The ITA Court of Cassation, in Order No. 3462 of February 16, 2026 (Pres. Acierno, Rel. Tricomi), clarified a key aspect of the Privacy Code in the version in force prior to the GDPR (Legislative Decree 196/2003).

The obligation to notify the Data Protection Authority, provided for in Article 37, paragraph 1, letter a), applies to geolocation systems installed on company vehicles even when GPS data is not automatically linked to the employee’s name. It is sufficient that the employer be able to indirectly identify the employee through logical deductions based on ancillary elements, such as the assignment of a specific vehicle or tachograph data.

The trial court had deemed “automatic identification via codes” necessary; the Supreme Court, however, clarified that, for the purposes of the notification obligation, what matters is the concrete risk of indirect profiling, since even such a scenario constitutes the processing of personal data and requires compliance with the obligations set forth in the Privacy Code.