In its order no. 25287 of 24 August 2022, the Court of Cassation ruled on monitoring carried out by the employer and confirmed the legal principles within which the employer may use a detective agency.
This case involved a worker dismissed because he was accused of leaving the workplace repeatedly during working hours, for activities unrelated to his job (the contract allowed a certain workplace and time flexibility). This came to light as part of a broader investigation concerning the violation of leave under Art. 33 of Law no. 104/92 by a colleague which involved the appellant who had been reprimanded several times.
While the investigation on the other employee was lawful, the surveillance carried out on the employee in question was outside the detective agency remit.
According to the Supreme Court, the external monitoring must be limited to the employee illicit acts that are not attributable exclusively to the breach of an employment contractual obligation. In other words, to operate legally, detective agencies must not monitor work performance. Under the law, work performance monitoring must be carried out directly by the employer and its employees using audio-visual equipment and other monitoring tools.
Please note that internal work performance monitoring must follow legal limits.
The key provision is Art. 4 of the Workers’ Statute (Law 300/1970). Under this provision, information collected through monitoring can be used for employment relationship purposes, including disciplinary. However, certain criteria and “guarantee procedures” must be followed for them to be lawful.
Adequate information must be provided to the worker on the methods used to carry out monitoring. If audio-visual equipment or other monitoring tools are used, information must be provided on tools use and monitoring methods.
Under the last paragraph of Article 4, for the collected information to be usable for employment relationship purposes, personal data protection legislation, i.e., Regulation (EU) 2016/679 and Legislative Decree 101/2018, must be followed.
This allows the company, employer and data controller under the data protection legislation, to use the information collected and avoid incurring a heavy GDPR penalty for unlawful personal data processing.
Other related insights:
