Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Autostrade per l’Italia S.p.A.: Insufficient legal basis for data processing
The Italian DPA has imposed a fine of EUR 420,000 on Autostrade per l’Italia S.p.A.
Full text
The Italian DPA has imposed a fine of EUR 420,000 on Autostrade per l’Italia S.p.A. The controller used data from a worker's social media profiles obtained by other workers and a third party in a disciplinary proceeding. The controller did not have a legal basis to use this data.
Industry: Employment
How it connects
Related across sources
C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) CJEU Jun 5, 2018 IP Address Controllers Processors
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
Guidelines 8/2020 targeting of social media users Guidelines ·EDPB Apr 13, 2021 Marketing IP Address Transparency
C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV C-40/17 (Fashion ID) CJEU Jul 29, 2019 Controllers Legitimate Interest Processors