Italy’s Privacy Watchdog Orders Amazon to Stop Recording Workers’ Health & Union Data

Key Takeaways

• Immediate Processing Ban: Italy’s Data Protection Authority ordered Amazon Italia Logistica to stop processing sensitive personal data relating to more than 1,800 employees at its Passo Corese site.
• Special Category Data Collected: The company recorded health conditions, trade union participation, strike activity, and detailed family circumstances in an internal platform linked to attendance tracking.
• Extended Retention Periods: The data was stored throughout employment and retained for up to ten years after workers left the company.
• Workplace Surveillance Concerns: The Authority also ordered Amazon to stop processing data from four cameras installed near bathrooms and staff break areas.
• Wider National Scope: The prohibition extends to other Italian logistics centers if the same internal platform was used in a similar manner.

Deep Dive

Italy’s data protection authority has ordered Amazon to immediately stop processing sensitive personal data relating to more than 1,800 employees at its Passo Corese logistics hub, after finding the company had systematically recorded highly personal information about workers for years.

The ruling follows inspections carried out between 9 and 12 February 2026 at the site, conducted in cooperation with the National Labour Inspectorate and the Special Technological Fraud and Privacy Protection Unit of Italy’s Financial Police.

At the center of the case is an internal platform linked to Amazon’s attendance tracking system. According to the Authority, managers used the system to log information gathered during interviews with employees returning from periods of absence. What was recorded went far beyond routine HR administration.

Entries included details about medical conditions such as Crohn’s disease, herniated discs and pacemaker implants. The system also documented participation in strikes and trade union activities. In some cases, notes referenced alleged misuse of leave.

The Authority said the records extended into workers’ private lives, capturing deeply personal matters such as a terminally ill parent, a sibling with brain cancer or marital separation. The data was reportedly stored throughout employment and retained for up to ten years after an employee left the company.

Under Italian law, employers are prohibited from processing data that are not relevant to assessing an employee’s professional aptitude. The Authority concluded that the practices at the Passo Corese site breached those limits.

The order requires Amazon Italia Logistica to stop processing the sensitive data of the affected employees immediately. It also prohibits the company from processing data unlawfully collected through the same platform at other logistics centres in Italy, should the system be used in a similar way elsewhere.

Separately, the Authority ordered Amazon to cease processing data gathered from four surveillance cameras installed near bathrooms and staff break areas at the site.

The investigation is not over. The Authority said it is continuing to examine whether additional infringements may have occurred.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.