Application of the GDPR in the Context of a Business Transaction: Exchange of Employees’ Personal Data and the Right of Access
In this article, we analyze a case decided by the Italian data protection authority (“Garante”), concerning the processing and transfer of employees’ personal data between the Italian airlines Alitalia and ITA Airways. The proceedings arose from a 2021 business transaction involving the transfer of certain assets between the two companies, without a simultaneous transfer of employees. This particular circumstance raised the issue of the lawfulness of the further processing and sharing of employees’ personal data between the two companies. Factual Background In 2021, Alitalia entered insolvency proceedings during which it sold part of its assets to ITA Airways, which had...