections are steadily increasing. In 2024, GDPR fines in Italy nearly quintupled compared to the previous year, and employees' right of access is one of the most closely monitored areas.
The numbers speak for themselves. In 2024 the Garante adopted 835 collegial decisions, 468 of them corrective or sanctioning, and handled over 4,000 complaints, an average of 11 per day, according to the 2024 Annual Report of the Garante Privacy. In 2025 there were 807 decisions, with fines of over €37 million and 2,415 data breach notifications, 10% more than the year before, as reported by Ritalia.it.
At the European level, last year the EDPB coordinated an enforcement action focused on the right of access (Article 15 GDPR). It involved 30 national authorities and 1,185 companies of different sectors and sizes, as documented in the EDPB report on the coordinated action. This is no marginal issue: it is a stated priority of European authorities.
The €5.5 million BBVA fine, analyzed in the article BBVA fine: what's at risk for those who ignore the opt-out, shows that the Garante doesn't stop at small cases. And the €825 million Uber case confirms that automated decisions about workers are an area of very high regulatory scrutiny.
What changes in practice: who does what when an employee request arrives?
You need a clear internal process with defined roles. Without one, missing the 30-day legal deadline is almost certain.
- 1 · Employee or former employeeSends the requestThey can do it by email, letter or even verbally. They don't have to cite the GDPR. It's enough to ask to see their own data or the documents that concern them.
- 2 · HR manager or privacy contactLogs the request within 24 hoursEvery request must be logged with its date of receipt. From that moment, the 30-day legal deadline to respond starts.
- 3 · Privacy contact / legalAssesses what to provideIdentifies the processed data that concerns the requester. If there are limitations (e.g. third-party data), documents them in writing.
- 4 · HR manager or legalResponds within 30 daysProvides the requested data or states in writing the reason for refusal and the remedies available (complaint to the Garante or court action).
- 5 · Privacy contactArchives all documentationKeeps the request, the response and every interim communication. In case of an inspection, this documentation is proof of compliance.
Three real-world scenarios: what happens at a manufacturer, a professional firm and an e-commerce business?
The risk varies with the tools used, but the structure of the problem is always the same: data collected without an adequate privacy notice and no procedure for answering requests.
Illustrative examples: the numbers and situations are meant to show the reasoning, they are not real customer data.
| Company type | Tools that generate employee personal data | Main risk | What to do now |
|---|---|---|---|
| Manufacturer with a vehicle fleet | GPS on vans, access badges, warehouse video surveillance | No specific privacy notice for GPS and video surveillance; access requests not handled | Update the privacy notice for each tool; appoint a contact for requests |
| Professional firm (accountant, lawyer) | Company email, management software, possible remote access | Email metadata kept too long; no procedure for requests from collaborators | Check email log retention periods; create a written procedure |
| E-commerce business with a warehouse and logistics team | Order management software, badges, possible GPS on riders | Generic privacy notices that don't cover operational data; requests from former employees ignored | Map all staff-related processing; update privacy notices by role |
Which other similar cases has the Garante already penalized?
Employees' right of access is one of the most affected areas. Recent cases show the Garante steps in with companies of every size and sector.
The Garante's 2024 Annual Report notes that decisions in the workplace mainly concern email, video surveillance and AI-based systems. The 2024 EDPB report on the right of access identified seven main challenges for companies, including the lack of documented internal procedures and inconsistent interpretations of the limits to the right of access.
| Company / Body | Fine | Main violation |
|---|---|---|
| La Patria S.p.A. (security services, Bologna) | 39.000 € | Failure to respond to access requests; no GPS privacy notice |
| Regione Lombardia | 50.000 € | Employee email metadata kept for 90 days without an adequate legal basis |
| Hera Comm | 5.800.000 € | GDPR violations in the use of scoring systems, including Art. 15 |
| EstEnergy | 1.400.000 € | GDPR violations in the use of scoring systems, including Art. 15 |
| Cerved | 400.000 € | GDPR violations in the use of scoring systems, including Art. 15 |
| Experian | 120.000 € | GDPR violations in the use of scoring systems, including Art. 15 |
The highest fines concern large-scale violations, but cases like La Patria show that SMEs aren't safe either. Digital compliance is increasingly intertwined with AI: as the article AI and compliance in ad campaigns shows, the default settings of digital tools can cause violations without the company even noticing.
What tools and approaches exist to handle employee requests securely?
There are three levels of intervention: internal procedures, staff training and external support. The right choice depends on the size of the company and the complexity of its data processing.
| Approach | Suitable for | Indicative cost | Main limitation |
|---|---|---|---|
| Written internal procedure + designated contact | SMEs with few employees and simple processing | Low (internal time) | Needs continuous updating as the tools in use change |
| HR and legal training on GDPR in the employment relationship | Companies with a structured HR team | Medium | Doesn't replace legal advice for complex cases |
| External audit + privacy notice updates | SMEs with monitoring tools (GPS, badges, video surveillance) | Medium-high | One-time investment, to be updated every 1-2 years |
| External DPO (data protection officer) | Companies with complex processing or a legal obligation | Variable (ongoing contract) | Requires a DPO with knowledge of your specific industry |
How do you get started: the steps to secure how you handle employee requests
Start by mapping every tool that collects employee data, then build a procedure and train the people who have to apply it.
