- within Privacy, Technology and Finance and Banking topic(s)
- in European Union
By its decision no. 476 of 18 June 2026, the Italian data protection authority (the "Garante") imposed an administrative fine of EUR 460,000 on Piaggio & C. S.p.A. for accessing the corporate email accounts of two dismissed employees and retaining that data for an extended period.
Summary of the Case
Two employees whose employment contracts were terminated for just cause on 2 March 2023 requested confirmation that their corporate email accounts had been deactivated; when the company failed to respond within the applicable time limit, they filed a complaint with the Italian DPA. The employees also alleged that the employer had accessed their past correspondence and used it in disciplinary proceedings.
In its defence, the company submitted that, upon serious suspicion of misconduct, it had launched an internal investigation involving its DPO, that the review had been limited by specific filters and keywords, and that this amounted not to systematic monitoring but to a "defensive check". The investigation was found to have accessed a total of 112 emails, some of which dated back approximately two years before the suspicion arose.
The Garante's Legal Assessment
While not rejecting the "defensive check" (controlli difensivi) doctrine developed by the Italian Supreme Court, the Garante emphasised that it can only cover data and conduct arising after the suspicion emerged. Because the review reached back approximately two years before the suspicion arose, the control at issue was characterised not as a defensive check but as retrospective surveillance.
The company backed up employee emails for the entire duration of the employment relationship and for a further five years after its termination, and retained access logs for six months. The Garante found these retention periods disproportionate and held that systematic retention, by enabling the retrospective reconstruction of employee activity, disabled the monitoring safeguards under Article 4 of the Italian Workers' Statute. In the course of the proceedings, the company reduced its email retention period to three months and its log retention period to 21 days.
The Garante held that a request for confirmation of account deactivation amounts to a request to stop processing the data. The company's failure to respond to these requests at all, citing an ongoing employment dispute, was found not to comply with the procedural requirements for deferring data subject rights.
The Garante rejected the company's policy provision stating that there could be "no expectation of confidentiality" over corporate tools. Even within an employment relationship, employees retain a legitimate expectation of privacy regarding their corporate email, and correspondence constitutes communications protected under constitutional guarantees.
On the basis of these findings, the Garante found Piaggio's data processing activity unlawful, imposed an administrative fine of EUR 460,000, and prohibited access to the collected email content.
Assessment Under the Turkish DPL
Under Article 4 of Law No. 6698 (the "DPL"), personal data must be processed in a manner connected to, limited to, and proportionate with the purpose, and retained only for as long as required. The five-year (email) and six-month (log) retention periods at issue in the Piaggio decision could likewise conflict with the obligation under Article 7 of the DPL to erase data once the grounds for processing cease to exist.
The Board's principle decision no. 2018/63 similarly emphasised that exceeding access authorisation to process data outside its purpose breaches Article 12 of the DPL. Accordingly, backing up and retrospectively reviewing corporate emails without any limitation as to duration or purpose carries a risk of breaching the principles of purpose limitation and storage limitation.
Article 10 of the DPL requires that employees be given clear notice covering the purpose, legal basis, and retention period applicable to the use of corporate email; in the Piaggio decision as well, the failure to disclose this information with sufficient clarity was treated as a separate ground of violation.
Requests for confirmation of account deactivation likewise constitute an exercise of data subject rights under Article 11 of the DPL and must be answered within thirty days at the latest under Articles 13 and 14. Merely invoking an ongoing dispute and leaving such requests entirely unanswered would not be accepted under the DPL either.
The Board's decision no. 2023/1321 of 3 August 2023 illustrates a similar risk: although the email address used by a former shareholder had been rendered inactive, incoming messages continued to be viewed by the company. The Board found that this amounted to continued processing after the individual's departure without reliance on any of the grounds under Article 5 of the DPL, and imposed an administrative fine of TRY 50,000, instructing that the system be corrected and the data destroyed. Together with the Piaggio decision, this decision reinforces the need to close the email addresses of former employees or shareholders.
The Board's decision no. 2021/1187 of 25 November 2021 shows that a lack of notice can, on its own, constitute a ground of violation. The employer had accessed a former employee's corporate email account without providing any notice under Article 10 of the DPL regarding the account's potential monitoring. The company's defence that the employee could have known this and that the data should be deemed "made public" was rejected. Citing the Constitutional Court's decision of 12 January 2021 and the ECtHR's judgment in Bărbulescu v. Romania, the Board emphasised the need for a fair balance between the employee's private life and the employer's legitimate interests, and imposed an administrative fine of TRY 250,000. This decision, too, aligns with the Piaggio decision in showing that employer access can only be based on notice given clearly in advance.
Conclusion
Read together, the Piaggio decision and the Board's decisions nos. 2023/1321 and 2021/1187 show that the use of corporate email systems for workplace monitoring is subject to strict limits under both Italian practice and the general principles of the Turkish DPL. The common conclusion under both legal systems is that corporate email is not merely a work tool but an area protected by the employee's freedom of correspondence and expectation of privacy; accordingly, employer access to that area must be exceptional, reasoned, and limited.
It is therefore of considerable importance that data controllers set retention periods for email and log data proportionate to their purpose, avoid systematic and indefinite backup practices, and limit access to employee emails to cases of concrete and current suspicion and to data arising after the suspicion emerged. In addition, privacy notices should be updated to clearly set out the purpose, legal basis, and retention period applicable to the processing of corporate email, and employees should be informed in advance that their account may be monitored by the employer, since a lack of notice can, on its own, give rise to a separate administrative fine. Finally, data controllers should prioritise, as part of their compliance efforts, closing or deactivating without delay the email accounts of individuals who leave employment or a shareholding, refraining from forwarding messages received at those accounts to other persons, and responding within the statutory time limit to account-deactivation and other requests from data subjects.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
