The Italian Data Protection Authority, the Garante, has fined La Patria S.p.A. EUR 39,000 for failing to respond properly to a former employee's requests to access his own personal data. The case, published by the European Data Protection Board, carries a final decision date of 6 August 2026 and cites Articles 12, 13 and 15 of the GDPR.

La Patria S.p.A. is described in the decision as a security and technological security company. The irony of a security vendor being fined for not knowing where its own employee data was, or not wanting to say, has not gone unnoticed. It's also a useful reminder that selling security and practicing it remain two separate skills.

The investigation started with a complaint from a former employee. According to the EDPB summary, he had made two requests to access documentation tied to disciplinary proceedings against him. That documentation included data collected through a GPS system installed on the company vehicle assigned to him. He wanted the material in order to defend himself. The proceedings later ended in his dismissal, and the company never adequately answered either request.

The Garante found that the company had failed to respond adequately to the access requests. Two points from the decision matter well beyond Italy.

First, the DPA clarified that a data subject does not need to expressly cite the GDPR for a request to count as an exercise of the right of access. An employee asking HR for "the documents you are using against me" is making an Article 15 request, whether or not the words "Article 15" or "GDPR" appear anywhere in the email. Organizations that only trigger their subject access process when a request lands on a specific web form, with the magic words included, are running a process that does not match the law.

Second, where a controller decides not to comply with a request, it must inform the data subject of the reasons. Silence is not a lawful refusal. A controller can have legitimate grounds to limit or decline access, but it has to say so, and it has to explain why. The summary does not go further into what those grounds might be in this specific case.

The legal references listed are Article 12 (transparent information, communication and modalities for exercising data subject rights), Article 13 (information to be provided where personal data are collected from the data subject) and Article 15 (right of access by the data subject). The decision is recorded as an administrative fine under the keywords "Data subjects rights" and "Fines."

Several things are not covered by the published summary. It does not state whether the Garante examined the lawfulness of the GPS tracking itself, as opposed to the handling of the access requests. It does not describe any response or statement from La Patria, nor whether the company intends to appeal. It does not break down how the EUR 39,000 figure was calculated. Anyone looking for those details will need to wait for the full Italian decision or further reporting. The EDPB notice is available at edpb.europa.eu.

For identity and access teams this is less about privacy law and more about plumbing. Telematics data from a fleet vehicle is personal data about an identifiable employee, which means it belongs in the same inventory as HR records, badge logs and endpoint telemetry. If a DSAR team cannot find out which system holds the GPS trail for a given person, or who has the access to pull it, the organization cannot answer a request even when it wants to. That is an identity governance problem before it is a legal one.

It is also a positive story in one sense. EUR 39,000 is a cheap lesson compared with what a badly handled dismissal plus a regulator can cost, and the fix is well understood: know what you collect, know where it lives, and answer the person asking.

Practitioners should check three things this week. First, confirm that the subject access process accepts requests in plain language through HR, legal and line managers, not only through a GDPR branded form, because the Garante has now said plainly that the magic words are not required. Second, verify that vehicle telematics, GPS and similar monitoring systems are listed in the data inventory with a named owner, a retention setting and a documented path for extracting one employee's records. Third, make sure any decision to withhold data in a disciplinary context is written down with reasons and sent to the employee, because an unanswered request is now, on the record, a fineable one.