The Italian data protection authority (Garante) sanctioned a company for opening a former employee's personal locker in their absence and destroying its contents, considering that personal items constitute personal data and that their handling constitutes processing subject to the GDPR.

Facts and context

The Italian data protection authority (Garante) today published a sanction decision against Cosmint S.p.A., including a fine of €6,600, for breaches related to opening a former employee's personal locker and destroying its contents.

The case originated from a complaint by a former temporary contract employee who accused the company of opening his locker in his absence after the end of his contract.

Reasons for the decision

The authority first rejected the company's argument that the GDPR would not apply. It considered that the items contained in a locker (clothing, hygiene products, etc.) constitute information relating to an identified natural person and thus fall under the definition of "personal data" in Article 4(1) of the GDPR. Similarly, the operations of opening, inspecting, video recording, and destruction constitute "processing" within the meaning of Article 4(2) of the GDPR. The authority relied on the case law of the Court of Justice of the European Union (cases C-740/22, C-175/20, C-579/21, C-25/17) to adopt a broad interpretation of these notions. On the merits, the following breaches were found:

• Lawfulness of processing obligation (Article 6 of the GDPR): The processing was carried out without a valid legal basis. The authority dismissed the legitimate interest invoked by the company (need to free the locker for a new employee), considering the processing unnecessary. Indeed, the company opened the locker the day before a scheduled meeting with the complainant to empty the locker. The authority recalled that the controller must verify whether its legitimate interest can be achieved by less detrimental means to the rights of the data subject, who could not reasonably expect such action.
• Obligation of fairness, transparency, and data minimization (Article 5(1)(a) and (c) of the GDPR): The company acted unfairly by opening the locker without prior notice to the employee and destroying his personal effects. This action was deemed disproportionate to the pursued objective, causing unjustified harm to the complainant's privacy and dignity. The destruction of belongings, some of which were of "strictly personal/intimate" use, was neither necessary nor proportionate.
• Information obligation (Article 13 of the GDPR): The company had no internal policy nor provided any written information to employees on locker usage rules and procedures applicable at the end of the employment contract. The oral instructions mentioned by the company were deemed insufficient to meet the transparency requirement, especially in a context of high staff turnover.
• Cooperation obligation with the supervisory authority (Article 157 of the Italian Data Protection Code): The company did not respond to the authority's first request for information, constituting a separate violation of its cooperation obligations.

Authority's decision

Consequently, the authority imposed a fine of €6,600 on Cosmint S.p.A.

Furthermore, the authority ordered the publication of its decision on its website.

Lessons learned

This decision confirms / specifies / recalls that:

• Items contained in a personal locker (clothing, hygiene products, medicines) may reveal information about an identified natural person and must be considered personal data under the GDPR.
• Opening a locker, inspecting its contents, video recording, and destruction constitute personal data processing operations subject to GDPR rules.
• The use of lockers provided to employees must be governed by a clear internal policy communicated in advance, specifying usage rules and procedures applicable upon termination of the employment contract.
• A company's legitimate interest in freeing a locker for a new employee cannot justify forced opening in the employee's absence if less intrusive alternatives, such as respecting a scheduled appointment, are possible.
• The immediate destruction of a former employee's personal effects is a disproportionate measure that harms their dignity and privacy.