Summary of the Decision

Origin of the case  

Following a complaint, the Italian Supervisory Authority (SA), became aware that a company had installed a satellite tracking device on company vehicles assigned to its employees, which was able to detect their behavior (times, mileage, fuel consumption, and driving style), both during work and private trips. The data collected were used to assign a rating score and take any corrective action. Given the sensitivity of the matter raised, the Italian SA ordered an on-site inspection.

Key Findings

Inspections and subsequent checks revealed that the satellite device, installed at the request of the Swiss parent company, allowed for tracking of workers' activities without the safeguards provided by the Italian workers Charter (Regulations on the protection of the freedom and dignity of workers). Furthermore, the information provided to workers covered all the group's affiliated companies, including those based outside the EU, without clearly indicating the purposes of the processing, legal bases, or entities qualifying as data controllers, processors, and recipients.

The investigations also revealed that access to the information collected via the devices installed in company cars was also granted to staff from other companies in the group, without the appropriate authorization.

Decision

The Italian SA issued a fine of 120 000 EUR to the company as data processor. 
In determining the amount of the fine, the Italian SA took into account both the limited number of employees involved and the immediate suspension of the unlawful data processing, implemented by the company immediately after the complaint was filed. The Italian SA also ordered the deletion of data relating to employees' journeys, collected and used to assign driving behavior.

For further information: Garante privacy: no al controllo dello stile di guida dei lavoratori. Sanzione di 120mila euro a società che monitorava 5 dipendenti con auto aziendale