Italian DPA sanctions Top Secret Investigazioni for unjustified email forwarding after

[Web Doc. No. 10287400] Decision of July 23, 2026 Register of Decisions No. 554 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter referred to as the “Code”); HAVING REGARD TO the complaint filed pursuant to Art. 77 of the Regulation by Messrs. XX and XX against Top Secret Investigazioni e Sicurezza s.r.l.; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Acting Secretary General pursuant to Article 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Ginevra Cerrina Feroni; PREAMBLE 1.

The complaint filed with the Data Protection Authority and the preliminary investigation initiated by the Office. In a complaint filed with this Authority on April 14, 2022, supplemented by two subsequent communications dated January 27, 2023, and April 5, 2023, Mr. XX and Mr. XX, through their attorney, Mr. XX, alleged a violation of personal data protection regulations by Top Secret Investigazioni e Sicurezza s.r.l. (hereinafter “the Company”), specifically regarding the failure to deactivate individual company email accounts (XX and XX) following the termination of employment—with incoming messages being redirected to another account—as well as the failure to provide information regarding the processing of personal data. In support of their complaint, they submitted to the record several emails that the Company had sent in response to messages addressed to the aforementioned accounts.

By letter dated July 6, 2023, this Office issued a request for information to the Company, pursuant to Article 157 of the Code, in order to gather relevant information for evaluating the matters raised in the complaint. In response to this request, the Company submitted its observations via a letter dated July 28, 2023, stating that: - “On February 7, 2020, [the complainants] both signed a union settlement agreement with Top Secret Investigazioni e Sicurezza srl, which stipulated that the aforementioned company deactivate the complainants’ corporate accounts by February 29, 2020 “by inserting an automated reply message redirecting the User to another entity or account in no way traceable” to the complainants themselves”; - “as noted by Engineer XX, who was tasked with conducting an investigation into the technical validity of the complainants’ grievances (…) these are merely “placeholders,” used solely to respond to specific requests from senders, and not active email “accounts”—that is, spaces reserved and used to receive emails—such that no data processing activity (e.g., even simple viewing) was ever carried out by the data controller”; - “Proof of the foregoing is the response forwarded to me by the provider, which specified that both of the aforementioned mailboxes were deleted on February 28, 2020—that is, prior to the deadline established by the labor conciliation agreement”; - “Engineer (…) also noted that any communication sent to the aforementioned addresses was simply forwarded by the OVH server to the autoresponder subsystem, which handled the request and sent an automatic reply message to the sender”; - “Due to a configuration error, the literal content of the message did not correspond to what actually occurred, since the autoresponder was not configured to forward the email to another address (which is instead the function of a forwarder)”; - “It follows that no data processing activities were carried out by Top Secret Investigazioni e Sicurezza S.r.l. in relation to the aforementioned accounts (…), as they were permanently deleted before the deadline set forth in the employment agreement, nor is there any evidence to the contrary.”

Furthermore, the Company submitted copies of the personal data processing notices, signed by the former employees upon their hiring (specifically on December 8, 2011, and May 12, 2010), and a copy of the “Internal Company Regulations,” dated April 20, 2018, concerning, among other matters, the use of devices by employees, which were made available to them by posting on the company bulletin board. The complainants submitted, in a letter dated November 15, 2023, their comments regarding the Company’s arguments, reiterating instead that the email accounts had remained active “at least through the end of 2021, as Users continued to receive the same forwarding notice from Top Secret.” 2. The initiation of proceedings for the adoption of corrective and punitive measures by the Authority. In light of the foregoing, the Office notified the Company of the initiation of sanction proceedings, pursuant to Article 166, paragraph 5, of the Code (note dated March 11, 2024), for the violation of Articles 5, para 1, subparagraph a), and 13, regarding the inadequacy of the information provided, and of Article 5, para 1, subparagraphs a), (c) and (e), of the Regulation in connection with the continued use of the two complainants’ email addresses following the termination of their respective employment relationships.

On April 9, 2024, the Company submitted its defense briefs, pursuant to Art. 18 of Law No. 689/1981, in which the representative stated that it had never disputed the principle that company accounts attributable to identified or identifiable individuals must be removed upon termination of the employment relationship. In fact, in the mutual termination agreements entered into with the two complainants, the complainants themselves “had provided for the activation of an automatic reply with redirection to another account ‘not traceable to the complainant.’” Therefore, based on the technical guidance received (as set forth in the technical report, Annex 7 to the defense briefs), it was held that “the representatives’ accounts were merely virtual, or ‘mere placeholders,’ used solely to respond to specific requests from senders and not active email ‘mailboxes’ (…). The redirection to another address would therefore have been merely fictitious.”

“Top Secret and Investigazioni’s belief that the accounts had been removed or deactivated was reinforced by the provider itself, according to which both of the aforementioned accounts were deactivated on February 28, 2020.” With regard to the criteria set forth in Article 83, para 2, of the Regulation, the Company noted that the violation, if established, would in any case have been of limited duration, affecting only two individuals who had expressly requested, as part of a union agreement, “forwarding to another account via an automatic responder.” Furthermore, “the effects of the violation had already been fully remedied for the data subjects as of October 20, 2020—well before the GPDP notified the Company of the initiation of proceedings.” The Company also reported that it had launched an internal investigation to identify the technical issues that had caused the delay in the final erasure of the accounts assigned to the complainants.

Following this investigation, new “Company Regulations for the Use of IT Systems and Tools” were approved, along with a new privacy notice template to be provided to the data subjects. On May 4, 2026, a hearing was held with the Company, during which it clarified that the complainants had served as privacy officers and were therefore aware of the procedures adopted by the Company regarding the use of IT tools. In particular, during the hearing, the Company requested that the proceedings be dismissed, given that the 120-day deadline set forth in the internal regulations for the conclusion of sanction proceedings had expired, in accordance with the judgement of the Court of Cassation in Case No. 18583/2025. 3. The outcome of the preliminary investigation and the proceedings for the adoption of corrective and sanctioning measures pursuant to Article 58(2) of the Regulation. Upon review of the statements made by the party during the proceedings, as well as the documentation obtained, it has been established that the Company, identified as the controller pursuant to Article 4, No. 7, of the Regulation, has carried out processing operations concerning the complainants that do not comply with the regulations governing data protection.

In this regard, it should be noted that, unless the act constitutes a more serious offense, any person who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, shall be liable pursuant to Art. 168 of the Code, “False Statements to the Data Protection Authority and Interruption of the Performance of the Data Protection Authority’s Duties or the Exercise of Its Powers.” 3.1. Preliminary Issue. Compliance with Procedural Deadlines. As a preliminary matter, we must address the issue raised by the Company during the hearing, according to which the present proceeding is flawed due to the expiration of the 120-day deadline set forth in the Authority’s internal Regulations for the conclusion of the Authority’s proceedings. On this point, reference is made first and foremost to Article 166, paragraph 5, of the Code, pursuant to which “The Office of the Data Protection Commissioner, when it considers that the evidence gathered in the course of the activities referred to in paragraph 4 constitutes one or more violations specified in this title and in Article 83, paragraphs 4, 5, and 6, of the Regulation, shall initiate proceedings for the adoption of the measures and sanctions referred to in paragraph 3 by notifying the controller or processor of the alleged violations, in accordance with the safeguards provided for by the Regulation referred to in paragraph 9 (…)”.

Regulation No. 2/2019, concerning the identification of the departments and organizational units responsible for administrative proceedings at the Italian Data Protection Authority, provides that the “notification of alleged violations” referred to in Art. 166, paragraph 5, of the Code, must take place within 120 days “from the ascertaining of the violation for notification thereof to residents within the territory of the Republic, or 360 days for notification to residents abroad.” It should be noted, among other things, that the judgement cited by the party (Supreme Court No. 18583/2025) draws a distinction within the scope of the Data Protection Authority’s procedural activities, identifying “a sanctioning phase in the strict sense (see Art. 166, paragraph 5, of Legislative Decree No. 196/03, …) and a preceding investigative phase (or, if you prefer, a preliminary investigation phase, to which, instead, paragraph 4 of the same Art. 166 is dedicated)”.

Therefore, “only once the investigative (or preliminary) phase governed by Article 166, paragraph 4, of Legislative Decree No. 196/03 (…), has been completed, shall the Office of the Data Protection Authority—“when it considers that the evidence gathered during the activities referred to in paragraph 4 constitutes one or more violations specified in this Title and in Article 83, paragraphs 4, 5, and 6 of the Regulation, shall initiate proceedings for the adoption of the measures and sanctions referred to in paragraph 3, notifying the controller or processor of the alleged violations,” specifying that with regard to the Authority’s “investigative or (preliminary)” activities, “there is no peremptory deadline” for their completion (in this regard, reference is also made to Constitutional Court Judgement No. 151/2021). Instead, “the time limit of 120 days, to be considered mandatory, set forth in point 2 of Annex “B” of the Data Protection Authority’s Regulation No. 2/2019 refers exclusively to the sanctioning phase in the strict sense and begins upon the conclusion of the preliminary investigation phase, which culminates in the actual determination of the violations attributed to the offender and the service of the notice of violation.”

This position was further confirmed by a recent judgement of the Court of Cassation (No. 22791/2026), which emphasizes that “the 120-day deadline is not a deadline for imposing the sanction starting from the notification of the violations, but rather a deadline for serving the notice of violations, which begins to run from the final determination—to be assessed according to criteria of reasonableness and appropriateness—since the mere acquisition of information is not sufficient; rather, the Data Protection Authority must be able to evaluate all the constituent elements of the offense based on the evidence gathered. It is, therefore, a procedural deadline, not a final deadline.” In this context, the Authority correctly identified the starting point of the 120-day period for initiating the sanctioning proceeding as the moment when it not only materially acquired but also fully assessed the investigative evidence on file, and, following that assessment, concluded that the evidence constituted a violation of the regulations governing data protection (on this point, see Court Decision No. 151/2021; Court of Cassation, Section I, July 8, 2025, No. 18583).

