IL GARANTE PER LA PROTEZIONE DEI DATI PERSONALI — Myndoor S.r.l.

Decided by

IL GARANTE PER LA PROTEZIONE DEI DATI PERSONALI

Parties

IL GARANTE PER LA PROTEZIONE DEI DATI PERSONALI v. Myndoor S.r.l.

Decision date

May 14, 2026

Remedy

The Garante issued a formal warning under Article 58(2)(a) of the GDPR, instructing Myndoor S.r.l. to implement measures preventing any direct or indirect disclosure of employee stress or sentiment data to employers.

Appeal

Appeal status not stated

Key holdings

1. The Garante formally warned Myndoor S.r.l. that providing workplace sentiment analysis data to employers risks violating data protection rules and worker dignity protections.

   “i trattamenti previsti possono verosimilmente violare il quadro normativo in materia di protezione dei dati personali e tutela della dignità della persona che lavora” — TUTTO CIÒ PREMESSO IL GARANTE

2. Data relating to employees' emotional state and psychological stress constitutes non-pertinent workplace data under national privacy law, which employers are prohibited from accessing.

   “le informazioni riguardanti la sfera emotiva dei dipendenti, dunque il relativo stato di benessere o stress psicologico, costituiscono informazioni riconducibili all’ambito di applicazione dell’art. 113 del Codice” — 4. Il quadro normativo in materia di protezione dei dati personali e tutela della dignità dei lavoratori.

In plain English

The Italian Data Protection Authority initiated an ex officio investigation into Myndoor S.r.l., a company that developed an artificial intelligence plugin for Slack and Teams platforms. The plugin performs sentiment analysis on workplace messages to evaluate user stress levels and psychological well-being. Following media reports suggesting the plugin was used by public sector employers, the authority examined whether employee personal data was processed unlawfully. During the inquiry, Myndoor explained that it functions as the sole data controller for the service, analyzing message content strictly to return stress management recommendations to individual workers. Employers cannot access raw message data or individual psychological profiles. However, Myndoor offered employers aggregated weekly stress reports if at least 10 active users enabled the plugin. Myndoor had generated such a report for only one employer. The authority found that while no direct illegal transmission of identifiable data had occurred, transmitting aggregated stress reports still creates a risk of re-identification depending on workplace size. Furthermore, gathering employee emotional data and inferring emotions using artificial intelligence violates employee privacy limits and conflicts with rules restricting workplace emotion inference under the EU AI Act. Consequently, the Garante issued a formal warning requiring Myndoor to adopt safeguards ensuring no sentiment analysis data is made available to employers.