Background
Opinion 12/2018 adopted on 25 September 2018 by the European Data Protection Board or “EDPB”, has recently been made public. The EDPB is the body that is mainly in charge of ensuring a uniform and consistent application of EU Regulation 679/2016 on the protection of natural persons with regard to the processing of personal data (”GDPR”) in all member States. The EDPB succeeded the previous “Working Party 29” or “WP29” and has broader powers and new duties.
As part of its work of aligning the various internal practices, in the last few months the Supervisory Authorities of the member States submitted to the EDPB their list of “types of data processing” which require a prior “data protection impact assessment” (DPIA) as a condition for legality of the processing.
The Italian case
The list submitted by the Italian Data Protection Authority defines six types of processing that require that a DPIA be conducted beforehand. Specifically, these are:(i) processing of biometric data; (ii) processing of genetic data; (iii) processing carried out using innovative technologies; (iv) monitoring of employees; (v) “further processing of personal data” and (vi) processing that refers to a “specific legal basis”.
The EDPB answered the Italian Data Protection Authority with its own observations, some of which were of a general nature while others were of a detailed “prescriptive” nature.
Specifically regarding the processing of biometric and genetic data or processing carried out using new technologies, the EDPB considers that this type of processing is not in and of itself able to create a clear risk to the rights and freedoms of the data subjects. In its opinion, for a DPIA to be required, the presence of at least one more of the nine cases listed in the “Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679” adopted by Working Party 29 and commonly referred to as the WP248 guidelines (e.g.: processing that enables judgement of an individual based on profiling; systematic monitoring; matching of various data sets) is necessary.
On the other hand, the EDPB agrees with the Italian Data Protection Authority when the latter claims that systematic monitoring of individuals that are in and of themselves vulnerable, such as employees, constitutes processing that requires a DPIA.
Prospects
In conclusion, it will be interesting to see how the Italian Data Protection Authority will proceed: if it decides not to follow the “prescriptions” provided by the EDPB, Italy could be the first to be involved in a new dispute resolution mechanism by the Board, with the so-called “consistency mechanism” pursuant to Articles 63, 64 and 65 of the GDPR.
On 19 September Legislative Decree No. 101/2018 entered into force (the “Decree”), laying down provisions to align the national regulatory framework to European Regulation 679/2016 on personal data protection (“GDPR”).
The Decree gives the Data Protection Authority (the “Authority”) broad powers as well as significant duties, such as the review of some codes of professional conduct and the issuing of specific guidelines that promote simplified “privacy compliance” methods for micro, small and medium-sized enterprises.
Moreover, the decree includes a series of provisions that specify certain powers and duties that fall on the Data Controller and Data Processor. Among them, they are allowed to hold roles and tasks assigned to personnel inside the company who pursuant to previous regulations could be defined – depending on the case – as data processors or persons in charge of data processing.
The Decree confirms the exception to the information obligation in the case of CVs voluntarily submitted by the data subjects to establish an employment relationship. It remains understood that the data subject shall be provided with suitable information note at the time of the first actual contact after submission of the CV. In addition, it is confirmed that consent to the processing of personal data contained in a CV is not required, as long as the processing takes place for contractual or pre-contractual purposes.
Furthermore, the Decree provides for cases of limitation of the rights granted to the data subjects when – if they are exercised – among other things actual and material damage may derive (i) to the interests protected on the basis of anti-money laundering regulations and (ii) to the confidentiality of the whistle-blower notifying an offence of which he/she may have become aware as part of his/her role.
The GDPR allows the member States to define, without prejudice to the administrative fines established, additional penalties “as long as they are effective, proportionate and dissuasive” as well as “capable of ensuring the application of the Regulation”. The Decree confirmed also some specific offences included in the previous regulations. These include the unlawful processing of personal data, which now envisages only a slight reduction in the maximum penalty from 24 months to 18 months, or the breach of the regulations on the matter of remote monitoring and surveys on the opinion of employees.
With judgement dated 15 October 2018, No. 25711, the Court of Cassation provided again its opinion on what are the requirements (and to which magnitude they are relevant) for a work relationship qualified as independent to be reclassified as employment relationship.
The ruling originated from an appeal filed at the Court of Milan by eight service providers that requested the verification of the illegitimate nature of various types of agreements (for example, contractor agreement, project-based agreement) that followed each other over time with the same employer and, thus, the verification of the existence of an employment relationship associated with them.
Both judgements rejected the claims of the workers, since the Single Judge first then the Court of Appeal deemed legitimate the agreements entered into between the parties and, above all, insufficient the elements brought forth to support the claims of the workers to demonstrate the existence of an employment relationship between the parties.
One of the losing parties appealed at the Court of Cassation, claiming a breach and false application of the law by the judges in charge, since they did not deem proven the employment relationship while at the presence of several factors indicating subordination, among which: compliance with working hours, methods of calculation and payment of the salaries, lack of entrepreneurial risk for the providers, method of control of the business performance.
In this sense, the Court of Cassation specified how these claims could not be accepted and how they were unfounded.
In fact, the Court of Cassation judges, confirmed how they could not perform a new review and how it is up to the judge in charge to assess whether the elements and the facts provided are suitable to the type of agreement chosen by the parties when the employment relationship is established.
At the same time, however, they underlined, based on a unanimous and consolidated opinion, that the type of agreement (that is the “nomen juris”) ‹‹adopted by the parties entering the agreement, without any absolute and critical nature, cannot be fully ignored and may be considered an ancillary aspect to consider when it is difficult to distinguish between independence and discrimination››.
Click here to continue reading the note to the judgment published in Il Quotidiano del Lavoro of Il Sole 24 Ore.
With a lawsuit filed at the Court of Rome, a worker claimed of having provided his work under employment conditions for two specific time periods for a company providing design, implementation and production of TV programs, as part of a broadcast and to have been dismissed verbally. Specifically, the appellant claimed (i) of having written the questions to be submitted to the TV program’s guests, (ii) of having participated to the TV program as part of the audience, (iii) of having received during the employment relationship orders, directives and instructions from the company’s representatives, (iv) of having worked within pre-established work hours, of having requested authorisation in the case of absence, (v) of having been subjected to two disciplinary actions; (vi) of having received a fixed and pre-established compensation in both periods and to have used tools and instruments owned by the company to carry out his work activity.
The worker sued also, alternatively, the company casting extras thus requesting to the judge:
– the verification and statement of the employment relationship with all legal consequences from a salary and social security contribution stand point;
– payment of damage suffered due to exploitation of his image;
– the ineffectiveness of the verbal dismissal ordered with consequent right to be reintegrated at work and any further legal consequence.
The Court rejected the claims of the appellant, ordering him to pay the legal costs.
After the first instance ruling, the worker filed an appeal based on the following:
1.failure to verify the existence of employment relationship pursuant to art. 61 of Legislative Decree No. 276/2003;
2. failure to provide a reason on the existence of employment relationship pursuant to art. 61 of Legislative Decree No. 276/2003;
3. breach of articles 115 and 116 of the Italian Code of Civil Procedure;
4. Failure to review the various claims filed.
The Court of Appeal having jurisdiction (Court of Appeal of Rome, Labour Division, Judgement 3.4.2018) deemed as unfounded the first and the second reason, considering them together due to their logical association. According to the Court of Appeal, in fact, the company casting the audience and extras in their defence brief highlighted the occasional nature of the performance carried out by the appellant specifying that the audience and extras were called to participate to TV programs from time to time, organised respecting their personal commitments, and thus there was no pre-established and agreed schedule for their presence. The worker, instead, did not specify, even if he had the burden of proof, that an agreement existed with one of the defendant companies that would govern and guarantee the carrying out of the activities for a specific number of days per month. Therefore, in the opinion of the local Court, the requirement of continuity of work performance was not met.
Moreover, in the opinion of the Court, the worker did not object, in his appeal, to the aspects of the first instance ruling that disputed the subordinate nature of the employment relationship Instead he simply reported literally the legal claims detailed in the first instance appeal. For said reasons, according to the Court, it was not even possible to accept the reason of the appeal related to the employment nature of the business relationship.
Finally, the Court did not even accept the reason of the appeal related to the request for payment of damage that was suffered due to exploitation of his image, considering that the appellant himself had implicitly agreed to the publication of the image by participating to the recording of the TV program “solely destined to be broadcast”.
Click here to continue reading the note to the judgment published in Il Quotidiano del Lavoro of Il Sole 24 Ore.
The 2018 Budget Law (Law no. 205 dated 27 December 2017) introduced in the “Code of equal opportunities for men and women” (Legislative Decree 198/2006) new protections against discrimination due to harassment, including sexual harassment, in the workplace. In particular, the Italian legislator – having taken into consideration the widespread occurrence of such conduct – wished to protect the employees who, in practical terms, are in the process of filing a complaint against said conduct and, therefore, are taking action in Court. On this issue, the budget law expressly establishes that the employee who is acting in court to file for discrimination based on harassment or sexual harassment, may not be penalized, demoted, dismissed, transferred or subjected to any other organizational measure that has a direct or indirect negative effect on his/her work conditions, as determined by the claim. Therefore, any retaliatory or discriminatory dismissal of the reporting party, as well as any change of duties ordered against him/her for said reasons shall be deemed null and void. In light of the above, all employers must establish an adequate preventive and penalty system capable of preventing such criminal phenomena. This can be achieved by using appropriate protocols within the 231 models.
