Italian DPA fines security company EUR 39,000 for GDPR violations
The Italian DPA fined La Patria S.p.A. EUR 39,000 for failing to respond to an employee's access requests and for inadequate information about GPS data processing. The company also had incorrect references to special categories of data in its privacy notice.
- Framework
- GDPR
- Who it concerns
- La Patria S.p.A., a security and technological security company
What changed?
Each point with the sentence from the source that says it.
A data subject does not need to expressly refer to the GDPR for a request to qualify as an exercise of the right of access.
The DPA clarified that a data subject does not need to expressly refer to the GDPR for a request to qualify as an exercise of the right of access.
Where a controller decides not to comply with a request, it must inform the data subject of the reasons and of the possibility of lodging a complaint or seeking a judicial remedy.
Furthermore, where a controller decides not to comply with a request, it must inform the data subject of the reasons and of the possibility of lodging a complaint or seeking a judicial remedy.
Geolocation data collected through GPS systems installed on company vehicles constitute personal data because the vehicle’s location can be indirectly linked to the employee driving it.
Such data constitute personal data because the vehicle’s location can be indirectly linked to the employee driving it.
Privacy notices should not refer to processing of special categories of personal data if the company does not actually process such data.
In addition, the company’s privacy notices incorrectly referred to the processing of special categories of personal data, including information concerning philosophical beliefs and sex life, although the company did not actually process such data.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- DSAR Procedure
Review the DSAR procedure to ensure that access requests are recognized even without explicit reference to GDPR and that refusals include reasons and information on remedies.
- Privacy Notice
Review the privacy notice to ensure it accurately describes processing of geolocation data and does not mention special categories of data that are not processed.