An access request lands in HR's inbox. The sender is a former employee facing a disciplinary matter, and he wants documents, including GPS data from his assigned vehicle. He never mentions the General Data Protection Regulation (GDPR). What happens next determines whether you have a routine file or a regulatory problem.
The Italian Data Protection Authority (the Garante) recently fined a Bologna security company EUR 39,000 over exactly this fact pattern. The total split into EUR 22,000 for failing to honor the right of access and EUR 17,000 for deficient information given to employees, under Articles 12, 13, and 15. This guide turns that decision into if/then logic your team can use at intake.
The Decision You Are Facing
When an employee asks for their data, you must decide quickly how to classify and answer the request. Three questions drive everything: Is this a Data Subject Access Request? Can you fully comply? And does your privacy notice support what you're about to disclose?
Get the first answer wrong and the rest is moot.
Key Factors That Affect Your Choice
Whether the request invokes the GDPR. It doesn't have to. The Garante made clear that an employee need not cite the regulation for a request to count as an exercise of the right of access. A message asking for "the documentation in my disciplinary file" is enough. Your intake process should screen for substance, not keywords.
The litigation context. The complainant wanted the documents to defend himself in disciplinary proceedings that ended in dismissal. Employers often treat these requests as adversarial and stall. That instinct is the trap. Motive doesn't change your Article 15 obligations.
Whether geolocation data is in scope. GPS data from a company vehicle is personal data because the vehicle's location can be indirectly linked to the employee driving it. If your fleet systems feed a disciplinary file, they belong in the search.
The state of your privacy notices. Article 13 requires you to tell employees what you process and why. Two failures appeared here: no appropriate information on GPS processing, and notices that referenced special categories of data (philosophical beliefs, sex life) the company didn't process.
Your timeline discipline. Article 12 governs how and when you respond, including when you refuse.
Path A: You Can Fully Comply
Choose this when you hold the data, no exemption applies, and the request is clear.
- If the request mentions disciplinary records, vehicles, or monitoring, then search HR files, fleet management and telematics platforms, and any system feeding the disciplinary process.
- If you locate GPS or location records tied to the employee's assigned vehicle, then include them. Don't argue the data is about the vehicle rather than the person.
- If you're responding, then do so within the Article 12 timeframe and in concise, intelligible language.
Path A is also where your Article 13 hygiene shows. Before you hand over location data, confirm employees were told it was collected. If they weren't, you've just documented your own notice failure. Fix the notice now, not after the response goes out.
Path B: You Will Not (or Cannot) Comply in Full
Choose this when a legitimate restriction applies, such as third-party rights in the documents, or you genuinely hold nothing responsive.
The Garante's finding is unambiguous on the procedural duty here. If you decide not to comply with a request, then you must inform the data subject of the reasons and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy. Silence is not a refusal; it's an Article 12 infringement. In the La Patria case, the complainant sent two requests and received no adequate answer.
Practical steps:
- Log the request on receipt, whatever its wording.
- Document the specific legal basis for each withheld item.
- Disclose everything that isn't covered by the restriction rather than withholding wholesale.
- Send a written refusal that names the reasons and both remedies.
Path C: The Request Exposes a Notice Gap
Choose this when you realize, mid-response, that your privacy notice doesn't match your processing.
This path often runs alongside A or B. Two mismatches appeared in this case, and they run in opposite directions:
- Under-disclosure: processing exists (GPS tracking) but the notice doesn't describe it adequately.
- Over-disclosure: the notice claims processing of special categories (philosophical beliefs, sex life) that doesn't occur.
Both are Article 13 problems. The second is easy to overlook because boilerplate feels safe. It isn't. A notice that asserts sensitive-data processing you don't perform misleads employees about what you hold and invites the question of why you'd ever need it.
If you find either mismatch, then run a short notice audit: inventory actual processing activities, compare each to the notice text, strike what isn't happening, and add what is. The Garante credited the company for doing precisely this during the proceedings, providing proper geolocation information and removing the incorrect special-category references. It didn't impose further corrective measures because the infringements had ceased. Remediation didn't erase the fine, but it clearly shaped the outcome.
Summary Matrix
| Situation | Path | Driving Requirement | Your First Action |
|---|---|---|---|
| Request is clear and data is held | A | Article 15; Article 12 timing | Search HR, fleet and telematics systems; disclose in full |
| Request invokes no regulation | A or B | Right of access applies regardless of wording | Treat as a Data Subject Access Request |
| Restriction applies to part or all | B | Article 12 duty to give reasons and remedies | Written refusal citing reasons, complaint and judicial options |
| GPS or monitoring data exists | A, plus C | Geolocation is personal data; Article 13 | Confirm employees were informed before disclosure |
| Notice text doesn't match processing | C | Article 13 accuracy and completeness | Audit notice against actual activities; correct both directions |
What to Do This Quarter
Train intake staff to recognize requests by substance. Add fleet and telematics systems to your data map. Review every employee-facing notice against real processing. If you wait for a complaint to do these things, you'll be doing them under a regulator's timeline, with a fine already on the table.