- 1 · Management / HRMap every tool that collects employee dataGPS, badges, video surveillance, email, management software, company apps. For each one: what it collects, for how long, and who can access it.
- 2 · Legal / privacy consultantReview and update your privacy noticesEvery tool needs its own specific notice. Remove references to data categories you don't actually process.
- 3 · HR / designated contactCreate a written procedure for access requestsWho receives the request, who assesses it, who replies, and by when. Include a standard reply template for the most common cases.
- 4 · HR / managementTrain the staff who manage employeesHR managers, team leaders and anyone who might receive a request must know what to do and who to pass it to.
- 5 · Privacy contactTest the procedure with a simulationSimulate an access request and check that the process works within the required deadlines. Document the outcome.
- 6 · ManagementSchedule an annual reviewEvery time you introduce a new digital tool, update the mapping and the privacy notices. Don't wait for the Garante to check.
What are the most common mistakes that lead to fines like this?
There are three common mistakes: ignoring requests because they don't explicitly mention the GDPR, using generic privacy notices copied from templates, and failing to update documentation when new tools are introduced.
- Ignoring a request because it's "not formal." The Garante has made clear that there's no need to cite the GDPR. Any written request from an employee about their data triggers the obligation to respond within 30 days.
- Using one generic privacy notice for all employees. If you use GPS, video surveillance or monitoring software, each tool requires a dedicated section in the notice.
- Including data categories in the notice that you don't process. As in the La Patria case, referring to "data on sex life" or "philosophical beliefs" when you don't process them is a separate violation.
- Not appointing an internal contact. Without a clear point of contact, requests get lost between departments and the 30-day deadline passes without anyone noticing.
- Not keeping records of the requests you've handled. In an inspection, proof of compliance is the paperwork: request received, reply sent, date.
How can you tell if your procedure is really working?
There are simple indicators you can track internally, no sophisticated tools needed.
| Indicator | Goal | Red flag |
|---|---|---|
| Average response time to access requests | Under 30 days | Even a single request without a reply within 30 days |
| Percentage of requests with a documented reply | 100% | Any request with no written record of the reply |
| Notices updated after new tools are introduced | Within 30 days of introduction | Tools active for more than 30 days without a specific notice |
| HR staff trained on the procedure | 100% of the HR team and department heads | Managers who don't know who to pass a request to |
| Annual review of the processing map | Once a year | Mapping unchanged for more than 12 months |
So, is it worth investing in an audit of your GDPR procedures for employees?
Worth it if you have employees with GPS-tracked vehicles, badges, video surveillance or monitoring software, and you've never checked the specific notices for these tools. The risk of a penalty is real, and the cost of an audit is far lower than the minimum fine.
Somewhere in between: you already have an employee privacy notice, but haven't updated it in the last 12 months or have introduced new digital tools without updating it. A targeted internal check is enough to reduce the risk.
Not yet if you have an active DPO, documented and up-to-date procedures, and you've already checked the notices for every data collection tool. Keep up periodic monitoring and you're covered.
How we see it at SHM
For us, GDPR compliance in the employment relationship isn't a bureaucratic matter: it shows how well a company really knows its digital processes. If you don't know what data you collect on your employees, or how, you probably don't know it for your customers either.
We've worked with companies that used complex digital tools (management systems, monitoring platforms, access systems) without ever mapping the data those tools generated. The starting point was never the fine: it was understanding what was really happening in their internal processes. From there, building clear procedures was much easier.
If you want to understand where you're exposed, the first step is an audit of your existing procedures. We can help you structure it, train your HR team and build GDPR request handling into the workflows you already use. You'll find our business process automation and optimization and AI and digital tools training for companies services among our core offerings. For a direct conversation, get in touch.
You can explore the European regulatory context further in our article on Project management and technology, where we collect the most relevant cases for Italian SMEs.
Frequently Asked Questions
No. The Garante has made clear that any written request in which an employee asks to see their own data triggers the obligation to respond within 30 days. It doesn't need to cite Article 15 of the GDPR or use technical terms. Even a simple informal email is enough.
The GDPR sets a deadline of 30 days from receipt of the request. In complex cases, it can be extended by a further 60 days, but the employee must be told about the extension within the first 30 days. Not replying at all breaks the law, regardless of how complex the case is.
Yes. The Garante has confirmed that the location of a company vehicle is personal data when the vehicle is assigned to a specific employee, because its location can be indirectly traced back to that person. So a specific notice is needed before the employee starts using the vehicle.
You can refuse, but you must do so in writing, explain your reasons, and inform the employee of the remedies available: filing a complaint with the Garante or going to court. An unexplained refusal is treated as a failure to respond and violates the GDPR.
It depends on what it contains. A generic notice isn't enough if the company uses specific tools such as GPS, video surveillance, access badges or monitoring software. Each of these tools requires a dedicated section explaining what is collected, why and for how long. Including data categories that aren't actually processed is also a violation.
Yes. The case of La Patria S.p.A. proves it: the €39,000 fine landed on an SME in the security sector, not a large corporation. Garante investigations often start from individual complaints, and a single dissatisfied employee is enough to open a proceeding.
The fine doesn't come because the company acted in bad faith: it comes because no one had ever written down who had to respond, to whom, and by when.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
