The cost of watching your employees

The Italian regulator, Garante, just handed Piaggio a €460,000 fine. That's just under half a million euros because they decided to snoop on employee emails without a legal leg to stand on.

Most firms make the same mistake here. They point to an employee handbook that says "company equipment is for business use" and assume that's a get-out-of-jail-free card. I've seen plenty of these programmes described as 'mature'. Whenever I hear that word, I start looking for where the bodies are buried.

A policy isn't a control; it's an intention.

When I’m auditing a monitoring setup, I ignore the handbook. Instead, I ask: what would you show the assessor on a Tuesday? If you can't produce a time-stamped log showing exactly who accessed a mailbox, why they did it, and which specific legal justification was invoked for that individual instance, you don't have a control. You have a hope.

The breakdown at Piaggio wasn't a lack of policy. It was a failure of proportionality. They treated employee privacy as a toggle switch—either on or off—rather than a sliding scale based on actual risk.

The correct control isn't a broader policy; it's a technical gate. You need a documented approval workflow where access to private communications requires a second-party sign-off and a recorded reason that survives legal scrutiny. The evidence should be a trail of tickets, not a PDF signed by the CEO three years ago.

Some will argue that this hampers agility. They'll say that in a crisis, an admin can't wait for a committee to approve an email search.

That's fine, provided you have a "break-glass" procedure. A break-glass account that triggers an immediate alert to the DPO and requires a post-facto justification within 24 hours is evidence. A vague 'administrative privilege' held by an IT manager who likes to keep tabs on the staff is a liability.

The fallout here isn't just the fine. The second-order effect hits the IT admins and the legal team. Once a regulator finds you've been overstepping, every single action those admins took over the last few years becomes suspect. It turns your internal IT department into a liability for the board.

Worse, it flags your firm to insurers. Cyber insurance isn't just about hackers; it's about regulatory risk. A fine of this size suggests a systemic failure in governance. Don't be surprised when the premiums jump or the coverage for 'regulatory fines' suddenly disappears from the renewal quote.

If you want to know if your own monitoring is legal, stop reading your policy and look at your logs. If those logs show a pattern of "general oversight" rather than specific, justified investigations, you're just waiting for your turn in the regulator's inbox.