Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Lazio Region: Insufficient legal basis for data processing

The Italian DPA has fined Lazio Region EUR 100,000.

€100,000 Fine
Lazio Region
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 113 GDPR Art. 114 GDPR
Personal Data Processing Employees Monitoring Supervisory Authorities
Dec 1, 2022 Source garanteprivacy.it

Full text

The Italian DPA has fined Lazio Region EUR 100,000. A trade union had filed a complaint with the DPA alleging that the Region had monitored the e-mail accounts of employees of the Region's legal department. The Region had initiated such monitoring on suspicion of possible disclosure of information protected by official secrecy to third parties. The Region stored and analyzed the employees' data for 180 days. The data included not only information related to work, but also personal data of the data subjects concerning their private sphere. During its investigation, the DPA found that the Region at the time did not have a valid legal basis for such a large-scale collection of personal data.

Industry: Employment

How it connects

References

Related across sources

C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
Opinion 01/2019 draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary Meeting, 22 - 23 January 2019 Opinion 01 /201 9 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the… Opinion ·EDPB Jan 23, 2019 DPIA Supervision Supervisory Authorities
Opinion 7/2019 draft list of the competent supervisory authority of Iceland regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary m eeting, 12 - 13 March 2019 - Item 2.3.1 Opinion 7 /201 9 on the draft list of the competent supervisory authority of Iceland regarding the processing… Opinion ·EDPB Mar 12, 2019 DPIA Supervision Supervisory Authorities
Opinion 2/2019 draft list of the competent supervisory authority of Norway regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary Meeting, 22 - 23 January 2019 Opinion 2 /201 9 on the draft list of the competent supervisory authority of Norway regarding the processing operations… Opinion ·EDPB Jan 23, 2019 DPIA Supervision Supervisory Authorities
C-288/12 Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per The European Commission brought an infringement action against Hungary before the Court of Justice (Grand Chamber) under Article 258 TFEU, alleging that Hungary violated Article… CJEU Apr 8, 2014 Supervision Supervisory Authorities Personal Data
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
Related documents