Corporate GPS and dismissal: limits on evidence from defensive checks

1. The fact

   According to legal press reports, the case stems from the dismissal of a security guard accused of repeatedly abandoning his post. The company, prompted by reports, cross-referenced attendance records with data from the GPS system installed on the company car assigned to the employee, revealing prolonged stops at his private residence during working hours. The dispute reached the Supreme Court following conflicting lower court rulings regarding the admissibility of such evidence.\n\nThe employee challenged the dismissal, arguing that the monitoring violated the guarantees under the Workers' Statute by constituting covert and continuous performance surveillance. The company defended the check as a defensive control in the strict sense, aimed at protecting corporate assets and reputation. The Supreme Court's decision clarified whether the mere existence of suspected wrongdoing authorizes an employer to bypass privacy protections and union consultation procedures.

2. 

   The rules at play

   The relevant legal framework centers on Article 4 of Law No. 300/1970 (Workers' Statute), as amended by Legislative Decree No. 151/2015.

   1. Paragraph 1 provides that audiovisual systems and other tools capable of remote employee monitoring may be used exclusively for organizational, production, workplace safety, or asset protection needs, subject to union agreement or authorization from the Labor Inspectorate.
   2. Paragraph 3 conditions the usability of collected data for employment-related purposes, including disciplinary actions, on providing the employee with adequate information regarding the methods of tool usage and control execution, in compliance with Regulation (EU) 2016/679 (GDPR).
   3. Finally, Article 2119 of the Italian Civil Code governs dismissal for cause, requiring a breach so severe that it prevents the continuation of employment, even on a provisional basis; however, its application depends on the lawfulness of the evidence obtained.

3. What the case law says

   Case law establishes a clear distinction between defensive checks aimed at protecting corporate assets and the monitoring of work performance. According to settled precedent, defensive checks are permissible even without union agreement or administrative authorization if activated ex post, following grounded suspicion that an employee has committed a wrongful act. However, the courts have specified that this power is not unrestricted: asset protection needs can never justify covert monitoring of an employee's private or professional life without prior notice regarding the presence and operation of the tool.\n\nThe core principle is preventive transparency. The Supreme Court clarified that evidence becomes inadmissible if the employer failed to provide the notice required by privacy regulations and the Workers' Statute. Even in cases of serious misconduct, such as post abandonment, evidence obtained via GPS is inadmissible if the worker was unaware of potential verification methods, as privacy rights and worker dignity prevail over the employer's disciplinary interest unless mediated by compliance with notice procedures.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Installing GPS devices on corporate vehicles must always be preceded by a union agreement or authorization from the Labor Inspectorate, specifying organizational or asset protection purposes.\n2. Employers must draft and deliver a detailed privacy notice to employees, explicitly setting out monitoring procedures and the potential use of data for disciplinary purposes.\n3. Defensive checks in the strict sense may only be initiated upon specific, substantiated suspicions of wrongdoing, and must never evolve into systematic or preventive monitoring of the workforce.\n4. Before issuing a disciplinary charge based on technological findings, practitioners must verify data chain of custody and ensure company policies fully comply with GDPR requirements.

References: Articolo 4 Legge 300/1970Articolo 2119 Codice CivileRegolamento UE 2016/679 (GDPR)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 25 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction