ITALIAN DATA PROTECTION AUTHORITY: EMPLOYEE MONITORING THROUGH GEOLOCATION SYSTEMS
With Decision No. 382/2026, the Italian Data Protection Authority (Garante per la protezione dei dati personali) found unlawful the processing of employees’ geolocation data carried out through a GPS tracking system installed in company vehicles.
In the case examined by the Authority, although a collective agreement had been concluded pursuant to Article 4 of the Workers’ Statute (Law No. 300/1970), the geolocation system recorded the vehicles’ position every 60 seconds and enabled real-time monitoring, resulting in the essentially continuous tracking of employees’ movements.
According to the Authority, such a configuration infringed the GDPR principles of data minimisation, proportionality and data protection by design.
The Authority also challenged the failure to carry out a prior Data Protection Impact Assessment (DPIA) under Article 35 GDPR, despite the significant risks associated with the systematic monitoring of workers.
The Authority therefore: (i) held that the use of geolocation data for disciplinary purposes was unlawful, as the data had been collected through processing that was not compliant with data protection law and were therefore unusable pursuant to Article 4(3) of Law No. 300/1970; and (ii) notwithstanding the corrective measures subsequently implemented by the controller, found infringements of Articles 5, 6, 25, 35 and 88 GDPR, as well as Articles 113 and 114 of the Italian Privacy Code, and imposed an administrative fine of EUR 6,000.