In the case at hand, any consent that, according to the Company, the two complainants allegedly gave during union mediation—by requesting that correspondence passing through their company email accounts be redirected to another account—is not relevant. This is because, within the context of an employment relationship—and given the asymmetry between the respective parties—consent does not, as a rule, constitute a valid basis for the lawfulness of personal data processing, regardless of the employer’s legal status (Recital No. 43; Art. 4, point 11), and Art. 7, paras. 3 and 4, of the Regulation; see the established position at the European level, the “Art 29 Working Party”, Opinion 2/2017 on data processing in the workplace, WP 249, pp. 7 and 26, and Guidelines on consent under EU Regulation 2016/679—WP 259—dated May 4, 2020). In any case, in the two conciliation reports included in the case file (Attachments 5 and 6 to the note dated July 28, 2023), no consent is expressly given by the data subjects; rather, the Company undertakes the obligation to “deactivate the account (…) by February 29, 2020, by inserting an automated reply message redirecting the User to another entity/account (…)”.

In the present case, therefore, the forwarding of correspondence to another corporate email account appears to have taken place over a period of approximately 8 months, given that the last communication received on the individual account of one of the two complainants is dated October 8, 2020. In light of this action, the Company has not provided any useful clarification regarding the purposes or legal basis for the processing, thereby effectively engaging in the processing of personal data that is contrary to the principles of lawfulness, data minimisation, and storage limitation (Art. 5, para. 1, subpar. a), (c) and (e) of the Regulation), according to which data must be “processed lawfully, fairly, and transparently,” must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed,” and must be retained “for no longer than is necessary for the purposes for which they are processed.”

From a general standpoint, the Authority has deemed it consistent with the principles of personal data protection that, to safeguard possible and legitimate business continuity needs, after the termination of the employment relationship, the data controller shall remove the account, after deactivating it and simultaneously implementing automated systems designed to notify third-party senders and provide them with alternative contact information related to the employee’s professional activities, while also taking appropriate measures to prevent the display of incoming messages during the period in which such automated system is in operation (see Order No. 754 of December 18, 2025, Web Doc. No. 10213574, and Order No. 53 of February 1, 2018, Web Doc. No. 8159221). In its defense briefs, the Company submitted the new “Regulation on the Use of IT Systems and Tools,” which outlines the procedures for managing email, including the deactivation of individual accounts following the termination of employment.

However, it should be noted that the Regulations describe certain data processing operations that do not yet comply with the provisions and principles governing data protection. In particular, with reference to the provisions of Art. 18 of the aforementioned Regulations (“after the termination of the employment relationship (…), the company reserves the right to assess, at its sole and absolute discretion, the need to keep the inbox active for an appropriate period of time in order to ensure business operations. (…)” This is based on the assumption that “the assigned email account constitutes a work tool” and that “the documentation present in the profile of a user whose employment relationship has ended will be presumed by the company to be work-related correspondence and documentation rather than personal information”). For this reason, the Company is hereby requested, pursuant to Art 57, para 1, subparagraph d) of the Regulation, to review its internal policies in light of the principles governing data protection and the provisions regarding remote monitoring set forth in Law No. 300/1970, bearing in mind that, as the Authority has consistently noted in numerous decisions, the content of email messages, as well as the external data of communications, constitute forms of correspondence protected by guarantees of confidentiality that are also constitutionally protected (Articles 2 and 15 of the Constitution), with respect to which there is a legitimate expectation of confidentiality regarding the messages that are the subject of such correspondence (see point 5.2(b) of Ruling No. 13 of March 1, 2007, containing Guidelines for Email and the Internet, Web Doc.

No. 1387522; and, with regard to specific cases, most recently, Provision No. 613 of October 9, 2025, Web Doc. No. 10185435). Based on the above considerations, the violation of the principles of lawfulness, data minimization, and storage limitation must therefore be confirmed in relation to the processing carried out by the Company on the individual email accounts assigned to the complainants following the termination of their employment. 3.2. Violation of Articles 5(1)(a) and 13 of the Regulation. With regard to the processing carried out by the Company on its employees’ email accounts, there is no evidence that the Company prepared documentation sufficient to fully describe the processing activities subsequently carried out. In fact, at the time the events occurred, the privacy notices signed by the two complainants upon their hiring (Attachments 13 and 14 to the note dated July 28, 2023) predate the entry into force of the Regulation, and there is no evidence that they were updated.

In any case, these forms contain only very general information regarding the processing purposes and methods of the employer’s processing of personal data. Other documentation pertains to their designation as administrators and custodians of passwords for accessing computers (Attachment 12 to the aforementioned note), which, however, is irrelevant to the case at hand. Nor does the Company Regulation referred to in Annex 9 to the note dated July 28, 2023, contain any useful provisions regarding the management of email and the storage of its content, particularly following the termination of an employment relationship. Such conduct is contrary to the obligation set forth in Article 13 of the Regulation, which requires the controller to provide the data subject, at the time personal data are collected, with all the information necessary to ensure fair and transparent processing (see also Recital 60).

