TL;DR
By decision no. 585 of 6 August 2026, announced on 30 September, the Italian Garante fined La Patria S.p.A., a Bologna security company, €39,000. Three infringements: refusal of access to GPS data without reasons and without mentioning the right to complain or seek a judicial remedy; no privacy notice on company-car geolocation, even though the trade-union agreement referred to it; an inaccurate notice describing special-category processing that never happened. The amount reflects corrections made during the investigation.
The facts
The complaint came from a former worker. The company had given him a car fitted with satellite tracking and, after disciplinary proceedings, dismissed him. To defend himself he asked to see and receive a copy of, among other things, the GPS data. An adequate reply never came.
The three infringements
- ACCESS. A controller that considers it cannot act on a request must still state the reasons for refusing and the right to lodge a complaint with the authority or seek a judicial remedy (Article 12(4)). That did not happen here.
- NO NOTICE. Geolocation data are personal data, yet employees had received no information about that processing. The agreement with workers' representatives, signed under Article 4 of the Italian Workers' Statute, expressly referred to that obligation.
- INACCURATE NOTICE. The documents provided described processing of special categories of data that the company did not actually carry out.
Saying no has a form too
The right of access does not disappear because a dispute with the employee is under way, and a controller is not bound to say yes every time. It is bound to answer on time and, if it refuses, to explain why and point to complaint and judicial remedy. Silence, or a generic refusal, is already an infringement.
Why the amount is moderate
In setting the fine the Garante took into account that the company adopted corrective measures during the investigation: it gave employees a proper notice on geolocation and removed references to special-category processing it did not perform. Corrections do not erase the infringement, but they weigh on the amount.
What it means for the DPO
Four checks
One: every GPS system on company vehicles must appear in the record of processing and in a specific notice, not only in the union agreement or the labour-inspectorate authorisation. Two: the data-subject rights procedure needs a refusal template too, with reasons, complaint and judicial remedy. Three: requests made during litigation are handled like any other, with the same deadline. Four: reread notices and remove anything untrue; describing non-existent processing is an inaccuracy, not caution.
The case shows labour law and the GDPR running on parallel tracks: the union agreement makes the system lawful under employment law, while the GDPR still requires transparency towards each worker and precise answers when they exercise their rights.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
