Italian Transportation Company Sanctioned for Installation of Geolocation System and Failing to Inform Employees

• An employee of an Italian transportation service filed a complaint against his employer for data violation
• The complaint noted that a satellite detection system was used on his tractors without his knowledge
• The company Autotrasporti Cuccu Riccardo srl was sanctioned for non-compliance and asked to pay a fine of 50,000 Euros

The Italian Data Protection Authority (DPA) addressed a complaint against the transportation company Autotrasporti Cuccu Riccardo Srl Unipersonale filed by an employee for violation of his data. 

The complaint read that the employee was not informed before installing a geolocation system on his vehicle. It was allegedly installed to monitor the performance of the employee’s work. This violated DPA article 13 of the regulation around the protection of personal data.

The employee filed a complaint against his employer on 23 September 2024. 

The employer argued that they were authorized by the ITL of Cagliari-Oristano to install a satellite system on company vehicles. This was to allow monitoring of company assets and ensuring safety at work and for production needs.

The vehicles were tractors with semi-trailers which remained under surveillance also during breaks. The recorded data in the system was processed in compliance with the EU regulations and was available for reference to the employees during their work hours.

All their personal data would be deleted upon the termination of service.

The Privacy and Technological Fraud Protection Unit of the Guardia di Finanza launched the sanctioning process against the company that did not respond to its requests for information sent to the company’s certified email address until 25 March 2022.

The unit also led investigations that concluded the company used WAY geolocation systems by the TIM operator since May 2021 for the protection of assets and workplace safety. They employed approximately 70 people out of whom 50 were drivers with each employee assigned the same tractor and all equipped with the WAY system.

The company had applied for authorization for the satellite location systems in March 2021. They argued that they had previously responded to the request for information received on 11 January 202 and hence did not address duplicate requests. They further clarified that all employees were aware of the surveillance system which was posted on a notice board. 

The location system tracked vehicles as needed and the data was accessible to the drivers during work hours. The system recorded the license plate number, driver’s name, and surname.

Investigations revealed that the data detected by the system would not match the driver but fetched the records of the employee who was assigned the tractor at the time of installation of the location tracking system.

When investigations were carried out against WAY to fully understand the information processing protocol followed by them, it was found that the data transmission was delayed by 3 to 5 minutes.

Authorities found that under Art. 13 of the GDPR regarding the processing of personal data via the geolocation service, the company did not ensure the system identified the driver accurately. It was also noted that the company did not make an adequate effort to inform the drivers about the data processing by placing it on a notice board. 

The method of processing data by the geolocation system was neither fully represented nor was it appropriate to monitor them during breaks per the aim of the surveillance system. 

The notice found the practices of the employer unlawful and also pointed out the lack of response to requests for information by the authorities.

The investigation concluded, “The processing was therefore carried out in a manner contrary to that provided for in the authorization provision and, therefore, is contrary to the principle of lawfulness of processing (art. 5, par. 1, letter a), of the Regulation) in relation to art. 114 of the Code and art. 88 of the Regulation."

To correct their mistakes, the company was ordered to prepare suitable information notices to fully represent how their data was processed via the geolocation system. They were also ordered to conform to the processing concerning limited data retention prescribed by the ITL of Cagliari Oristano. 

Finally, they were asked to pay a sum equal to 50,000 euros.