With order no. 364 of 6 June 2024 called “Computer programs and services for the management of e-mail in the workplace and metadata processing”, the IDPA has returned to the topic of company e-mail metadata retention.
“Metadata” does not mean information contained in the “body” of the email but rather the information relating to the sending, receiving and sorting the messages. This may include the email addresses of the sender and of the recipient, the IP addresses of the servers or clients involved in the routing of the message, the times of sending, retransmission or reception, the size of the message, the presence and size of any attachments and, in certain cases, depending on the email management system used, may also include the subject of the message sent or received.
With respect to the IDPA’s guidelines before the public consultation, the guidelines of 6 June 2019 extended the retention period to 21 days.
This retention period is merely “indicative”.
Retention for longer is only permitted if specific conditions that make the extension necessary are satisfied and are adequately proven.
Applying the principle of accountability, it is therefore up to each employer to adopt all technical and organisational measures to ensure compliance with the principle of purpose limitation, selective accessibility by only authorised and adequately trained individuals and the tracking of access carried out.
These requirements must be met while keeping in mind that generalised metadata collection and retention can lead to indirect remote control of workers’ activities and, in this case, the safeguards provided for by Article 4 of the Workers’ Charter apply i.e., it is necessary to enter into a union agreement or, failing that, obtain authorisation from the National or Local Labour Inspectorate.
Please contact our Privacy Focus Team for further information.
Data has become the new oil and its role is likely to grow further as digital becomes more central to our lives. This has important implications for privacy, as Vittorio De Luca, founder of the law firm De Luca & Partners, points out. “the EU legislator has intervened significantly in this area over the last few years. However, at corporate level the position is divided into companies that have implemented and structured real internal compliance models and over time have managed to change the culture and sensitivity of all those who make up the organisation, while others continue to consider data protection as a company cost rather than an investment”, he points out.
Personal data protection legislation and employment law are now closely linked, not only with regard to the processing of human resources data. “Increasingly, we are assisting companies in how to correctly manage requests for access to documents and personal files that are – legitimately – submitted by employees as part of disciplinary proceedings against them”, he points out. “In addition to the consequences on the employment law front, a data subject (in this case, the worker) has always the right to make a report to the Italian Data Protection Authority”, explains Mr De Luca.
Continue reading the full version published in La Repubblica.
Other related insights:
The Italian Data Protection Authority (‘IDPA’), with a Ruling of 7 March 2024 [announced in the Newsletter of 3 May 2024] upheld a complaint filed by a worker who had asked her former employer company for access to her personal file to find out what information could have given rise to a disciplinary sanction against her.
The company had not given an adequate response to the request and had only provided an incomplete list of the documentation collected, omitting information which formed the basis of the disciplinary sanction which was then imposed. The omitted information was only provided to the worker after the start of the IDPA’s investigation.
In its note of reply, the company claimed that it had not provided the worker with the above-mentioned documentation in order to protect its right of defence in court as well as the confidentiality of the third parties involved. The company also alleged that the complainant lacked standing to access the information, since it had been requested at a time when the disciplinary proceedings could no longer be challenged.
The IDPA reiterated that the right of access recognised by Regulation (EU) 2016/679 (‘GDPR’) is intended to allow the data subject to exercise control over his or her personal data and to verify its accuracy. Consequently, this right cannot be denied or limited depending on the purpose of the request. In fact, according to the provisions of the GDPR, data subjects are not asked to indicate a reason or a particular need to justify their requests to exercise their rights, nor can the data controller verify the reasons for the request.
Therefore, access to personal data cannot be denied because the data requested could be used by the data subject to defend himself or herself in court in the event of dismissal.
“The jurisprudence has on several occasions reiterated that the right of access derives, in addition to the legislation on personal protection data, from the ‘respect for the principles of good faith and fairness incumbent on the parties to the employment relationship under Articles 1175 and 1375 of the Italian Civil Code. This is confirmed by the fact that, for some time, the relevant sector’s collective bargaining agreement has provided that the employer must keep, in a special personal file, all the deeds and documents produced by the entity or by the employee himself or herself, which relate to his or her professional development, the activity performed and the most significant facts concerning him or and that the employee has the right to freely view the deeds and documents included in his or her personal file’ (Italian Court of Cassation, 7 April 2016, no. 6775)”.
Based on the points set out above, the IDPA imposed a fine of EUR 20,000.00 on the company.
