Comune di Bolzano
- Country
- Italy
- Fine
- 84,000 EUR
- Date
- 2021-05-13
- Sector
- Public administration
- Articles
- Art. 5, par. 1, lett. a) and c)art. 9art. 13 andart. 35 of GDPR.
Failure to comply with data minimisation principles, with the obligation to provide sufficient information to the data subject, failure to provide an impact assessment.
The Italian DPA's investigations revealed that the Municipality had been using, for about ten years, a system for monitoring and filtering employees' internet browsing, storing this information for netwrok security purposes. Nevertheless, the system, implemented without adequately informing the employees, allowed processing operations that were unnecessary and disproportionate to the purpose of protecting and securing the internal network, carrying out a generalised collection of data relating to connections to websites visited by individual employees, including information related to the private life of the person concerned.