Italian DPA: employer breached Art. 15 GDPR by ignoring access request over disciplinary

[Web Doc. No. 10297306] Decision of August 6, 2026 Register of Decisions No. 585 of August 6, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Claudio Filippi, Deputy Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed by Mr. XX against La Patria S.p.A.; HAVING EXAMINED the documentation in the case file; HAVING REGARD TO the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Dr. Agostino Ghiglia;

Origin of the preliminary investigation and activities carried out. On July 26, 2023, Mr. XX filed a complaint pursuant to Article 77 of the Regulation and Articles 142 et seq. of the Code against La Patria S.p.A. (hereinafter, the Company). In response to this complaint, corrective measures were submitted on November 26, 2023, and April 18, 2024, following specific requests from the Office dated November 16, 2023, and April 3, 2024, respectively. The complaint alleged violations of the Regulations, specifically: the failure to respond to two requests for access to data in which the complainant asked to “review and obtain a copy of all documentation pertaining to the […] [disciplinary] charge, including the recording of the GPS device installed on the company vehicle with license plate number […]” (June 14, 2022) and to have “access to the case files in order to review and obtain copies of all documentation pertaining to the aforementioned disciplinary charge” (June 25, 2022); the Company’s submission, in the proceedings before the judicial authority, of an “alleged list of GPS records—a satellite system with which company vehicles are equipped—which, according to the Company’s assertions, [Company], dates from the period between April 2, 2022, and May 25, 2022,” as well as having commissioned a private investigation firm to conduct surveillance of the complainant. On May 2, 2024, the Office sent a request for information pursuant to Article 157 of the Code to the Company, which responded on June 10, 2024. On that occasion, the Company stated that: “[the complainant] was employed by La Patria Spa […] as a security guard until July 4, 2022, the date on which the employee was terminated for just cause following disciplinary proceedings initiated with a disciplinary charge dated June 7, 2022, which was subsequently rescinded and replaced by a disciplinary charge dated June 21, 2022” (see note dated June 10, 2024, p. 1); “By order of January 30, 2024, the Court […] ruled that the termination was unlawful” (see cited note, p. 1); “In that ruling, the Court also ruled on the legality of the investigative inquiry commissioned by La Patria from [the investigative agency]” (see cited note, p. 2); “As of the date of this brief, an appeal is pending […] pursuant to Art. 1, paragraph 5, of Law No. 92/2012, filed by La Patria Spa” (see cited note, p. 2); “With regard to the employment relationship established with the [complainant], attached are the privacy notices in effect at the time during the period covered by the circumstances alleged in the complaint: the privacy notice dated April 8, 2019, for employees […] and personnel employed by prefectural decree, dated the same day […]; notice dated September 1, 2021, for employees […] and personnel employed by prefectural decree, dated the same day […]; notice dated December 14, 2022, regarding employees […] and personnel employed by prefectural decree, same date” (see cited note, p. 2); “With regard to the brief dated June 14, 2022, it should be noted that it was drafted as a defense brief by the employee within the context of the disciplinary proceeding governed by Art. 7 of Law 300/1970. Upon reading […] the brief prepared by the employee’s attorneys, there is no reference to the GDPR or even the slightest mention thereof; indeed, the request is made in the concluding remarks, where a copy of the documentation pertaining to the disciplinary charge is requested, with clear reference to labor law, without any mention of the employee’s data subject rights under the GDPR. Further confirmation of this emerges from an examination of the representation issued for this purpose by the [complainant] to his attorney […], attached to the defense brief, in which the employee granted the attorney a mandate “to represent and defend me in the disciplinary proceedings initiated against me (…)”. Moreover, the brief refers to alleged GPS records based on the erroneous belief […] that the disciplinary charge drew its evidentiary support from the geolocation of the company vehicle via such equipment. […] since the two documents were drafted by legal professionals—and thus possess technical expertise—had they intended to exercise their rights under Article 15 of the GDPR, they would certainly have made a specific request to that effect as well, rather than limiting their references solely to Article 7 of Law 300/1970” (see cited note, p. 3); “Similar considerations apply with respect to the brief dated June 22, 2022 […]; there is no mention of requests to exercise the rights of access generally provided to the data subject under Article 15 of the GDPR, much less under Article 22 of the GDPR” (see cited note, p. 4); “It is clear that in that instance, the employee complained […] exclusively of an alleged impairment of his rights of defense within the disciplinary proceedings” (see cited note, p. 4); “Regarding the GPS devices installed on the company vehicles of La Patria S.p.A. […] The union agreement states […] verbatim that the controller intends to use GPS devices for fleet management as well as for the active and passive safety of the driver” (see cited note, p. 5); “La Patria S.p.A., therefore, after informally consulting the DPO for the appropriate assessments, convened the trade unions that were data subjects, which—having been informed of the tool the employer intended to adopt and the methods of data collection—signed the relevant agreement, thereby legitimizing its use; This was done precisely in light of the fact that the installed system allows for the collection of a series of data and parameters related to the vehicle’s operation (and therefore, necessarily, its location as well), but is not capable of collecting identifying data regarding the security guard on board the vehicle, and also in light of the fact that, apart from the collection of the vehicle’s technical data, the device does not contain any personal data regarding the GpG to whom the vehicle is assigned while on duty” (see cited note, p. 6); “In accordance with the agreement reached with the labor unions, to gather information regarding the roadside Surveillance operation […] that led to the initiation of disciplinary proceedings against the [complainant] and subsequently to his dismissal, La Patria engaged a private investigation agency to investigate the [complainant]. Proof of this is the fact that the only document used for disciplinary purposes by the employer […] was the report from the investigation agency” (see cited note, p. 6); “The system for monitoring the technical operating parameters of the company’s vehicle fleet is completely separate from the workflow of the company’s operational division—including the operations center and the services office—and therefore from any data concerning the employees who use the vehicles. The only company department that has access to the data collected by this system is the logistics office, which operates during hours when night patrols are not active and exclusively for the purposes specified in an agreement or at the request of company management, and, in any case, in offline mode. The individual assigned to this role is a single person from the logistics office who has no personnel oversight duties and is specifically appointed for this purpose” (see cited note, p. 7); “With regard to Document 11 submitted to the court by the defense counsel for La Patria, it should be clarified that the preparation of this document—which was not provided for by the company’s organizational structure for the reasons just stated—took place only ex post to respond to the request for disclosure pursuant to Art. 210 of the Code of Civil Procedure made by the opposing party in its initial complaint […]. The processing of the GPS log data—which, it should be reiterated, allows solely for the geolocation of the vehicle—by linking it to data concerning on-duty personnel, was therefore necessary only at the time of exercising the rights of defense in court and for that purpose” (see cited note, p. 7). On October 15, 2024, the Office sent a request for additional information pursuant to Article 157 of the Code, and the Company, on November 14, 2024, submitted its response, stating on that occasion that: “The geolocation data of company vehicles is processed by La Patria S.p.A. exclusively for operational and security purposes, as indicated in the union agreement […] signed on June 10, 2019. In particular, it is specified that the data collected via GPS devices is used by La Patria S.p.A. solely to optimize operational and logistical management, while ensuring the safety of personnel and company vehicles.” […] “the processing of geolocation data has never involved the direct management of employees’ personal data for the purpose of individual monitoring, but is intended exclusively for the monitoring of vehicles for logistical and security purposes” (see note dated November 14, 2025, p. 1); “Since the Company has always used the data collected via GPS devices solely for the purposes described above […] no privacy notice regarding the installation of the company device was prepared or provided to the complainant. This omission occurred in good faith, as the Company believed that, in the absence of any processing involving the employee’s personal data, a specific privacy notice was not necessary” (see cited note, pp. 1, 2); “The Company, fully aware of the legal requirements regarding data protection, undertakes to comply with the applicable obligations, ensuring: - the utmost diligence in adopting all required measures; - the implementation of any additional measures you may communicate, even at a later date, within the timeframes you specify; all with the aim of ensuring full compliance with current privacy regulations, including the drafting and distribution to current employees of a privacy notice regarding the GPS processing in question” (see cited note, p. 2); “La Patria S.p.A. […] confirms that the omission resulted from a differing interpretation of the regulations, without any malicious or fraudulent intent” (see cited note, p. 2); with reference to the notices dated December 14, 2022, September 1, 2021, and April 8, 2019, “the Company wishes to clarify that it has never, either in the past or at present, conducted any processing of personal data relating to employees’ philosophical beliefs, other orientations, or sexual life. In fact, such personal data has never been processed, collected, recorded, or stored by the Company, and its mention in the privacy policy was solely the result of a purely precautionary assessment aimed at ensuring maximum transparency for data subjects. More specifically, it should be noted that the reference to philosophical or other beliefs was included in the privacy notices as a precautionary measure, taking into account the possibility—albeit purely theoretical—that such information could be inferred from photographs contained in personal identification documents. However, it is reiterated that such references, where inferable, are not processed by the Company for any reason, as it adheres to the principle of data minimisation under Art 5, para 1, letter c), without in any way extending the collection or storage to aspects of private or personal life that fall outside the professional context. Similarly, Patria S.p.A. does not process, collect, record, or handle in any way data relating to the sexual life of its employees. This information has been included in the privacy policy purely as a precautionary measure, given that the only context in which it may arise is the receipt of documents related to pregnancy certificates or similar information necessary to comply with specific and current labor regulations” (see cited note, pp. 2, 3); “In drafting the privacy policy, the Company sought to consider every possible consequence that might arise from the collection of such information, adopting a prudent approach aimed solely at providing a comprehensive and transparent privacy policy” (see cited note, p. 3); “Patria S.p.A. undertakes […] to proceed, based on the guidance you provide in response to this letter, with the revision of the privacy policy in order to eliminate, where necessary, any reference to special categories of data that are not processed, ensuring that the document accurately reflects the actual data processing methods adopted. Patria S.p.A. confirms and reaffirms its willingness to cooperate with the Data Protection Authority by fully complying with the regulations governing personal data protection and by taking all necessary measures to ensure compliance with current provisions” (see cited note, p. 3); with regard to the privacy notices attached to the response dated June 10, 2024, “it is clarified that the processing of internet browsing files is carried out by La Patria S.p.A. solely for the purpose of addressing security and data compliance needs, protecting the corporate network, and preventing IT anomalies that could compromise the security of corporate information; it is not intended in any way for the remote monitoring of employees. The legal basis justifying the processing in question is the controller’s legitimate interest in ensuring the security of its IT systems, as provided for in Art. 6(1)(f) of the Regulation […]. This processing activity, in accordance with the principle of accountability (Article 5(2) of the Regulation […]), is limited to only the data necessary to ensure network protection and is carried out only when necessary, avoiding any invasive or irrelevant processing” (see cited note, p. 3); “Access to this information is also granted exclusively to authorized personnel responsible for cybersecurity and occurs only in the event of specific operational needs related to potential critical issues involving network breaches that require access to these logs” (see cited note, p. 3); “Patria S.p.A. reaffirms that under no circumstances is the processing of internet browsing data monitored and/or used for the purpose of individual monitoring of employees […]” (see cited note, p. 3);

Initiation of proceedings (Art. 166, paragraph 5, of the Code). On March 19, 2025, the Office, pursuant to Article 166, paragraph 5, of the Code, served notice of the alleged violations of the Regulation against the Company, with reference to Articles 5, para 1, subparagraph (a), 6, 12, 13, 15, 88 of the Regulation, and Article 114 of the Code, for failing to provide an adequate response to the requests to exercise the right of access submitted by the complainant on June 14, 2022, and June 25, 2022, for failing to fulfill theobligation to provide information regarding the processing of data collected via GPS devices installed on company vehicles; for having provided inadequate information regarding the processing of special categories of personal data; and for having processed data relating to employees’ Internet browsing logs in a manner not compliant with data protection regulations.

Defenses of the Party (Art. 166, paragraph 6, of the Code). In its written defense, submitted on April 17, 2025, the Company stated that: - “With regard to the issue of the alleged failure to respond to the complainant’s request for access to personal data [it should be noted that] the request was characterized by the complainant himself as ‘Access to Records’ and generally concerned the desire to ‘review and obtain a copy of all documentation pertaining to the disciplinary proceeding,’ including ‘the GPS device tracking records.’ The company, therefore, […] interpreted the request as part of a standard disciplinary hearing, in line with the employee’s right to a defense, which, under labor law, requires the employer to provide only the documentation necessary to ensure that right. From this perspective, the company considered that the employee’s rights could be guaranteed through the mechanisms provided for by labor and procedural law, in accordance with the case law of the Court of Cassation (see Court of Cassation Case No. 27093 and Court of Cassation Labor No. 23304 of November 18, 2010, and Cass. No. 6468/2024)” (see note of April 17, 2025, p. 1); - requests recognition of “on the one hand, the objective ambiguity of the request made by the complainant, and on the other hand, the absence of any obstructive intent on the part of the Company” (see cited note, p. 1); - “The Company acknowledges that a different interpretive framework for the request could have allowed for a response fully compliant with the GDPR, correctly classifying the request as an exercise of the data subject rights. The Company has therefore decided to adopt an internal protocol for processing requests that involve both labor law and privacy issues, involving the newly appointed DPO and consultant in the preliminary assessment” (see cited note, p. 1); - “Regarding the request concerning the GPS track […] the Company did not possess data directly attributable to the complainant. In fact, the location tracking system did not automatically associate the technical data collected with a specific individual. Therefore, to respond to the request, the Company would have had to access the system and process data that had never been extracted, and consequently link it to the employee—an operation that would have entailed further and unnecessary processing of personal data” (see cited note, p. 2); - “In determining the severity of any potential penalty or in applying any corrective measures, the Company requests that the Court take into account the fact that the complainant, as the data subject, has not suffered any harm with regard to the processing of his personal data” (see cited note, p. 2); - “With regard to the failure to provide an appropriate privacy notice concerning the processing of data via the GPS system installed on company vehicles, it should be noted that this omission was due to an error of judgment committed in good faith” (see op. cit., p. 2); - “The processing of data collected via GPS was carried out solely for organizational and operational purposes, including the optimization of fleet management and the planning of vehicle maintenance. Particular attention was paid to employee safety, given the nature of the activities performed and the potential associated risks; precisely with this in mind, even though the system did not directly identify the GPG on board the vehicle, the Company considered it important to be able to trace, in the event of an emergency, the employee on board the vehicle—a feature designed exclusively to ensure a rapid response without any intent to monitor” (see note cited above, p. 2); - “While acknowledging the lack of information provided, the company emphasizes that the data processing had no negative impact on the rights and freedoms of employees. Furthermore […] it appears that the employee was well aware that the company car was equipped with an integrated GPS satellite system, making it clear that he was aware of the processing, even if not formally documented” (see cited note, p. 2);The company acted in good faith and immediately took steps to correct the issues that arose by promptly sending a clear and comprehensive notice to employees, containing all the information required under Articles 13 and 14 of the GDPR” (see cited note, p. 2); - “With regard to data relating to ‘philosophical beliefs, other orientations, or sexual life’ […] it should be noted that the reference in the privacy notices was included as a precautionary measure to ensure maximum transparency, even though no processing of such data took place. The Company acknowledges that the privacy notice was not fully aligned with the processing operations actually carried out, but emphasizes that, since no processing of the aforementioned data took place, there was no harm to the rights and freedoms of employees. […] Since there was no actual harm, the impact of the violation was minimal, and therefore we request that the amount of the fine be reduced or waived” (see cited note, pp. 2, 3); - “The Company has already initiated a review of the privacy notices to bring them into line with the actual data processing operations and ensure full compliance with articles 12 and 13 of the Regulation” (see cited note, p. 3); - “As confirmation of this commitment, please find attached […] an updated draft of the privacy notice for employees, from which references to special categories of personal data that are not processed have been removed” (see cited note, p. 3); - “In this context, it should be noted that the Company recently replaced the DPO, coinciding with a change in external consultants” (see cited note, p. 3); - “Regarding the processing of Internet browsing logs, the Company intends to provide a formal and collaborative clarification […] the Company apologizes for the imprecise wording and confirms that no logging or analysis system for websites visited by employees is active within its IT environments, nor are activities to monitor the web content browsed by employees—even indirectly—planned or permitted” (see cited note, p. 3); - “In the previously transmitted note, the terminology used (‘Internet browsing logs’) proved ambiguous and open to misinterpretation. This wording was intended in a technical-systemic sense and did not refer to individual Internet browsing by employees” (see cited note, p. 3); - “The Company also conducted […] further internal audits, which revealed that the processing carried out by the Company pertains exclusively to technical system logs, automatically generated by network devices […] to ensure perimeter security and the integrity of the company’s IT infrastructure” (see cited note, p. 3); - “These logs: - do not record the URLs or content of the web pages visited by employees; - cannot be traced, either directly or indirectly, to individual employees, nor are they used for the purposes of behavioral monitoring or productivity control; - are not processed or analyzed on an individual basis, but only in exceptional cases related to the management of security incidents or critical malfunctions; - are retained for a limited period, in accordance with the principles of proportionality and data minimization” (see cited note, p. 3); - “To ensure greater transparency and accountability, the Company has already: - updated the employee privacy notice, specifying the technical and non-identifying nature of the logs generated; - supplemented the processing register with the correct classification of this activity” (see cited note, p. 3); - The Company “reaffirms its commitment to cooperate fully with the Data Protection Authority to ensure compliance with current data protection regulations” (see cited note, p. 4).

Following an examination of the statements made to the Data Protection Authority during the proceedings, as well as the documentation obtained, it appears that the Company, in its capacity as data controller, has carried out certain processing operations that are non-compliant with personal data protection regulations for the reasons set forth below. In particular, the Company failed to provide an adequate response to the requests to exercise rights submitted by the complainant on June 14, 2022, and June 25, 2022, concerning the documentation underlying the disciplinary action. Furthermore, the Company failed to fulfill its obligation to provide information regarding the processing of data collected via GPS devices installed on company vehicles. The Company also provided inadequate information regarding the processing of data belonging to special categories of data. In this regard, it should be noted that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false records or documents, shall be held liable pursuant to Art. 168 of the Code, “False Statements to the Data Protection Authority and Interruption of the Performance of the Authority’s Duties or the Exercise of Its Powers.”

Violation of Articles 12 and 15 of the Regulation. It has been established that the Company did not provide an adequate response to the request for access dated June 14, 2022 (contained in the defense brief filed on behalf of the complainant following the disciplinary charge) in which the complainant requested access to the documentation pertaining to the disciplinary charge of June 7, 2022 (specifically, the complainant requested to “review and obtain copies of all documentation pertaining to the aforementioned disciplinary charge, including the recording of the GPS device installed on the company vehicle with license plate number […]”), and the request for access dated June 25, 2022, regarding the documentation pertaining to the disciplinary charge of June 21, 2022 (a request contained in the defense brief filed on behalf of the complainant, which states, “the complainant insists on the request [to] the company […] for access to the records in order to review and obtain copies of all documentation pertaining to the aforementioned disciplinary charge”). The Company’s conduct constituted a violation of Articles 12 and 15 of the Regulation. In this regard, the complainant specified that “the dismissal was challenged both through out-of-court proceedings and in court […] initiated by an appeal […] and the claimant has consistently requested the production of the documents gathered by the accusing company, which only produced the investigative report before the Labor Court. […] the complaint filed with the Authority stems from information learned from the brief submitted by La Patria Spa on March 1, 2023, in the pending labor proceeding.” The objection raised by the Company regarding the lack of references to the Regulation in the petitions filed by the complainant—from which it would follow that the petitions cannot be classified as requests for access to data—cannot be upheld: indeed, the wording of the petitions clearly indicates their subject matter. In this regard, it should be noted that, with respect to the right granted to the data subject under Article 15 of the Regulation, the Guidelines 1/2022 on the rights of data subjects — Right of Access, adopted by the EDPB on March 28, 2023 (to which minor amendments were made on May 30, 2024), specify that “the GDPR does not impose any requirements on data subjects regarding the form of an access request for personal data. Therefore, in principle, data subjects are not required to comply with any requirements under the GDPR when choosing the communication channel through which to contact the controller” (see para. 3.1.2., point 52). Nor can the Company’s argument be accepted regarding the instrumental nature of the requests and the complainant’s failure to provide evidence of harm resulting from the failure to provide the subject matter of the access requests as grounds justifying a lack of response. In this regard, it should be emphasized that the aforementioned Guidelines on the Right of Access to Data specify that “the general purpose of the right of access is to provide individuals with sufficient, transparent, and easily accessible information regarding the processing of their personal data, so that they may be aware of the processing and verify its lawfulness, including with regard to the accuracy of the data being processed” (p. 3, in the “Summary” Section)) and that “the data subject does not […] an obligation to justify the access request, and it is not for the controller to assess whether the request will actually be useful to the data subject in verifying the lawfulness of the relevant processing or in exercising other rights. The controller must comply with the request, unless it is evident that it was submitted under provisions other than those relating to data protection” (p. 3, in the “Summary” Section). Furthermore, if the controller determines that it cannot comply with requests to exercise data subject rights, it must inform the requester of the reasons for the refusal, as well as of the right to file a lawsuit with the courts or lodge a complaint with the Data Protection Authority (as clearly stated in Art. 12, para 4, of the Regulation). In the present case, it was found that the Company did not provide an adequate response to the requests for access to data, not even to indicate that it was unable to comply with them; in fact, the Company merely stated, “nor does the access request for evidence relating to the alleged facts constitute an obstacle to the imposition of the disciplinary measure, given that the employer is not required to do so prior to the imposition of the measure” (see termination letter dated July 4, 2022). Finally, regarding the case law cited by the Company concerning the obligations incumbent upon the employer within the framework of the procedure set forth in Art. 7 of Law No. 300 of 1970, we merely note that the subject matter of the finding of a data breach concerning personal data protection regulations concerned the right of access to personal data provided for in Art. 15 of the Regulation, that is, a right defined within the framework of personal data protection law that has its own distinct and autonomous characteristics, concerning personal data—that is, data relating to the data subject.

Violation of the obligation to provide adequate information regarding the processing of data. The Company also engaged in conduct in violation of Article 13 of the Regulation, with regard to the processing of geolocation data, because, according to the Company’s own statements, in connection with the processing of data relating to the satellite geolocation of company vehicles, no specific notice was provided to the data subjects regarding this matter. In this regard, it should be noted that the collection of geolocation data from the vehicle used by the employee provides information indirectly linked to the employee driving that company vehicle and therefore involves the processing of personal data which, as such, requires that the information specified in Art. 13 of the Regulation be provided to the data subjects. In the same agreement—which, in accordance with the safeguard procedure provided for in Art. 4, paragraph 1, of Law No. 300 of 1970, was concluded by the Company with the union representatives—it was specified that “the Company undertakes: to provide employees with specific information regarding the foregoing, pursuant to Article 13 of the Consolidated Law on Privacy (Decree-Law No. 196/2003), within 30 days of the signing of this agreement.” Given the processing carried out, despite the obligation set forth in Article 13 of the Regulation—even though the aforementioned agreement clearly stated that the Company would provide appropriate information to employees—the Company failed to fulfill this obligation. In this regard, the Company itself acknowledged that, through the geolocation system, it can “identify, in the event of an emergency, the employee inside the vehicle—a feature designed exclusively to ensure a rapid response” (see note dated April 17, 2025, p. 2); the Company also acknowledged that, at the time of the events, it had not provided adequate information regarding the processing of geolocation data. It is noted that the Company stated that it “immediately took steps to correct the issues that arose by promptly sending a clear and comprehensive notice to the employees” in accordance with Articles 13 and 14 of the Regulation (see note dated April 17, 2025, p. 2). Article 13 of the Regulation—which establishes the controller’s obligation to provide information—was also violated by the Company because, in the notices dated December 14, 2022, September 1, 2021, and April 8, 2019, the Company specified that, as part of its processing activities, it may also become aware of information relating to employees’ “philosophical or other beliefs” and “sexual life”—data falling under the so-called special categories referred to in Article 9 of the Regulation—even though, as stated by the Company, such processing was not actually carried out. Consequently, it appears that the information provided regarding the processing of employee data does not align with the processing activities actually carried out by the Company, including with respect to so-called special categories of data. Pursuant to Article 12(1) of the Regulation, among other things, “the controller shall take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14 […] regarding the processing in a concise, transparent, intelligible, and easily accessible form, using clear and plain language,” Article 13 of the Regulation specifies that “where personal data concerning the data subject are collected from the data subject, the controller shall provide the data subject, at the time the personal data are obtained, with the […] information [listed in that provision].” The content of the privacy notice must, therefore, describe processing operations that are actually carried out and ensure that they comply with data protection regulations; it is not sufficient, in and of itself, to render a processing operation lawful merely because a description of it is included in the privacy notice, nor is it sufficient for the privacy notice to describe processing operations if, in practice, the data controller does not actually carry them out. In this regard, the Company itself stated that it had included such data in the documents containing the privacy notice “as a precautionary measure, in order to ensure maximum transparency, even though no processing of the aforementioned data was actually carried out” (see note dated April 17, 2025, pp. 2, 3). For the reasons set forth above, the Company’s conduct violated Articles 12 and 13 of the Regulation. In this regard, it is noted that the Company stated that it had “initiated a review of the disclosure documentation,” attaching an updated draft of the disclosure notice intended for employees and specifying, with respect to that document, that “references to special categories of personal data that were not processed have been removed” (see Note No. 3 dated April 17, 2025). It should be noted, in this regard, that, pursuant to Article 9 of the Regulation, there is a general prohibition on the processing of so-called “special categories of data”; this prohibition may be waived only in the cases strictly provided for in para 2 of the same article. Among these, subparagraph (b) specifies that the prohibition does not apply when “processing is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or the data subject in the field of employment and social security and social protection law, to the extent that it is authorized by Union law or the laws of the Member States […], provided that appropriate safeguards for the fundamental rights and data subject rights are in place.” Finally, with regard to the allegation, raised at the outset of the proceedings, concerning the violation of Articles 5(1)(a), 6, and 88 of the Regulation, and Articles 113 and 114 of the Code, in relation to data concerning employees’ internet browsing, we take note of the Company’s submissions in its defense briefs dated April 17, 2025, from which it appears that the Company did not carry out the processing at issue. For these reasons, it is not considered that, in the present case, the grounds exist to adopt measures regarding the violation of Articles 5(1)(a), 6, para. 6, 88 of the Regulation, and Articles 113 and 114 of the Code, as set forth in the notice of violations dated March 19, 2025; the case is therefore deemed closed with respect to these specific issues. With regard to the draft privacy notice that the Company attached to its defense briefs of April 17, 2025 —a document that is, therefore, not yet operational—given the content of the notice of violations and in light of the Company’s statements regarding the revision of informational documents to comply with personal data protection regulations, the Company is reminded of the need to comply with personal data protection regulations, even where, the documents containing the privacy notice describe processing operations relating to browsing data, data, or metadata pertaining to the individual email account assigned to the employee, and the content of incoming and outgoing email messages relating to individual corporate email addresses. This is always subject to the fact that the information documents must describe processing operations that are lawful in and of themselves.

For the reasons set forth above, the Authority considers that the statements, documentation, and explanations provided by the controller during the preliminary investigation do not sufficiently address the findings notified by the Office in the notice initiating the proceedings; consequently, they are insufficient to warrant the dismissal of this proceeding, especially since none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The conduct of the Company—and specifically the failure to adequately respond to requests for access to data, the failure to comply with the obligation to provide adequate information regarding the geolocation of company vehicles, and failure to comply with the obligation to provide information by supplying incorrect details regarding the processing of so-called “special categories of data,” are unlawful, as set forth above, in relation to Articles 12, 13, and 15 The violation, as established in the reasoning section, cannot be considered “minor,” given the nature of the multiple violations found, which concerned the obligation to provide adequate information and the exercise of the right of access (see Recital 148 of the Regulation).

CORRECTIVE MEASURES Recital 5. CORRECTIVE MEASURES Considering that the conduct has ceased to have any effect—given that, ultimately, the complainant obtained the investigative report during the proceedings before the judicial authority, the Company has stated that it has taken steps to provide information regarding the processing of geolocation data to its employees, and has stated that it has removed the incorrect references contained in thethe privacy notice regarding the processing of so-called special categories of data—the conditions for adopting further corrective measures under Art. 58(2) of the Regulation do not apply.

ORDER-INJUNCTION Pursuant to Article 58(2)(i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Art. 18 of Law No. 689 of November 24, 1981, and Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019).

Assessment of the Conduct and Determination of the Applicable Penalty. The violation of the aforementioned provisions resulted from multiple acts (regarding requests to exercise the right of access and the obligation to provide adequate information), which must therefore be considered separately, for the purpose of determining the administrative fines to be imposed, which, for the violations as a whole, have been set at a total of 39,000 (thirty-nine thousand) euros based on the following reasons.

Determination of the administrative fine relating to the exercise of the right of access (Article 83(2) of the Regulation). With regard to the conduct concerning the exercise of the right of access, Art. 83(5), in setting the maximum penalty at 20 million euros or, for enterprises, 4% of the annual worldwide turnover for the preceding fiscal year, whichever is higher, specifies the methods for determining the aforementioned fine, which must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors listed in para 2 to be assessed when determining the relevant amount. The amount of the administrative fine shall be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account that: the unlawful processing consists of failing to provide an appropriate response to requests for access to data by a data subject (see Article 83(2)(a) of the Regulation); as set forth in the reasoning of this decision, the Company’s conduct constituted negligence (see Art. 83(2)(b) of the Regulation); it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, considering that the controller is a joint-stock company with a turnover of less than 500 million euros, it is considered that, for the purposes of quantifying the fine, the following circumstances should be taken into account: the Company has stated that it has resolved to adopt an internal protocol for processing requests involving both labor law and privacy issues, involving the newly appointed DPO and consultant (see Art. 83(2)(c) of the Regulation); there are no previous relevant violations on the part of the Company (see Art 83(2)(e) of the Regulation); the level of cooperation with the Company was ordinary (see Art 83(2)(f) of the Regulation); the Authority became aware of the violation through a complaint filed by the data subject (see Article 83(2)(h) of the Regulation). In the present case, the economic circumstances of the controller—determined on the basis of the controller’s revenue as reported in the regular financial statements for the year 2024—are considered relevant. In light of the aforementioned factors, assessed as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, the amount of the administrative fine is set at 22,000 (twenty-two thousand) euros for the violation of Articles 12 and 15 of the Regulation.

Determination of the administrative fine for the violation of the obligation to provide adequate information (Articles 83, para 2, of the Regulation). With regard to the conduct concerning the violation of the obligation to provide adequate information, Art. 83, para. 5—which sets the maximum fine at 20 million euros or, for enterprises, 4% of the undertaking’s annual global turnover in the preceding fiscal year, whichever is higher, specifies the methods for quantifying the aforementioned fine, which must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in para 2—to be assessed when determining the amount of the penalty. The amount of the administrative fine shall be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account that: the unlawful processing consists of failing to provide adequate notice regarding the geolocation of company vehicles and regarding the so-called “special categories of personal data” to be provided to employees (see Art. 83, para. 2, subparagraph a), of the Regulation); as is evident from the reasoning in this decision, the Company’s conduct was characterized by negligence (see Article 83, para 2, subparagraph b), of the Regulation); the violation in question concerned information regarding the geolocation data processed and the reference to certain so-called special categories of data, which, in practice, were not actually processed (see Art. 83(2)(g) of the Regulation); it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the Calculation of Administrative Fines under the GDPR” dated May 24, 2023, paragraph 60). That said, given that the controller is a joint-stock company with a turnover of less than 500 million euros, it is considered that, for the purposes of quantifying the fine, the following circumstances should be taken into account: the Company has stated that it provided clear notice to employees regarding geolocation and that it removed incorrect references regarding the processing of so-called special categories of personal data that were not actually processed (see Art. 83(2)(c) of the Regulation); there are no relevant prior violations on the part of the Company (see Art 83(2)(e) of the Regulation); the level of cooperation with the Company was ordinary (see Article 83(2)(f) of the Regulation); the Authority became aware of the violation through a complaint filed by the data subject (see Article 83(2)(h) of the Regulation); as a mitigating factor, it is also considered that the so-called special categories of personal data included in the privacy notice—relating to philosophical beliefs and sexual life—were, despite being expressly provided for in the document, never processed by the Company, as expressly stated by the Company (see Art. 83(2), para. 2), subparagraph (k) of the Regulation); In the present case, the economic circumstances of the controller—determined on the basis of the controller’s revenue as reported in the regular financial statements for the year 2024—are deemed relevant. In light of the aforementioned factors, assessed as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, the fine is set at 17,000 (seventeen thousand) euros for the violation of Articles 12 and 13 of the Regulation. In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section of the decision containing the injunction order must be published on the Data Protection Authority’s website, given the seriousness of the conduct in question, which concerned the exercise of the right of access to data and the obligation to provide appropriate information to employees. FOR THESE REASONS pursuant to Articles 57 and 83 of the Regulation, the processing of personal data carried out by La Patria S.p.A., with registered office at Via della Barca, No. 26, Bologna, Tax ID 07764040965, is hereby declared unlawful due to the violation of Articles 12, 13, and 15 of the Regulation, as set forth in the grounds; IT IS HEREBY ORDERED that the complaint filed against La Patria S.p.A. by order of March 19, 2025, be dismissed, limited to the violations of Articles 5(1)(a), 6, 88 of the Regulation, and Articles 113 and 114 of the Code; IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the aforementioned controller, La Patria S.p.A., to pay the sum of 39,000 (thirty-nine thousand) euros as an administrative fine for the violation(s) indicated in the grounds. IT IS ORDERED that the aforementioned controller, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, pay the sum of 39,000 (thirty-nine thousand) euros, in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is hereby noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—in accordance with the procedures set forth in the attachment – of an amount equal to half of the penalty imposed within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this order may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10—failure to do so will result in the appeal being deemed inadmissible—within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, August 6, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Ghiglia THE DEPUTY SECRETARY GENERAL Filippi [Web Doc. No. 10297306] Decision of August 6, 2026 Register of Decisions No. 585 of August 6, 2026 THE DATA PROTECTION COMMISSIONER AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Claudio Filippi, Deputy Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed by Mr. XX against La Patria S.p.A.; HAVING EXAMINED the documentation in the case file; HAVING REGARD TO the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Dr. Agostino Ghiglia; 1 FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1 Origin of the preliminary investigation and activities conducted. On July 26, 2023, Mr. XX filed a complaint pursuant to Article 77 of the Regulation and Articles 142 et seq. of the Code against La Patria S.p.A. (hereinafter, the Company). In response to this complaint, on November 26, 2023, and April 18, 2024, the Company submitted corrective documents following specific requests from the Office dated November 16, 2023, and April 3, 2024, respectively. The complaint alleged violations of the Regulations, specifically: the failure to respond to two requests for access to data in which the complainant asked to “review and obtain a copy of all documentation pertaining to the […] [disciplinary] charge, including the recording of the GPS device data from the company vehicle with license plate number […]” (June 14, 2022) and to have “access to the case files in order to review and obtain copies of all documentation pertaining to the aforementioned disciplinary charge” (June 25, 2022); the Company’s submission, in the proceedings before the judicial authority, of an “alleged list of GPS records—a satellite system with which company vehicles are equipped—which, according to the [Company], dates from April 2, 2022, to May 25, 2022,” as well as having commissioned a private investigation firm to conduct surveillance on the complainant. On May 2, 2024, the Office sent a request for information pursuant to Article 157 of the Code to the Company, which responded on June 10, 2024. On that occasion, the Company stated that: “[the complainant] was employed by La Patria Spa […] as a security guard until July 4, 2022, the date on which the employee was terminated for just cause following disciplinary proceedings initiated with a disciplinary charge dated June 7, 2022, which was subsequently rescinded and replaced by a disciplinary charge dated June 21, 2022” (see note dated June 10, 2024, p. 1); “By order of January 30, 2024, the Court […] ruled that the termination was unlawful” (see cited note, p. 1); “In that order, the Court also ruled on the legality of the investigative inquiry commissioned by La Patria from [the investigative agency]” (see cited note, p. 2); “As of the date of this brief, an appeal for opposition pursuant to Art. 1, paragraph 5, of Law No. 92/2012, filed by La Patria Spa, is pending” (see cited note, p. 2); “With regard to the employment relationship established with the [complainant], attached are the policies in effect at the time during the period covered by the circumstances alleged in the complaint: the policy dated April 8, 2019, regarding employees […] and personnel employed by prefectural decree, dated the same day […]; notice dated September 1, 2021, for employees […] and personnel employed by prefectural decree, dated the same day […]; notice dated December 14, 2022, regarding employees […] and personnel employed by prefectural decree, dated the same day” (see cited note, p. 2); “With regard to the brief dated June 14, 2022, it should be noted that it was drafted as a defense brief by the employee within the framework of the disciplinary proceedings governed by Art. 7 of Law 300/1970. Upon reading […] the brief prepared by the employee’s attorneys, there is no reference to the GDPR or even the slightest mention thereof; indeed, the request is made in the concluding remarks, where a copy of the documentation pertaining to the disciplinary charge is requested, with clear reference to labor law, without any mention of the employee’s data subject rights under the GDPR. Further confirmation of this emerges from an examination of the representation issued for this purpose by the [complainant] to his attorney […], attached to the defense brief, in which the employee granted the attorney a mandate “to represent and defend me in the disciplinary proceeding initiated against me (…)”. Moreover, the brief refers to alleged GPS records based on the erroneous belief […] that the disciplinary charge drew its evidentiary support from the geolocation of the vehicle via such company equipment. […] since the two documents were drafted by legal professionals—and thus possess technical expertise—had they intended to exercise their rights under Article 15 of the GDPR, they would certainly have made a specific request to that effect as well, rather than limiting their references solely to Article 7 of Law 300/1970” (see cited note, p. 3); “Similar considerations apply with regard to the brief dated June 22, 2022 […]; there is no mention of requests to exercise the rights of access generally provided to the data subject under Article 15 of the GDPR, much less with regard to Article 22 of the GDPR” (see cited note, p. 4); “It is clear that in that instance, the employee complained […] exclusively of an alleged infringement of the rights of defense within the context of the disciplinary proceeding” (see cited note, p. 4); “Regarding the GPS devices installed on the company vehicles of La Patria S.p.A. […] The union agreement states […] verbatim that the controller intends to use GPS devices for fleet management as well as for the active and passive safety of the driver” (see cited note, p. 5); “La Patria S.p.A., therefore, after informally consulting the DPO for the necessary assessments, convened the trade unions that were data subjects, which—having been informed of the tool the employer intended to adopt and the methods of data collection—signed the relevant agreement, thereby authorizing its use; This was done precisely in light of the fact that the installed system allows for the collection of a series of data and parameters related to the vehicle’s operation (and therefore, necessarily, its location as well), but is unable to collect identifying data regarding the GpG on board the vehicle, and also in light of the fact that, apart from the collection of the vehicle’s technical data, the device contains no personal data regarding the GpG to whom the vehicle is assigned while on duty” (see cited note, p. 6); “In accordance with the agreement reached with the labor unions, in order to gather information regarding the roadside Surveillance operation […] that led to the initiation of disciplinary proceedings against the [complainant] and subsequently to his dismissal, La Patria engaged a private investigation agency to investigate the [complainant]. Proof of this is the fact that the only document used for disciplinary purposes by the employer […] was the report from the investigation agency” (see cited note, p. 6); “The system for monitoring the technical operating parameters of the company’s vehicle fleet is completely separate from the workflow of the company’s operational division—including the operations center and the services office—and therefore from any data concerning the employees who use the vehicles. The only company department that has access to the data collected by this system is the logistics office, which operates during hours when night patrols are not active and exclusively for the purposes specified in an agreement or at the request of company management, and in any case, in offline mode. The individual assigned to this role is a single person from the logistics office who has no personnel oversight duties and is specifically designated for this purpose” (see cited note, p. 7); “With regard to Document 11 submitted to the court by La Patria’s defense, it should be clarified that the preparation of this document—which was not provided for by the company’s organizational structure for the reasons just stated—took place only ex post to respond to the request for production pursuant to Art. 210 of the Code of Civil Procedure made by the opposing party in its initial complaint […]. The processing of the GPS log data—which, it should be reiterated, allows only for the geolocation of the vehicle—by linking it to data regarding on-duty personnel, was therefore necessary only at the time of exercising the rights of defense in court and for that purpose” (see cited note, p. 7). On October 15, 2024, the Office sent a request for additional information pursuant to Article 157 of the Code, and on November 14, 2024, the Company submitted its response, and on that occasion the representative stated that: “The geolocation data of company vehicles is processed by La Patria S.p.A. exclusively for operational and safety purposes, as indicated in the union agreement […] signed on June 10, 2019. In particular, it is specified that the data collected via GPS devices is used by La Patria S.p.A. solely to optimize operational and logistical management, while ensuring the safety of personnel and company vehicles. […] “the processing of geolocation data has never involved the direct management of employees’ personal data for the purpose of individual monitoring, but is intended exclusively for monitoring vehicles for logistical and safety purposes” (see note dated November 14, 2025, p. 1); “since the Company has always used the data acquired via GPS devices solely for the purposes described above […] no privacy notice regarding the installation of the company device was prepared or provided to the complainant. This omission occurred in good faith, as the Company believed that, in the absence of any processing involving the employee’s personal data, a specific privacy notice was not necessary” (see cited note, pp. 1, 2); “The Company, fully aware of the legal requirements regarding data protection, undertakes to comply with the applicable obligations, ensuring: - the utmost diligence in adopting all required measures; - the implementation of any additional measures you may communicate, even at a later date, in accordance with the terms you specify; all with the aim of ensuring full compliance with current privacy regulations, including the drafting and distribution to current employees of a privacy notice regarding the GPS processing in question” (see cited note, p. 2); “La Patria S.p.A. […] confirms that the omission resulted from a differing interpretation of the law, without any malicious or fraudulent intent” (see cited note, p. 2); with regard to the notices dated December 14, 2022, September 1, 2021, and April 8, 2019, “the Company wishes to clarify that it has never, either in the past or at present, conducted any processing of personal data relating to employees’ philosophical beliefs, other orientations, or sexual life. In fact, such personal data has never been processed, collected, recorded, or stored by the Company, and its mention in the privacy notice was solely the result of a purely precautionary assessment aimed at ensuring maximum transparency for data subjects. More specifically, it should be noted that the reference to philosophical or other beliefs was included in the privacy notices as a precautionary measure, taking into account the possibility—albeit purely theoretical—that such information could be inferred from photographs contained in personal identification documents. However, it is reiterated that such references, where they may be inferred, are not processed by the Company for any reason, as it adheres to the principle of data minimisation under Art. 5(1)(c) without in any way extending the collection or storage to aspects of private or personal life that fall outside the professional context. Similarly, Patria S.p.A. does not process, collect, record, or handle in any way data relating to the sexual life of its employees. This information has been included in the privacy policy purely as a precautionary measure, based on the assessment that the only context in which it may arise is the receipt of documents related to pregnancy certificates or similar information necessary to comply with specific, current labor regulations” (see cited note, pp. 2, 3); “In drafting the privacy policy, the Company sought to consider every possible consequence that might arise from the collection of such information, adopting a prudent approach aimed solely at providing a comprehensive and transparent privacy policy” (see cited note, p. 3); “Patria S.p.A. undertakes […] to proceed, based on the guidance you provide in response to this letter, with the revision of the privacy notice in order to eliminate, where necessary, any reference to special categories of data that are not