Former staff email: Italian watchdog’s €225,000 fine

According to WST Law & Tax’s article published on Lavorosì, “Privacy: Email dell’ex dipendente, le indagini difensive non giustificano la mancata chiusura.”, Italy’s data protection authority imposed an administrative fine of €225,000 on a recruitment company. The reported decision, No. 583 of 6 August 2026, concerns the processing of corporate email, including after employment ends. The decision was not consulted directly: the findings and reasoning described here rely on the journalistic account.

According to the report, the company had retained former employees’ individual mailboxes for an extended period without activating automatic replies informing senders that their employment had ended. The authority reportedly also found that employee privacy notices did not describe the processing actually undertaken in sufficient detail. The cited legal framework includes the principles in Article 5 GDPR, including data minimisation and storage limitation, and the information duties in Article 13. An interest in gathering evidence for litigation would not automatically make indiscriminate access to messages or prolonged account retention lawful.

WST Law & Tax’s analysis further reports that the authority cited an approach taken by Italy’s Court of Cassation under which checks investigating specific unlawful conduct must rest on concrete suspicion and concern data acquired after that suspicion arose. A general reference to litigation needs would therefore be insufficient to justify retrospective checks. For employer monitoring in Italy, the report also cites Article 88 GDPR and Article 114 of the Italian Privacy Code, which refers to the safeguards in Article 4 of the Workers’ Statute.