ITA Supreme Court: Geolocation of Company Vehicles: Obligation to Notify the Data Protection Authority Even in Cases of Indirect Identification.
The ITA Court of Cassation, in Order No. 3462 of February 16, 2026 (Pres. Acierno, Rel. Tricomi), clarified a key aspect of the Privacy Code in the version in force prior to the GDPR (Legislative Decree 196/2003).
The obligation to notify the Data Protection Authority, provided for in Article 37, paragraph 1, letter a), applies to geolocation systems installed on company vehicles even when GPS data is not automatically linked to the employee’s name. It is sufficient that the employer be able to indirectly identify the employee through logical deductions based on ancillary elements, such as the assignment of a specific vehicle or tachograph data.
The trial court had deemed “automatic identification via codes” necessary; the Supreme Court, however, clarified that, for the purposes of the notification obligation, what matters is the concrete risk of indirect profiling, since even such a scenario constitutes the processing of personal data and requires compliance with the obligations set forth in the Privacy Code.
NIS2 and the supply chain
With NIS2, the security of the ICT supply chain ceases to be merely a technical issue and becomes a matter of governance, management accountability, and the organization’s overall resilience. The regulation requires risk management measures that explicitly include the supply chain and relationships with direct and indirect suppliers.
This aspect is directly linked to the GDPR: Article 28 requires the data controller to select only data processors that offer sufficient guarantees, while Article 32 requires technical and organizational measures appropriate to the risk. It follows that the management of ICT suppliers cannot be limited to standard contracts or merely formal due diligence, but requires a concrete assessment of the supplier’s criticality, operational dependencies, data processed, security measures adopted, use of subcontractors, incident response times, and audit rights.
Supply chain risk must be managed ex ante through the selection, classification, verification, and continuous monitoring of critical suppliers. Operationally, this involves structured due diligence, security questionnaires, the collection of documentary evidence, periodic audits, verification of subcontractors, and specific clauses regarding notifications, vulnerabilities, response times, and cooperation in the event of an incident. Added to this is the contractualization of risk: for ICT suppliers that impact relevant services or processing operations, generic clauses are insufficient; clear provisions are required regarding technical and organizational measures, incident reporting, recovery support, vulnerability management, traceability of subcontractors, and data return or deletion.
From a NIS2 perspective, these clauses govern supply chain risk; from a GDPR perspective, they provide concrete implementation of Articles 28 and 32, since the security of the supply chain depends on defined, verifiable, and effectively enforceable obligations.
The appointment of a DPO is a mandatory requirement.
By Order No. 68 of February 12, 2026, the Data Protection Authority imposed a fine of 3,000 euros on the Municipality of Aversa for violating the obligations set forth in Article 37, paragraphs 1 and 7, of the GDPR, regarding the designation of the Data Protection Officer (DPO) and the communication of the DPO’s contact information to the Authority.
The ex officio investigation established that the entity had neither formally appointed the DPO nor published the relevant contact details on its official website. The defenses put forward by the Municipality—structural staff shortages, a financial restructuring process, and the timing of upcoming elections—were not deemed sufficient to justify the non-compliance, since the role of the DPO has been, since May 2018, a mandatory and non-negotiable component of public entities’ privacy governance.
Although the Municipality took steps to rectify the situation during the proceedings, the Data Protection Authority nevertheless deemed it necessary to impose the sanction and order the publication of the decision, emphasizing the deterrent function of the measure and reiterating that organizational difficulties do not exempt the data controller from complying with fundamental data protection obligations.
A university has been fined 50,000 euros for the unlawful processing of biometric data.
In a ruling dated January 29, 2026, the Italian Data Protection Authority fined a university 50,000 euros for unlawfully processing the biometric data of numerous participants in online teacher certification courses. The university used a facial recognition system to verify identity and attendance during classes, based on the creation of biometric models derived from students’ facial images and identification documents.
The Authority found that there was no suitable legal basis to justify the use of biometric technologies, which, as they pertain to special categories of data, require strict conditions and enhanced safeguards, especially given the availability of less invasive alternative solutions for attendance monitoring. It also emerged that a Data Protection Impact Assessment (DPIA) had not been conducted prior to the system’s activation, despite the very high number of data subjects involved—over 450 students per class.
During the investigation, the system remained partially in use, with corrective measures deemed inadequate, until its final deactivation. In determining the amount of the fine, the Data Protection Authority took into account, as a mitigating factor, the university’s cooperation and the voluntary cessation of processing.
EDPB and EDPS: Joint Opinion No. 2/2026 on the proposed Digital Omnibus Regulation.
On February 10, 2026, the EDPB and the EDPS adopted Joint Opinion No. 2/2026 on the proposed “Digital Omnibus” Regulation, through which the Commission aims to simplify and streamline the EU digital rules framework, including certain aspects of the GDPR. The Authorities support the goal of reducing complexity but reiterate a key point: simplification cannot come at the cost of weakening the concept of personal data or removing pseudonymized data that can still be traced back to natural persons from the scope of the GDPR. The Opinion welcomes measures that enhance harmonization and legal certainty—such as common templates for data breach notifications and DPIA—but raises concerns about changes that affect the core of fundamental rights. Simplification is not a compromise on protections, but a call to apply the GDPR in a more straightforward, informed, and demonstrable manner.
Robust compliance thus becomes a factor in reliability and decision-making speed in digital and AI projects, not merely a bureaucratic cost.
AI versus AE: lesson on the connection between AI and Authors and Editors according to the AI Act
Nicola Tilli will be addressed to have a lesson on the connection between Publishing sector and Artificial Intelligence
In Milan at University IULM on May 4th 2026 at Master of the professions oriented to literature, publishing, novelists, authors in general and linked arts
