{"id":25617,"date":"2025-07-03T15:52:41","date_gmt":"2025-07-03T13:52:41","guid":{"rendered":"https:\/\/www.delucapartners.it\/news\/e-mail-aziendale-e-navigazione-internet-il-garante-privacy-emette-la-prima-sanzione-per-conservazione-illegittima-dei-metadati-delle-mail-aziendali-e-dei-log-di-navigazione-2\/"},"modified":"2026-07-30T10:41:37","modified_gmt":"2026-07-30T08:41:37","slug":"e-mail-aziendale-e-navigazione-internet-il-garante-privacy-emette-la-prima-sanzione-per-conservazione-illegittima-dei-metadati-delle-mail-aziendali-e-dei-log-di-navigazione","status":"publish","type":"post","link":"https:\/\/www.delucapartners.it\/en\/news\/first-fine-for-unlawful-retention-of-corporate-e-mail-metadata-and-internet-logs-by-italian-data-protection-authority\/","title":{"rendered":"First fine for unlawful retention of corporate e-mail metadata and internet logs by Italian Data Protection Authority"},"content":{"rendered":"\n

\u201cThe employer may collect employees\u2019 Internet browsing logs and email metadata only under specific conditions and safeguards. This was affirmed by the Italian Data Protection<\/a> Authority (<\/em>i.e. \u201cGarante Privacy\u201d) when imposing a \u20ac50,000 fine on the Lombardy Region<\/em>\u201d (Provision No. 243 of April 29, 2025).<\/p>\n\n\n\n

As stated on the Authority\u2019s official website, this ruling follows an inspection aimed at verifying the Region\u2019s compliance with privacy regulations concerning the processing of employee data. The measure comes almost a year after the publication of the guidance document titled \u201cPrograms and IT services for managing e-mail in the workplace and the processing of metadat<\/em>a\u201d (Provision No. 364 of June 6, 2024).<\/p>\n\n\n\n

Although this case specifically involved public administration, it is worth clarifying that all findings, observations, and clarifications issued by the Authority fully apply to private-sector data controllers as well.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Metadata and Internet browsing logs<\/strong><\/h2>\n\n\n\n

\u201cMetadata\u201d refers to information related to the sending, receiving, and routing of messages. This may include the sender\u2019s and recipient\u2019s email addresses<\/a>, IP addresses of the servers or clients involved in message routing, timestamps of sending, retransmission or receipt, message size, presence and size of any attachments, and, in certain cases depending on the email management system used, even the subject of the sent or received message.<\/p>\n\n\n\n

Browsing logs, on the other hand, allow tracking of activities during web navigation and contain data such as visited IP addresses, URLs of opened web pages, connection times and durations, type of device and browser used, as well as any downloads or uploads performed.<\/p>\n\n\n\n

The June 6, 2024, guidance clarifies that the maximum retention period for such data is 21 days. Any retention beyond this period is permissible only under specific conditions that justify the extension, and, in any case, one of the safeguards provided by Italian law under Article 4 of Law No. 300\/1970 (the Workers\u2019 Statute) must be satisfied: (i) an agreement with trade unions or, failing that, (ii) authorization from the local Labour Inspectorate.<\/p>\n\n\n\n

This is because all such information allows the employer to identify behavioral patterns, understand workers\u2019 relationships and habits, and infer elements such as performance and productivity. In other words, it may amount to indirect remote monitoring of employees\u2019 activities.<\/p>\n\n\n\n

Violations detected and sanctions imposed<\/strong><\/h2>\n\n\n\n

During the Authority\u2019s inspection, it emerged that the Region retained:<\/p>\n\n\n\n