Palumbo Superyacht Ancona s.r.l.: Insufficient legal basis for data processing

The Italian DPA has fined Palumbo Superyacht Ancona s.r.l. EUR 50,000. The company had blocked an employee's company email account without permission. The employee had reported the incident to the company and asked for the restoration of the e-mail inbox, which contained both private and business e-mails. However, the company did not comply with this request. In the course of its investigation, the DPA found further violations. For example, the company did not respond to a request for information from the DPA and violated the principle of limiting data retention.

GDPR Articles: Art. 5 (1) a), e) GDPR, Art. 13 GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacy
Industry: Employment