DATA PROTECTION | Italian Data Protection Authority issues first fine for unlawful e-mail metadata storage

On 29 April 2025 the Italian Data Protection Authority (DPA) issued a fine against the Lombardy Region for the unlawful data processing of email metadata and web logs of belonging to its employees.

This fine marks the first enforcement action under the DPA’s June 2024 guidance on metadata retention, according to which email metadata can be stored for no more than 21 days and only for technical or security purposes. The guidance affirms that any longer storage period requires specific agreement with trade unions, as extended storage may lead to indirect monitoring of employees, forbidden under Article 4(2) of Law No. 300 of 20 may 1970.

The DPA’s investigations revealed that the Lombardy Region was instead retaining email metadata for 90 days in absence of any trade unions agreements. The DPA confirmed that that such processing cannot be justified even for security-related purposes. It also stressed that the mere existence of internal safeguards or the fact that data is accessed only under specific security protocols is not sufficient to make such processing lawful.

Newsletter n. 108 – June 2025