processed, ensuring that the document accurately reflects the actual data processing methods adopted. Patria S.p.A. confirms and reaffirms its willingness to cooperate with the Authority by fully complying with the regulations governing data protection and by taking all necessary measures to ensure compliance with the applicable provisions” (see cited note, p. 3); with regard to the privacy notices attached to the response dated June 10, 2024, “it is clarified that the processing of internet browsing files is carried out by La Patria S.p.A. solely for the purpose of addressing security and data compliance needs, protecting the corporate network, and preventing IT anomalies that could compromise the security of corporate information; it is in no way intended for the remote monitoring of employees. The legal basis justifying the processing in question is the controller’s legitimate interest in ensuring the security of its IT systems, as provided for in Art. 6(1)(f) of the Regulation […]. This processing activity, in accordance with the principle of accountability (Art. 5(2) of the Regulation […]), is limited to only the data necessary to ensure network protection and is carried out solely when necessary, avoiding any invasive or irrelevant processing” (see cited note, p. 3); “Access to such information is further granted exclusively to authorized personnel responsible for cybersecurity and occurs only in the event of specific operational needs related to potential critical issues involving network breaches that require access to such logs” (see cited note, p. 3); “Patria S.p.A. reiterates that under no circumstances is the processing of internet browsing data monitored and/or used for the purpose of individual monitoring of employees […]” (see cited note, p. 3); 2 INITIATION OF THE PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONING MEASURES AND THE PARTY’S DEFENSES. 2.1 Initiation of the proceedings (Art. 166, paragraph 5, of the Code). On March 19, 2025, the Office, pursuant to Article 166, paragraph 5, of the Code, served notice of the alleged violations of the Regulation against the Company, with reference to Articles 5, para 1, subparagraph (a), 6, 12, 13, 15, 88 of the Regulation, and Article 114 of the Code, for failing to provide an adequate response to the requests to exercise the right of access submitted by the complainant on June 14, 2022, and June 25, 2022, for failing to comply with theobligation to provide information regarding the processing of data collected via GPS devices installed on company vehicles, for having provided inadequate information documents regarding the processing of special categories of personal data, and for having processed data relating to employees’ Internet browsing logs in a manner that does not comply with data protection regulations. 2.2 Defenses of the Party (Art. 166, paragraph 6, of the Code). In its written defense submitted on April 17, 2025, the Company stated that: - “With regard to the alleged failure to respond to the complainant’s request for access to personal data [it should be noted that] the request was characterized by the complainant himself as ‘Access to Records’ and generally concerned the desire to ‘review and obtain a copy of all documentation pertaining to the disciplinary proceeding,’ including ‘the GPS device tracking records.’ The company, therefore, […] interpreted the request as part of a standard disciplinary proceeding, in line with the employee’s right to a defense, which, under labor law, requires the employer to provide only the documentation necessary to ensure that right. From this perspective, the Company considered that the employee’s rights could be guaranteed through the mechanisms provided for by labor and procedural law, in accordance with the case law of the Court of Cassation (see Cass. No. 27093 and Cass. Labor No. 23304 of November 18, 2010, and Cass. No. 6468/2024)” (see note dated April 17, 2025, p. 1); - requests recognition of “on the one hand, the objective ambiguity of the request made by the complainant, and on the other, the absence of any obstructive intent on the part of the Company” (see cited note, p. 1); - “The Company acknowledges that a different interpretive framework for the request could have allowed for a response fully compliant with the GDPR, correctly classifying the request as an exercise of the data subject rights. The Company has therefore decided to adopt an internal protocol for processing requests that involve both labor law and privacy issues, involving the newly appointed DPO and consultant in the preliminary assessment” (see cited note, p. 1); - “Regarding the request concerning the GPS track […] the Company did not possess data directly attributable to the complainant. The location tracking system, in fact, did not automatically associate the technical data collected with a specific individual. Therefore, to respond to the request, the Company would have had to access the system and process data that had never been extracted, and consequently link it to the employee—an operation that would have entailed further and unnecessary processing of personal data” (see op. cit., p. 2); - “in determining the amount of any penalty or in applying any corrective measures, the Company requests that consideration be given to the fact that the complainant, as the data subject, has not suffered any harm with respect to the processing of his or her personal data” (see note cited above, p. 2); - “With regard to the failure to provide an appropriate privacy notice concerning the processing of data via the GPS system installed on company vehicles, it should be noted that this omission is attributable to an error of judgment committed in good faith” (see note cited above, p. 2); - “The processing of data collected via GPS was carried out solely for organizational and operational purposes, including the optimization of fleet management and the scheduling of vehicle maintenance. Particular attention was paid to employee safety, given the nature of the activities performed and the potential associated risks; precisely with this in mind, even though the system did not directly identify the GPG on board the vehicle, the Company considered it important to be able to trace, in the event of an emergency, the employee on board the vehicle—a feature designed exclusively to ensure a rapid response without any intent to monitor” (see cited note, p. 2); - “While acknowledging the lack of information provided, the company emphasizes that the data processing had no negative impact on the rights and freedoms of employees. Furthermore […] it appears that the employee was well aware that the company car was equipped with an integrated GPS satellite system, making it clear that he was aware of the processing, even if not formally documented” (see cited note, p. 2);The company acted in good faith and immediately took steps to correct the issues that arose by promptly sending a clear and comprehensive notice to employees, containing all the information required under Articles 13 and 14 of the GDPR” (see cited note, p. 2); - “With regard to data relating to ‘philosophical beliefs, other orientations, or sexual life’ […] it should be noted that the reference in the privacy notices was included as a precautionary measure to ensure maximum transparency, even though no processing of such data actually took place. The Company acknowledges that the privacy notice was not fully aligned with the processing operations actually carried out, but emphasizes that, since no processing of the aforementioned data took place, there was no harm to the rights and freedoms of employees. […] Since there was no actual harm, the impact of the violation was minimal, and therefore we request that the amount of the fine be reduced or waived” (see cited note, pp. 2, 3); - “The Company has already initiated a review of the privacy notices to bring them into line with the actual data processing operations and ensure full compliance with articles 12 and 13 of the Regulation” (see cited note, p. 3); - “As confirmation of this commitment, attached is […] an updated draft of the privacy notice for employees, from which references to special categories of personal data not processed have been removed” (see cited note, p. 3); - “In this context, it should be noted that the Company has recently replaced the DPO, coinciding with the change in external consultant” (see cited note, p. 3); - “Regarding the processing of Internet browsing logs, the Company intends to provide a formal and cooperative clarification […] the Company apologizes for the imprecise wording and confirms that no logging or analysis system for websites visited by employees is active within its IT environments, nor are any activities intended or permitted to monitor the web content accessed by employees, even indirectly” (see cited note, p. 3); - “In the previously transmitted note, the terminology used (‘Internet browsing logs’) proved to be ambiguous and open to misinterpretation. This wording was intended in a technical-systemic sense and did not refer to individual Internet browsing by employees” (see cited note, p. 3); - “The Company also conducted […] further internal audits, which revealed that the processing carried out by the Company concerns exclusively technical system logs, automatically generated by network devices […] to ensure perimeter security and the integrity of the Company’s IT infrastructure” (see cited note, p. 3); - “these logs: - do not record the URLs or content of the web pages visited by employees; - cannot be traced, either directly or indirectly, to individual employees, nor are they used for the purposes of behavioral monitoring or productivity control; - are not processed or analyzed on an individual basis, but only in exceptional cases related to the management of security incidents or critical malfunctions; - are retained for a limited period, in accordance with the principles of proportionality and data minimization” (see cited note, p. 3); - “To ensure greater transparency and accountability, the Company has already: - updated the employee privacy notice, specifying the technical and non-identifying nature of the logs generated; - supplemented the processing register with the correct classification of this activity” (see cited note, p. 3); - the Company “reaffirms its commitment to fully cooperate with the Data Protection Authority to ensure compliance with current legislation on the protection of personal data” (see cited note, p. 4). 3 THE AUTHORITY’S ASSESSMENTS. Following an examination of the statements made to the Data Protection Authority during the proceedings, as well as the documentation obtained, it appears that the Company, in its capacity as controller, carried out certain processing operations that do not comply with personal data protection regulations for the reasons set forth below. In particular, the Company failed to provide an adequate response to the requests to exercise rights submitted by the complainant on June 14, 2022, and June 25, 2022, concerning the documentation underlying the disciplinary action. Furthermore, the Company failed to fulfill its obligation to provide information regarding the processing of data collected via GPS devices installed on company vehicles. The Company also provided inadequate information regarding the processing of data belonging to special categories of data. In this regard, it should be noted that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false records or documents, shall be liable pursuant to Art. 168 of the Code, “False Statements to the Data Protection Authority and Interruption of the Performance of the Authority’s Duties or the Exercise of Its Powers.” 3.1 Violation of Articles 12 and 15 of the Regulation. It has been established that the Company failed to provide an adequate response to the request for access dated June 14, 2022, (contained in the defense brief filed on behalf of the complainant following the disciplinary charge), in which the complainant requested access to the documentation pertaining to the disciplinary charge of June 7, 2022 (specifically, the complainant requested to “review and obtain a copy of all documentation pertaining to the aforementioned disciplinary charge, including the recording of the GPS device data from the company vehicle with license plate […]”), and the request for access dated June 25, 2022, regarding the documentation pertaining to the disciplinary charge of June 21, 2022 (a request contained in the defense brief filed on behalf of the complainant, which states, “insists on the request [to] the company […] for access to the records in order to review and obtain copies of all documentation pertaining to the aforementioned charge”). The Company’s conduct constituted a violation of Articles 12 and 15 of the Regulation. In this regard, the complainant specified that “the dismissal was challenged both through out-of-court proceedings and in court […] initiated by an appeal […] and the complainant has consistently requested the production of the documents gathered by the accusing company, which produced the investigative report only before the Labor Court. […] the complaint filed with the Authority stems from information obtained from the brief submitted by La Patria Spa on March 1, 2023, in the pending labor proceeding.” The objection raised by the Company regarding the lack of references to the Regulation in the requests submitted by the complainant—from which it would follow that the request cannot be classified as a request for access to data—cannot be upheld: indeed, the wording of the requests clearly indicates their subject matter. In this regard, it should be noted that, with respect to the right granted to the data subject under Article 15 of the Regulation, Guidelines 1/2022 on the rights of data subjects — Right of Access, adopted by the EDPB on March 28, 2023 (to which minor amendments were made on May 30, 2024), specify that “the GDPR does not impose any requirements on data subjects regarding the form of an access request for personal data. Therefore, in principle, data subjects are not required to comply with any requirements under the GDPR when choosing the communication channel through which to contact the controller” (see para. 3.1.2., point 52). Nor can the Company’s argument be accepted regarding the instrumental nature of the requests and the complainant’s failure to provide evidence of harm resulting from the failure to provide the subject matter of the access requests as grounds justifying the lack of a response. In this regard, it should be noted that the aforementioned Guidelines on the Right of Access to Data specify that “the general purpose of the right of access is to provide individuals with sufficient, transparent, and easily accessible information regarding the processing of their personal data, so that they may be aware of the processing and verify its lawfulness, including with regard to the accuracy of the data being processed” (p. 3, in the “Summary” Section)) and that “the data subject does not […] an obligation to justify the access request, and it is not up to the controller to assess whether the request will actually be useful to the data subject in verifying the lawfulness of the relevant processing or in exercising other rights. The controller must comply with the request, unless it is evident that it was submitted based on provisions other than those concerning data protection” (p. 3, in the “Summary” Section). Furthermore, if the controller considers that it cannot comply with requests to exercise rights, it must inform the requester of the reasons for the refusal as well as the existence of the right to file a lawsuit with the courts or lodge a complaint with the Data Protection Authority (Art. 12, para 4, of the Regulation). In the present case, it was found that the Company did not provide an adequate response to the requests for access to data, not even to indicate that it was unable to comply with them; in fact, the Company merely stated, “even the access request for evidence relating to the disputed facts does not constitute an obstacle to the imposition of the disciplinary measure, given that the employer is not required to do so prior to the imposition of the measure” (see termination letter dated July 4, 2022). Finally, regarding the case law cited by the Company concerning the obligations incumbent upon the employer within the framework of the procedure set forth in Art. 7 of Law No. 300 of 1970, we merely note that the subject matter of the investigation into the data breach involving violations of personal data protection regulations concerned the right of access to personal data provided for in Art. 15 of the Regulation, that is, a right defined within the framework of personal data protection law that has its own distinct and autonomous characteristics, concerning personal data—that is, data relating to the data subject. 3.2 Violation of the obligation to provide adequate information regarding the processing of data. The Company also engaged in conduct in violation of Article 13 of the Regulation, with regard to the processing of geolocation data, because, according to the Company’s own statements, in connection with the processing of data relating to the satellite geolocation of company vehicles, no specific notice was provided to the data subjects regarding this matter. In this regard, it should be noted that the collection of geolocation data from the vehicle used by the employee provides information indirectly linked to the employee driving that company vehicle and therefore involves the processing of personal data which, as such, requires that the information specified in Art. 13 of the Regulation be provided to the data subjects. In the same agreement—which, in accordance with the safeguard procedure provided for in Art. 4, paragraph 1, of Law No. 300 of 1970, was concluded by the Company with the union representatives—it was specified that “the Company undertakes: to provide employees with specific information regarding the foregoing, pursuant to Article 13 of the Consolidated Law on Privacy (Decree-Law No. 196/2003), within 30 days of the signing of this agreement.” Given the processing carried out, despite the obligation set forth in Art. 13 of the Regulation—even though the aforementioned agreement clearly stated that the Company would provide appropriate information to employees—the Company failed to fulfill this obligation. In this regard, the Company itself acknowledged that, through the geolocation system, it can “identify, in the event of an emergency, the employee inside the vehicle—a feature designed exclusively to ensure a rapid response” (see note dated April 17, 2025, p. 2); the Company also acknowledged that, at the time of the events, it had not provided adequate information regarding the processing of geolocation data. It is noted that the Company stated that it “immediately took steps to correct the issues that arose by promptly sending a clear and comprehensive notice to employees” in accordance with Articles 13 and 14 of the Regulation (see note dated April 17, 2025, p. 2). Article 13 of the Regulation—which establishes the controller’s obligation to provide information—was also violated by the Company because, in the notices dated December 14, 2022, September 1, 2021, and April 8, 2019, the Company specified that, as part of its processing activities, it may also become aware of information relating to employees’ “philosophical or other beliefs” and “sex life”—data falling under the so-called special categories referred to in Article 9 of the Regulation—even though, as stated by the Company, such processing was not actually carried out. Consequently, it appears that the information provided regarding the processing of employee data does not align with the processing activities actually carried out by the Company, including with respect to so-called special categories of data. Pursuant to Article 12(1) of the Regulation, among other things, “the controller shall take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14 […] regarding the processing in a concise, transparent, intelligible, and easily accessible form, using plain and clear language,” Article 13 of the Regulation specifies that “where personal data are collected from the data subject, the controller shall provide the data subject, at the time the personal data are obtained, with the […] information [listed in that provision].” The content of the privacy notice must, therefore, describe processing operations that are actually carried out and ensure that they comply with data protection regulations; it is not sufficient, in and of itself, to render a processing operation lawful merely because a description of it is included in the privacy notice, nor is it sufficient for the privacy notice to describe processing operations if, in practice, the data controller does not actually carry them out. In this regard, the Company itself stated that it had included such data in the documents containing the privacy notice “as a precautionary measure, in order to ensure maximum transparency, even though no processing of the aforementioned data had been carried out” (see note dated April 17, 2025, pp. 2, 3). For the reasons set forth above, the Company’s conduct violated Articles 12 and 13 of the Regulation. In this regard, it is noted that the Company stated that it had “initiated a review of the disclosure documentation,” attaching an updated draft of the disclosure statement intended for employees and specifying, with respect to the same, that “references to special categories of personal data that were not processed have been removed” (see Note No. 3 dated April 17, 2025). It should be noted, in this regard, that, pursuant to Article 9 of the Regulation, there is a general prohibition on the processing of so-called “special categories of data”; this prohibition may be waived only in the cases strictly provided for in para 2 of the same article. Among these, subparagraph (b) specifies that the prohibition does not apply when “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, to the extent that it is authorized by Union or Member State law […], provided that appropriate safeguards are in place to protect the fundamental rights and data subject rights.” Finally, with regard to the allegation—raised at the outset of the proceedings—concerning the violation of Articles 5(1)(a), 6, and 88 of the Regulation, and Articles 113 and 114 of the Code, in relation to data concerning employees’ Internet browsing, we take note of the Company’s statements in its defense briefs of April 17, 2025, from which it appears that the Company did not carry out the processing at issue. For these reasons, it is not considered that, in the present case, the conditions exist to adopt measures regarding the violation of Articles 5(1)(a), 6, para. 6, 88 of the Regulation, and Articles 113 and 114 of the Code, as set forth in the notice of violations dated March 19, 2025, which is therefore to be dismissed insofar as it relates to these specific issues. With regard to the draft privacy notice that the Company attached to its defense briefs of April 17, 2025 —a document that is, therefore, not yet operational—given the content of the notice of violations and in light of the Company’s statements regarding the revision of informational documents to comply with personal data protection regulations, the Company is reminded of the need to comply with personal data protection regulations, even where, the documents containing the privacy notice describe processing operations relating to browsing data, data, or metadata pertaining to the individual email account assigned to the employee, as well as the content of incoming and outgoing email messages regarding individual corporate email addresses. This is always subject to the fact that the information documents must describe processing operations that are lawful in and of themselves. 4 CONCLUSIONS. For the reasons set forth above, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not address the findings notified by the Office in the notice initiating the proceedings; they are therefore insufficient to justify the dismissal of this proceeding, and none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The Company’s conduct—specifically, the failure to provide an appropriate response to requests for access to data, the failure to comply with the obligation to provide adequate information regarding the geolocation of company vehicles, and the failure to comply with the obligation to provide information by supplying incorrect details regarding the processing of so-called “special categories” of data, are unlawful, as set forth above, in relation to Articles 12, 13, and 15 The violation, as established in the grounds set forth above, cannot be considered “minor,” given the nature of the multiple violations found, which concerned the obligation to provide adequate information and the exercise of the right of access (see Recital 148 of the Regulation). 5 CORRECTIVE MEASURES Recital 5. CORRECTIVE MEASURES Considering that the conduct has ceased to have any effect—given that, ultimately, the complainant obtained the investigative report already during the proceedings before the judicial authority, the Company has stated that it has taken steps to provide a notice regarding the processing of geolocation data to its employees, and has stated that it has removed the incorrect references contained in thethe privacy notice regarding the processing of so-called “special categories of personal data”—the conditions for adopting further corrective measures under Art. 58(2) of the Regulation are not met. 6 ORDER-INJUNCTION Pursuant to Article 58(2)(i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Art. 18 of Law No. 689 of November 24, 1981, and Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). 6.1 Assessment of the Conduct and Determination of the Applicable Penalty. The violation of the aforementioned provisions resulted from multiple acts (regarding requests to exercise the right of access and the obligation to provide adequate information), which must therefore be considered separately, for the purpose of determining the administrative fines to be imposed, which, for all violations taken together, have been set at a total of 39,000 (thirty-nine thousand) euros based on the reasons set forth below. 6.2 Determination of the administrative fine relating to the exercise of the right of access (Art. 83, para. 2, of the Regulation). With regard to the conduct concerning the exercise of the right of access, Art. 83(5), in setting the maximum penalty at 20 million euros or, for enterprises, 4% of the annual worldwide turnover of the preceding fiscal year, whichever is higher, specifies the methods for determining the aforementioned fine, which must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in para 2—to be assessed when determining the amount of the fine. The amount of the administrative fine must be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account that: the unlawful processing consists of failing to provide an adequate response to requests for access to a data subject’s data (see Art. 83(2)(a) of the Regulation); as stated in the reasoning of this decision, the Company’s conduct constituted negligence (see Art. 83(2)(b) of the Regulation); it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the Calculation of Administrative Fines under the GDPR” of May 24, 2023, paragraph 60). That said, considering that the controller is a joint-stock company with a turnover of less than 500 million euros, it is considered that, for the purposes of quantifying the fine, the following circumstances should be taken into account: the Company has stated that it has resolved to adopt an internal protocol for processing requests involving both labor law and privacy issues, involving the newly appointed DPO and consultant (see Art. 83, para. 2, subparagraph (c), of the Regulation); there are no previous relevant violations on the part of the Company (see Article 83(2)(e) of the Regulation); the level of cooperation with the Company was standard (see Art. 83(2)(f) of the Regulation); the Authority became aware of the violation through a complaint filed by the data subject (see Article 83(2)(h) of the Regulation). In the present case, the economic circumstances of the controller—determined based on the controller’s revenue as reported in the regular financial statements for the year 2024—are considered relevant. In light of the aforementioned factors, assessed as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, the amount of the administrative fine is set at 22,000 (twenty-two thousand) euros for the violation of Articles 12 and 15 of the Regulation. 6.3 Determination of the administrative fine for the violation of the obligation to provide adequate disclosure (Articles 83, para 2, of the Regulation). With regard to the conduct concerning the violation of the obligation to provide adequate information, Art 83, para 5, in setting the maximum penalty at 20 million euros or, for enterprises, 4% of the undertaking’s annual worldwide turnover for the preceding fiscal year, whichever is higher, specifies the method for determining the aforementioned fine, which must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in para 2—to be assessed when determining the amount of the fine. The amount of the administrative fine shall be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83, para. 2, of the Regulation. Taking into account that: the unlawful processing consists of failing to provide adequate notice regarding the geolocation of company vehicles and regarding the so-called “special categories of personal data” to be provided to employees (see Art. 83, para. 2, subparagraph a), of the Regulation); as evident from the reasoning in this decision, the Company’s conduct was characterized by negligence (see Article 83(2)(b) of the Regulation); the violation in question concerned information regarding the geolocation data processed and the reference to certain so-called special categories of data, which, in practice, were not actually processed (see Art. 83(2)(g) of the Regulation); it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, given that the controller is a corporation with a turnover of less than 500 million euros, it is considered that, for the purposes of determining the amount of the fine, the following circumstances should be taken into account: the Company has stated that it provided clear notice to employees regarding geolocation and that it has removed incorrect references concerning the processing of so-called special categories of personal data that were not actually processed (see Art. 83, para. 2, subpar. c), of the Regulation); there are no relevant prior violations on the part of the Company (see Art 83(2)(e) of the Regulation); the level of cooperation with the Company was ordinary (see Article 83(2)(f) of the Regulation); the Authority became aware of the violation through a complaint filed by the data subject (see Article 83(2)(h) of the Regulation); as a mitigating factor, it is also considered that the so-called special categories of data included in the privacy notice—relating to philosophical beliefs and data concerning sexual life—were, despite being expressly provided for in the document, never processed by the Company, as expressly stated by the Company (see Recital 83(2), subparagraph (k), of the Regulation); In the present case, the economic circumstances of the controller—determined on the basis of the controller’s revenue as reported in the regular financial statements for the year 2024—are deemed relevant. In light of the aforementioned factors, evaluated as a whole, and in accordance with the principles of effectiveness, proportionality, and dissuasiveness set forth in Art. 83, para 1, of the Regulation, the amount of the administrative fine is set at 17,000 (seventeen thousand) euros for the violation of Articles 12 and 13 of the Regulation. In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section of the decision containing the injunction must be published on the Data Protection Authority’s website, given the seriousness of the conduct in question, which concerned the exercise of the right of access to data and the obligation to provide appropriate information to employees. FOR THESE REASONS pursuant to Articles 57 and 83 of the Regulation, the processing of personal data carried out by La Patria S.p.A., with registered office at Via della Barca, No. 26, Bologna, Tax ID 07764040965, is hereby declared unlawful for violating Articles 12, 13, and 15 of the Regulation, as set forth in the reasoning; IT IS HEREBY DETERMINED to dismiss the complaint filed against La Patria S.p.A., by order dated March 19, 2025, limited to the violations of Articles 5(1)(a), 6, 88 of the Regulation, and Articles 113 and 114 of the Code; IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the aforementioned controller, La Patria S.p.A., to pay the sum of 39,000 (thirty-nine thousand) euros as an administrative fine for the violation(s) indicated in the grounds. IT IS HEREBY ORDERED that the aforementioned controller, in the event that the dispute is not resolved pursuant to Article 166, paragraph 8, of the Code, pay the sum of 39,000 (thirty-nine thousand) euros, in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, applicable to the filing of an appeal as indicated below; IT IS HEREBY ORDERED pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10; failure to do so within thirty days from the date of notification of the decision—or within sixty days if the appellant resides abroad—will result in the appeal being deemed inadmissible. Rome, August 6, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Ghiglia THE DEPUTY SECRETARY GENERAL Filippi