TL;DR for the DPO
It was not the access itself that was challenged, but the infrastructure that made it possible: mail backups for the whole employment relationship plus five years, logs for six months, an inadequate privacy notice. Whoever retains everything can always reconstruct everything, and for the authority that capability is already remote monitoring.
The facts
The proceeding started from complaints by two former employees of Piaggio & C. Spa. During the employment relationship the company had accessed their company email accounts, acquiring 112 emails in total, for the stated purpose of verifying alleged misconduct.
The detail that weighed most is chronological. In some cases the acquired emails dated from roughly two years before the company formed its suspicion. This was therefore not a targeted check on a specific fact, but a search backwards through an archive that already existed, built before and independently of any suspicion.
That archive was the result of two retention choices: backing up email data for the whole duration of employment and up to five years after termination, and retaining the related access logs for six months. The authority found both periods excessive.
Why it becomes remote monitoring
The authority's reasoning is the settled one on work tools: where collection and retention are systematic and prolonged, the processing becomes capable of reconstructing the employee's activity. At that point the employer's intention no longer matters, only the objective capability of the system. And that capability requires the safeguards of the Italian Workers Statute, which had not been activated here.
This is why the line between a work tool and a monitoring tool is not drawn on paper but in the technical configuration. A mail client is a work tool; the same client with unlimited backup retention and logs kept for months becomes a monitoring system, without anyone ever having taken that decision.
The other findings
- Excessive retention periods for both company emails and access logs, in breach of the storage limitation principle.
- Inadequate information given to employees on the purposes and legal bases of the processing: the notice did not adequately explain what was retained, for how long, and on what conditions it could be accessed.
- Failure to respond to the former employees' data subject requests, in particular those seeking confirmation that their accounts had been deactivated.
The authority declared the processing of company email data unlawful, banned Piaggio from accessing the data collected and stored on its systems, and imposed the administrative fine of 460,000 euro.
What to check with your clients, concretely
1) How long do email backups survive after the employment relationship ends? If the answer is 'I don't know' or 'forever', the problem already exists. 2) How long are mailbox access logs kept? 3) Does the employee privacy notice say, in plain words, what is retained and for how long? 4) Is there a written procedure for deactivating accounts on termination, with confirmation to the individual? 5) Is there a formal procedure for exceptional access to an employee's mailbox, with conditions, authorisation and a written record? The first three are questions for IT, not for HR.
The point for those handling several clients
Company email management is probably the most neglected obligation among those carrying high enforcement risk, because it sits between two functions: IT decides the technical retention, HR writes the privacy notice, and the two are almost never compared. The records of processing are the right place to surface this, because they force you to write the retention period next to the purpose. If a register has no entry for 'employee email', or has one with a generic period, that client has the same problem as Piaggio, only on a smaller scale.
Official source:Italian Data Protection Authority - Newsletter no. 550 of 29 July 2026; decision of 18 June 2026 [doc-web 10272529]Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
