Italy's data protection authority, the Garante per la protezione dei dati personali, has fined a security company EUR 39,000 for violations concerning the processing of employees' personal data, according to the European Data Protection Board.
The case was reported through the EDPB's regular round-up of national enforcement decisions by EU data protection authorities. Details of the specific violations were not included in the summary, but the fine relates to how the company handled data belonging to its own workforce.
Employee monitoring and workplace data processing remain a recurring focus for data protection regulators across the EU, particularly where security or surveillance technologies are involved.
This enforcement action falls under the General Data Protection Regulation rather than the EU AI Act. However, it is a useful reminder for organisations deploying AI-enabled security or monitoring tools in the workplace that GDPR obligations around employee data continue to apply independently of, and alongside, AI-specific rules.
Security companies and other employers using AI systems to monitor staff, such as video analytics or access control tools, should treat this as a signal that regulators are actively scrutinising employee data processing practices.
As a compliance matter, organisations preparing for the EU AI Act should not lose sight of parallel GDPR obligations, particularly where AI systems used in the workplace qualify as high-risk under Annex III and also involve the processing of employees' personal data.