Furthermore, in the context of an employment relationship, the obligation to provide an appropriate privacy notice is an expression of the principle of fairness set forth in Art. 5(1)(a) of the Regulation. It is noted that the Company, in its defense briefs, has prepared a new privacy notice template pursuant to Art. 13 of the Regulation and that the new internal policy template (dated September 1, 2024) contains more detailed information on specific processing operations. However, as already noted in the previous paragraph, it remains the case that the privacy notice and, in general, the policies must always describe lawful processing operations. Therefore, the violation of Articles 5(1)(a) and 13 of the Regulation regarding the absence of an adequate privacy notice remains. 4. Conclusions: Declaration of the unlawfulness of the processing. Corrective measures pursuant to Art 58(2) of the Regulation.

For the reasons set forth above, the Authority considers that the statements made by the controller during the preliminary investigation do not address the findings notified by the Office in the notice initiating the proceedings and are therefore insufficient to warrant the dismissal of this proceeding; moreover, with respect to these aspects, any of the cases provided for in Article 11 of the Data Protection Authority’s Regulation No. 1/2019. The processing of personal data carried out by Top Secret Investigazioni e Sicurezza s.r.l. is unlawful, under the terms set forth above, as it was carried out in violation of Articles 5(1)(a), (c), and (e), and Article 13 of the Regulation. The violation ascertained as described in the reasoning cannot be considered “minor,” given the nature of the violation, which concerned compliance with the general principles of processing and the obligation to provide a privacy notice.

The average level of severity of the violation, its duration, the number of data subjects involved, and the manner in which the Authority became aware of the violations were taken into account. In light of the corrective powers granted by Article 58, para 2, of the Regulation, and in light of the circumstances of the specific case, an administrative fine is imposed pursuant to Art 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, para 2, subparagraph (i), of the Regulation). Finally, it is considered that the conditions set forth in Art. 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. 5. Adoption of the injunction ordering the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The outcome of the proceedings shows that Top Secret Investigazioni e Sicurezza s.r.l. has violated Articles 5(1)(a), (c), and (e), and Article 13.

For the violation of the aforementioned provisions, the administrative fine provided for in Art. 83, para. 5, subparagraph a), of the Regulation shall be imposed. The Data Protection Authority, pursuant to Article 58, para 2, subparagraph i) of the Regulation and Article 166 of the Code, has the authority to impose an administrative fine as provided for in Article 83 of the Regulation, by issuing an injunction (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Top Secret Investigazioni e Sicurezza s.r.l., which has been found to be unlawful, as set forth above. Having determined that paragraph 3 of Art 83 of the Regulation must be applied, which provides that “If, in relation to the same processing operation or to related processing operations, a controller […] intentionally or negligently infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious violation,” the total amount of the fine is calculated so as not to exceed the maximum amount provided for in Art. 83, para. 5.

With regard to the factors listed in Art. 83(2) of the Regulation for the purposes of applying the administrative fine and determining its amount, and taking into account that the fine must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), it is noted that, in the present case, the following circumstances were taken into account: - With regard to the nature and severity of the violation, the following violations were deemed significant: those concerning the general principles of data processing related to the use of electronic tools in the context of the employment relationship, as well as the failure to provide appropriate information; it must be taken into account that the forwarding of correspondence received in the complainants’ accounts to another company account continued for a period of 8 months following the termination of their respective employment relationships; - With regard to whether the violation was intentional or negligent and the degree of the data controller’s accountability, the Company’s conduct was taken into account, as it had prepared a new privacy notice and set of company Regulations (although critical issues remain regarding these documents that were not the subject of a specific investigation); - The absence of prior data breaches regarding personal data protection was taken into account.

It is further considered that the following factors are relevant in this case, taking into account the aforementioned principles of effectiveness, proportionality, and deterrence to which the Authority must adhere in determining the amount of the penalty (Art. 83, para. 1, of the Regulation): first, the economic circumstances of the offender, determined based on the company’s turnover as reported in the financial statements for the year 2024. In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose on Top Secret Investigazioni e Sicurezza s.r.l. an administrative fine in the amount of 6,500.00 (six thousand five hundred) euros. In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website.

NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Article 57, para 1, subparagraph f), of the Regulation, finds that the processing carried out by Top Secret Investigazioni e Sicurezza s.r.l., in the person of its pro tempore representative, with registered office in Ferrara, Via Zandonai No. 4, VAT No. 01857670382, for violating Articles 5(1)(a), (c), and (e) and Article 13 of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph i) of the Regulation, that the aforementioned Company pay the sum of 6,500.00 (six thousand five hundred) euros as an administrative fine for the violations indicated in this order; THEREFORE ORDERS the said Company to pay the aforementioned sum of €6,500.00 (six thousand five hundred), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981.

It is noted that, pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying —again in accordance with the procedures set forth in the attachment—of an amount equal to half of the imposed penalty within the time limit specified in Art. 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, which is the deadline for filing an appeal as indicated below. ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/20129, the publication of the injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/20129, the publication of this order on the Data Protection Authority’s website; - pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts by submitting a petition to the ordinary court of the jurisdiction specified in Art 10, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori [Web Doc. No. 10287400] Decision of July 23, 2026 Register of Decisions No. 554 of July 23, 2026 THE DATA PROTECTION COMMISSIONER AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the alignment of national law with Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed pursuant to Art. 77 of the Regulation by Messrs.