◊◊◊◊
Summary of the right of access:
Other related insights:
On Wednesday 24 April 2024, MEPs adopted the text of the new Directive on the working conditions of platform workers. As can be learned from the press release published on the Parliament’s institutional website, the Directive “aim[s] to ensure that platform workers have their employment status classified correctly and to correct bogus self-employment”by introducing “a presumption of an employment relationship (as opposed to self-employment) that is triggered when facts indicating control and direction are present, according to national law and collective agreements […]”.
Among the initiatives introduced by the Directive, as far as is of interest here, there are limitations on the processing of personal data carried out by means of automated monitoring or decision-making or systems. For example, the following may not be subject to any processing operation: (i) data on the emotional or psychological state of the person performing platform work; (ii) personal data in relation to private conversations; (iii) data belonging to the category of special data (former sensitive data) or biometric data or, again, (iv) the data of the worker who carries out activities through a digital platform may not be collected when he or she is not carrying out his or her activity through the platform itself.
These provisions will apply from the start of the recruitment and selection procedures and for the entire duration of the relationship. It is understood that, given the type of processing and the high risk to the rights and freedoms of natural persons, processing of personal data by a digital work platform will be subject to specific impact assessments under Article 35 of Regulation (EU) 2016/679. The impact assessments carried out by the employer will then have to be shared with the workers’ representatives.
Another key element is the transparency obligations. Persons who perform work through digital platforms will have to be promptly made aware, in a transparent, intelligible and easily accessible form using clear and plain language, about the categories of decisions that are taken or supported or by automated decision-making or monitoring systems. The Italian national legal system is already familiar with this aspect following the introduction of the provisions of Regulation (EU) 2016/679 and the adoption of the so-called “Transparency Decree”.
Finally, it is understood that Member States will have to ensure that digital work platforms guarantee sufficient human resources to effectively monitor and assess the impact of individual decisions taken or supported by automated decision-making or monitoring systems.
◊◊◊◊
Next steps
The text approved by the European Parliament will now also have to be formally adopted by the Council and then published in the Official Journal of the European Union. After publication, each Member State will have two years to incorporate the new provisions into its national law.
Other related insights:
From 1 October 2024, businesses and self-employed workers operating on temporary or mobile construction sites, as defined by the Consolidated Safety Act (specifically, Article 89, paragraph 1, letter a), of Italian Legislative Decree no. 81/2008), are required to have a licence, in digital format, issued by the competent local office of the Italian National Labour Inspectorate.
This requirement was recently introduced by Article 29, paragraph 19, letter a), of Italian Decree Law of 2 March 2024, no. 19, not yet converted into law, which, replacing Article 27, paragraph 1) of the Consolidated Safety Act, introduces a credits accreditation system for businesses, and self-employed workers. The licence will be issued subject to satisfying the requirements specifically identified by the law, namely: (i) registration with the Chamber of commerce; (ii) compliance with the training obligations provided for in Article 37 of the Consolidated Safety Act applicable to company employers, executives, managers and workers; (iii) compliance by self-employed workers with the training obligations; (iv) holding a valid Certificate of Contributions Compliance (Documento Unico di Regolarità Contributiva, ‘DURC’); (v) holding a Risk Assessment Document or (vi) holding a Certificate of Tax Compliance Documento unico di regolarità fiscale (DURF).
Pending the issuance of a licence, unless otherwise notified by the Inspectorate, businesses and self-employed workers will still be able to operate within construction sites.
The new system provides for an initial balance of 30 credits and a minimum of 15 credits. If the score falls below the minimum threshold, subject to exceptions, it is not possible to operate on temporary or mobile construction sites. The accreditation system provides for credit reductions in the face of certain events, assessments or measures issued against company employers, executives, managers or the self-employed worker. Without prejudice to this, it is also provided that reduced credits can be reinstated.
Verification of the holding of the licence is delegated to the principal or to the works manager. Carrying on work in the absence of a licence or while holding a licence with a score lower than the minimum gives rise to an administrative fine of up to EUR 12,000 and exclusion from participation in public works for a period of six months.
◊◊◊◊
Prior to 1 October 2024, and considering that there may be amendments to the decree before it is converted into law, companies and self-employed workers who are subject to the new obligations must take steps as to ensure compliance with the provisions of the new accreditation system.
Other related insights:
