DLP Insights

Company emails: the limits of employer surveillance according to the Italian Supreme Court  (Norme & Tributi Plus Diritto de Il Sole 24 Ore, 27 February 2025 – Vittorio De Luca, Martina De Angeli)

Categories: DLP Insights, Publications, News | Tag: GDPR, cybersecurity

27 Feb 2025

The Italian Supreme Court, in its decision no. 807 of January 13, 2025, has once again addressed the legitimacy of employer monitoring of employees’ corporate email accounts. The Court reiterated that while an employer may access an employee’s company email, this action is only lawful if there is a well-founded suspicion of illegal conduct. Information gathered before such a suspicion arises cannot be used for disciplinary purposes. 

In the case at hand, the company had dismissed a manager based on information obtained from an email log check, which was conducted prior to an alert from the company’s system that triggered the suspicion of misconduct. The Court of Appeal had already ruled that the information collected prior to the “employer’s suspicion” could not be used as evidence to support the dismissal, and that only the manager’s statements should be considered as the sole source of evidence. 

This ruling raises important considerations regarding the limits of employer control, particularly in a technological context where surveillance capabilities have expanded. It is crucial to clearly define the boundaries within which monitoring activities and the data collected can be considered lawful and compliant with current regulations. Indeed, any monitoring activity must be proportionate, transparent, and clearly justified, ensuring that employees are informed about the scope and purpose of such surveillance. 

Continue reading the full version published in Norme & Tributi Plus Diritto of Il Sole 24 Ore.

More insights