XX and XX against Top Secret Investigazioni e Sicurezza s.r.l.; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Acting Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Ginevra Cerrina Feroni; PREAMBLE 1. The complaint filed with the Data Protection Authority and the preliminary investigation initiated by the Office. In a complaint filed with this Authority on April 14, 2022, and supplemented by two subsequent communications dated January 27, 2023, and April 5, 2023, Mr. XX and Mr. XX, through their attorney, Mr. XX, alleged a violation of personal data protection regulations by Top Secret Investigazioni e sicurezza s.r.l. (hereinafter “the Company”), specifically regarding the failure to deactivate individual company email accounts (XX and XX) following the termination of employment—with incoming messages being redirected to another account—as well as the failure to provide information regarding the processing of personal data.

In support of their claims, they submitted to the record several emails that the Company had sent in response to messages addressed to the aforementioned accounts. By letter dated July 6, 2023, this Office issued a request for information to the Company, pursuant to Article 157 of the Code, in order to obtain useful information for evaluating the matters raised in the complaint. In response to this request, the Company submitted its comments via a letter dated July 28, 2023, stating that: - “On February 7, 2020, [the complainants] both signed a union settlement agreement with Top Secret Investigazioni e Sicurezza srl, whereby it was established that the aforementioned company would deactivate the complainants’ corporate accounts by February 29, 2020 “by inserting an automated reply message that redirects the User to another entity or account in no way traceable” to the complainants themselves”; - “as noted by Engineer XX, who was tasked with conducting an investigation into the technical validity of the complainants’ grievances (…) these are mere ‘placeholders,’ used solely to respond to specific requests from senders, and not active email ‘accounts’—that is, spaces reserved and used to receive emails—such that no processing activity (e.g., even simple viewing) was ever carried out by the data controller”; - “Proof of the above is provided by the confirmation forwarded to me by the provider, which specified that both of the aforementioned mailboxes were deleted on February 28, 2020—that is, before the deadline established by the labor conciliation agreement”; - “Engineer (…) also noted that any communication sent to the aforementioned addresses was simply forwarded by the OVH server to the autoresponder subsystem, which processed the request and sent an automatic reply to the sender”; - “Due to a configuration error, the literal content of the message did not correspond to what actually occurred, since the autoresponder was not configured to forward the email to another address (which is, in fact, the function of a forwarder)”; - “It follows that no data processing activities were carried out by Top Secret Investigazioni e Sicurezza S.r.l. in relation to the aforementioned accounts (…), as they were permanently deleted prior to the deadline set forth in the employment agreement, nor is there any evidence to the contrary.”

Furthermore, the Company submitted copies of the privacy notices regarding the processing of personal data, signed by the former employees upon their hiring (namely on December 8, 2011, and May 12, 2010), and a copy of the “Internal Company Regulations,” dated April 20, 2018, concerning, among other matters, the use of devices by employees, which were made available to them by posting on the company bulletin board. The complainants submitted, in a letter dated November 15, 2023, their comments regarding the Company’s arguments, reiterating instead that the email accounts had remained active “at least through the end of 2021, as Users continued to receive the same forwarding notice from Top Secret.” 2. The initiation of proceedings for the adoption of corrective and sanctioning measures by the Authority. In light of the foregoing, the Office proceeded to notify the Company of the initiation of the sanctioning proceedings, pursuant to Article 166, paragraph 5, of the Code (note dated March 11, 2024), for the violation of Articles 5(1)(a) and 13, regarding the inadequacy of the information provided, and of Article 5(1)(a), (c) and (e), of the Regulation regarding the continued use of the two complainants’ email addresses following the termination of their respective employment relationships.

On April 9, 2024, the Company submitted its defense briefs, pursuant to Article 18 of Law No. 689/1981, as represented by its representative, which stated that it had never disputed the principle that company accounts attributable to identified or identifiable individuals must be deleted upon termination of the employment relationship. In fact, in the mutual termination agreements entered into with the two complainants, the complainants themselves “had provided for the activation of an automatic reply with a redirect to another account ‘not attributable to the complainant.’” Therefore, based on the technical guidance received (as set forth in the technical report, Annex 7 to the defense briefs), it was held that “the representatives’ accounts were merely virtual, or ‘mere placeholders,’ used solely to respond to specific requests from senders, and not active email ‘mailboxes’ (…). The redirection to another address would therefore have been merely fictitious.”

“Top Secret and Investigazioni’s belief that the accounts had been removed or deactivated was reinforced by the provider itself, which stated that both of the aforementioned email accounts were deactivated on February 28, 2020.” With regard to the criteria set forth in Article 83(2) of the Regulation, the Company noted that the violation, if established, would in any case have been of limited duration, affecting only two individuals who had expressly requested, as part of a union agreement, “forwarding to another account via an automatic reply.” Furthermore, “the effects of the violation had already been fully remedied for the data subjects as of October 20, 2020, well before the GPDP notified the Company of the initiation of proceedings.” The Company also reported that it had launched an internal investigation to identify the technical issues that had caused the delay in the final erasure of the accounts assigned to the complainants.

Following this investigation, new “Company Regulations for the Use of IT Systems and Tools” were approved, along with a new privacy notice template to be provided to the data subjects. On May 4, 2026, a hearing was held with the Company, during which it clarified that the complainants had served as privacy officers and were therefore aware of the procedures adopted by the Company regarding the use of IT tools. In particular, during the hearing, the Company requested that the proceedings be dismissed, given that the 120-day deadline set forth in the internal regulations for the resolution of disciplinary proceedings had expired, in accordance with the ruling of the Court of Cassation in Judgement No. 18583/2025. 3. The outcome of the preliminary investigation and the proceedings for the adoption of corrective and disciplinary measures pursuant to Art 58, para 2, of the Regulation. Based on the review of the statements made by the party during the proceedings, as well as the documentation obtained, it has been established that the Company, identified as the controller pursuant to Article 4, paragraph 7, of the Regulation, has carried out processing operations concerning the complainants that do not comply with the regulations on data protection.

In this regard, it should be noted that, unless the act constitutes a more serious offense, any person who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, shall be liable pursuant to Art. 168 of the Code, “False Statements to the Data Protection Authority and Interruption of the Performance of the Authority’s Duties or the Exercise of Its Powers.” 3.1. Preliminary Issue. Compliance with Procedural Deadlines. As a preliminary matter, we must address the issue raised by the Company during the hearing, according to which the present proceeding is flawed due to the expiration of the 120-day deadline provided for in the Data Protection Authority’s internal Regulation for the conclusion of the Authority’s proceedings. On this point, reference is made first to Article 166, paragraph 5, of the Code, pursuant to which “The Office of the Data Protection Authority, when it considers that the evidence gathered during the activities referred to in paragraph 4 constitutes one or more violations indicated in this title and in Article 83, paragraphs 4, 5, and 6, of the Regulation, shall initiate proceedings for the adoption of the measures and sanctions referred to in paragraph 3 by notifying the controller or processor of the alleged violations, in accordance with the safeguards provided for in the Regulation referred to in paragraph 9 (…)”.

Regulation No. 2/2019, concerning the identification of the departments and organizational units responsible for administrative proceedings at the Data Protection Authority, provides that the “notification of alleged violations” referred to in Art. 166, paragraph 5, of the Code must take place within 120 days “from the determination of the violation for notification thereof to residents within the territory of the Republic, or 360 days for notification to residents abroad.” It should be noted, among other things, that the judgement cited by the party (Supreme Court No. 18583/2025) draws a distinction within the scope of the Data Protection Authority’s procedural activities, identifying “a sanctioning phase in the strict sense (see Art. 166, paragraph 5, of Legislative Decree No. 196/03, …) and a preceding investigative phase (or, if you prefer, a preliminary investigation phase, to which, instead, paragraph 4 of the same Art. 166 is dedicated)”.

Therefore, “only once the investigative (or preliminary) phase governed by Article 166, paragraph 4, of Legislative Decree No. 196/03 (…), has been completed, shall the Office of the Data Protection Authority, “when it deems that the evidence gathered during the activities referred to in paragraph 4 constitutes one or more violations indicated in this title and in Article 83, paragraphs 4, 5, and 6 of the Regulation, shall initiate proceedings for the adoption of the measures and sanctions referred to in paragraph 3, notifying the controller or processor of the alleged violations,” specifying that with regard to the Authority’s “investigative or (preliminary)” activities, “there is no mandatory deadline” for their completion (in this regard, reference is also made to Constitutional Court Judgement No. 151/2021). Instead, “the time limit—to be considered mandatory—of 120 days provided for in point 2 of Annex “B” of the Data Protection Authority’s Regulation No. 2/2019 refers exclusively to the sanctioning phase in the strict sense and begins upon the conclusion of the preliminary investigation phase, which culminates in the actual determination of the violations attributed to the offender and the service of the notice of charges.”

This position was further confirmed by a recent judgement of the Court of Cassation (No. 22791/2026), which emphasizes that “the 120-day deadline is not a deadline for imposing the sanction starting from the notification of the violations, but rather a deadline for serving the notice of violations, which begins to run from the final determination of the violations—to be assessed according to criteria of reasonableness and appropriateness. Merely receiving the information is not sufficient; rather, the Data Protection Authority must be able to evaluate all the constituent elements of the violation based on the evidence gathered. It is, therefore, a procedural deadline, not a final deadline.” In this context, the Authority correctly identified the starting point of the 120-day period for initiating the sanctioning proceeding as the moment when it not only physically obtained but also fully assessed the evidence in the case file, and, following that assessment, concluded that the evidence obtained constituted a violation of the regulations governing data protection (on this point, see Court Decision No. 151/2021; Court of Cassation, Section I, July 8, 2025, No. 18583).

In the case at hand, any consent that, according to the Company, the two complainants allegedly gave during union mediation—by requesting that correspondence passing through their company email accounts be redirected to another account—is not relevant. This is because, within the context of an employment relationship—given the asymmetry between the respective parties—consent does not, as a rule, constitute a valid basis for the lawfulness of personal data processing, regardless of the employer’s legal status (Recital 43; Art. 4, point 11), and Art. 7, paras. 3 and 4, of the Regulation; see the established position at the European level, the “Art 29 Working Party”, Opinion 2/2017 on data processing in the workplace, WP 249, pp. 7 and 26, and Guidelines on consent under EU Regulation 2016/679—WP 259—dated May 4, 2020). In any case, in the two conciliation reports included in the case file (Attachments 5 and 6 to the note dated July 28, 2023), no consent is expressly given by the data subjects; rather, the Company undertakes the obligation to “deactivate the account (…) by February 29, 2020, by setting up an automated reply message that redirects the User to another entity/account (…)”.

In the present case, therefore, the forwarding of correspondence to another corporate email account appears to have taken place over a period of approximately 8 months, given that the last communication received on the individual account of one of the two complainants is dated October 8, 2020. In light of this action, the Company has not provided any useful clarification regarding any purposes or grounds for lawfulness, thereby effectively processing personal data in a manner that contravenes the principles of lawfulness, data minimisation, and storage limitation (Art. 5, para. 1, subpar. a), (c) and (e) of the Regulation), according to which data must be “processed lawfully, fairly, and transparently,” must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed,” and must be retained “for no longer than is necessary to fulfill the purposes for which they are processed.”

From a general perspective, the Authority considered it consistent with the principles of personal data protection that, to safeguard possible and legitimate business continuity needs, after the termination of the employment relationship, the data controller should remove the account, after deactivating it and simultaneously implementing automated systems designed to notify third-party senders and provide them with alternative contact information related to the employee’s professional activities, while also taking appropriate measures to prevent the display of incoming messages, during the period in which such an automated system is in operation (see Provision No. 754 of December 18, 2025, web doc. No. 10213574, Order No. 53 of February 1, 2018, web doc. No. 8159221). Along with its defense briefs, the Company submitted the new “Regulation on the Use of IT Systems and Tools,” which outlines the procedures for managing email, including the deactivation of individual accounts following the termination of employment.

However, it should be noted that the Regulations describe certain data processing operations that do not yet comply with the provisions and principles governing data protection. In particular, with reference to the provisions of Art. 18 of the aforementioned Regulations (“upon termination of employment (…), the company reserves the right to assess, at its sole and absolute discretion, the need to keep the email account active for incoming messages for a reasonable period of time in order to ensure business operations. (…)”. This is based on the assumption that “the assigned email account constitutes a work tool” and that “the documentation present in the profile of a user whose employment relationship has ended will be presumed by the company to be work-related correspondence and documentation rather than personal information”). For this reason, the Company is hereby urged, pursuant to Art. 57, para 1, subparagraph d) of the Regulation, to review its internal policies in light of the principles governing data protection and the provisions regarding remote monitoring set forth in Law No. 300/1970, bearing in mind that, as the Authority has consistently observed in numerous decisions, the content of email messages, as well as the external data of such communications, constitutes forms of correspondence protected by guarantees of confidentiality that are also constitutionally safeguarded (Articles 2 and 15 of the Constitution), with respect to which there is a legitimate expectation of confidentiality regarding the messages that are the subject of such correspondence (see point 5.2(b) of Decision No. 13 of March 1, 2007, containing Guidelines for Email and the Internet, web doc.

No. 1387522; and, with regard to specific cases, most recently, Provision No. 613 of October 9, 2025, Web Doc. No. 10185435). Based on the above considerations, the violation of the principles of lawfulness, data minimization, and storage limitation must therefore be confirmed in relation to the processing carried out by the Company on the individual email accounts assigned to the complainants following the termination of their employment. 3.2. Violation of Articles 5(1)(a) and 13 of the Regulation. With regard to the processing carried out by the Company on its employees’ email accounts, there is no evidence that the Company prepared documentation sufficient to fully describe the processing activities subsequently carried out. In fact, at the time the events occurred, the privacy notices signed by the two complainants upon their hiring (Attachments 13 and 14 to the note dated July 28, 2023) predate the entry into force of the Regulation, and there is no evidence that they were updated.

In any case, these forms contain only very general information regarding the processing purposes and methods of the employer’s processing of personal data. Other documentation pertains to their designation as data processors and custodians of passwords for accessing computers (Attachment 12 to the aforementioned note), which, however, is irrelevant to the present case. Nor does the Company Regulation referred to in Annex 9 to the note dated July 28, 2023, contain any useful provisions regarding the management of email and the storage of its content, particularly following the termination of an employment relationship. Such conduct is contrary to the obligation set forth in Article 13 of the Regulation, which requires the controller to provide the data subject, at the time personal data are collected, with all the information necessary to ensure fair and transparent processing (see also Recital 60).

Furthermore, in the context of an employment relationship, the obligation to provide an appropriate privacy notice is an expression of the principle of fairness referred to in Art. 5(1)(a) of the Regulation. It is noted that the Company, in its defense briefs, has prepared a new privacy notice template pursuant to Article 13 of the Regulation and that the new internal policy template (dated September 1, 2024) contains more detailed information on specific processing operations. However, as already noted in the previous paragraph, it remains the case that the privacy notice and, in general, the policies must always describe lawful processing operations. Therefore, the violation of Articles 5(1)(a) and 13 of the Regulation regarding the absence of adequate information remains. 4. Conclusions: Declaration of the unlawfulness of the processing. Corrective measures pursuant to Art. 58(2) of the Regulation.

For the reasons set forth above, the Authority considers that the statements made by the controller during the investigation do not address the findings notified by the Office in the notice initiating the proceedings and are therefore insufficient to warrant the dismissal of this proceeding; moreover, with respect to these aspects, any of the cases provided for in Article 11 of the Data Protection Authority’s Regulation No. 1/2019. The processing of personal data carried out by Top Secret Investigazioni e Sicurezza s.r.l. is unlawful, under the terms set forth above, as it was carried out in violation of Articles 5(1)(a), (c), and (e) and Article 13 of the Regulation. The violation ascertained as described in the reasoning cannot be considered “minor,” given the nature of the violation, which concerned compliance with the general principles of processing and the obligation to provide a privacy notice.

The average level of severity of the violation, its duration, the number of data subjects involved, and the manner in which the Authority became aware of the violations were taken into account. In view of the corrective powers conferred by Article 58, para 2, of the Regulation, and in light of the circumstances of this specific case, an administrative fine is imposed pursuant to Art 83 of the Regulation, commensurate with the circumstances of this specific case (Article 58, para 2, subparagraph (i), of the Regulation). Finally, it is considered that the conditions set forth in Art. 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. 5. Adoption of the injunction ordering the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The outcome of the proceedings shows that Top Secret Investigazioni e Sicurezza s.r.l. has violated Articles 5(1)(a), (c), and (e), and Article 13.

For the violation of the aforementioned provisions, the administrative fine provided for in Art. 83, para. 5, letter a), of the Regulation shall be imposed. The Data Protection Authority, pursuant to Article 58, para 2, subparagraph i) of the Regulation and Article 166 of the Code, has the authority to impose an administrative fine as provided for in Article 83 of the Regulation, by issuing an injunction (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Top Secret Investigazioni e Sicurezza s.r.l., which has been found to be unlawful, as set forth above. Having determined that paragraph 3 of Art 83 of the Regulation must be applied—which provides that “If, in relation to the same processing or related processing operations, a controller […] intentionally or negligently infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious violation,” the total amount of the fine is calculated so as not to exceed the maximum amount provided for in Art. 83, para. 5.

With regard to the factors listed in Art. 83(2) of the Regulation for the purposes of applying the administrative fine and determining its amount, and taking into account that the fine must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), it is noted that, in the present case, the following circumstances were taken into account: - With regard to the nature and severity of the violation, the violations committed were deemed significant, as they concerned the general principles of data processing related to the use of electronic tools within the context of the employment relationship, as well as the failure to provide appropriate notice; it must be taken into account that the forwarding of correspondence received in the complainants’ accounts to another company account continued for a period of 8 months following the termination of their respective employment relationships; - With regard to whether the violation was intentional or negligent and the degree of the data controller’s accountability, the Company’s conduct in drafting a new privacy notice and set of company Regulations was taken into account (although critical issues remain regarding these documents that were not the subject of a specific investigation); - The absence of prior data breaches regarding data protection was taken into account.

It is also considered that the following factors are relevant in this case, taking into account the aforementioned principles of effectiveness, proportionality, and deterrence that the Authority must adhere to when determining the amount of the penalty (Art. 83, para. 1, of the Regulation): first, the economic circumstances of the offender, determined based on the company’s turnover as reported in the financial statements for the year 2024. In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose on Top Secret Investigazioni e Sicurezza s.r.l. an administrative fine in the amount of 6,500.00 (six thousand five hundred) euros. In this context, it is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website.

THEREFOREWHILE, THE DATA PROTECTION AUTHORITY pursuant to Article 57(1)(f) of the Regulation, finds that the processing carried out by Top Secret Investigazioni e Sicurezza s.r.l., in the person of its pro tempore legal representative, with registered office in Ferrara, Via Zandonai No. 4, VAT No. 01857670382, for violating Articles 5(1)(a), (c), and (e) and Article 13 of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph (i) of the Regulation, that the aforementioned Company pay the sum of 6,500.00 (six thousand five hundred) euros as an administrative fine for the violations indicated in this order; THEREFORE ORDERS the said Company to pay the aforementioned sum of €6,500.00 (six thousand five hundred), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981.

It is noted that, pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying —again in accordance with the procedures set forth in the attachment—of an amount equal to half of the imposed penalty within the time limit specified in Art. 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below. ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/20129, the publication of this injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/20129, the publication of this order on the Data Protection Authority’s website; - Pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, letter u), of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts by submitting a petition to the ordinary court of the location specified in the aforementioned Art 10, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori