From 1 October 2024, businesses and self-employed workers operating on temporary or mobile construction sites, as defined by the Consolidated Safety Act (specifically, Article 89, paragraph 1, letter a), of Italian Legislative Decree no. 81/2008), are required to have a licence, in digital format, issued by the competent local office of the Italian National Labour Inspectorate.
This requirement was recently introduced by Article 29, paragraph 19, letter a), of Italian Decree Law of 2 March 2024, no. 19, not yet converted into law, which, replacing Article 27, paragraph 1) of the Consolidated Safety Act, introduces a credits accreditation system for businesses, and self-employed workers. The licence will be issued subject to satisfying the requirements specifically identified by the law, namely: (i) registration with the Chamber of commerce; (ii) compliance with the training obligations provided for in Article 37 of the Consolidated Safety Act applicable to company employers, executives, managers and workers; (iii) compliance by self-employed workers with the training obligations; (iv) holding a valid Certificate of Contributions Compliance (Documento Unico di Regolarità Contributiva, ‘DURC’); (v) holding a Risk Assessment Document or (vi) holding a Certificate of Tax Compliance Documento unico di regolarità fiscale (DURF).
Pending the issuance of a licence, unless otherwise notified by the Inspectorate, businesses and self-employed workers will still be able to operate within construction sites.
The new system provides for an initial balance of 30 credits and a minimum of 15 credits. If the score falls below the minimum threshold, subject to exceptions, it is not possible to operate on temporary or mobile construction sites. The accreditation system provides for credit reductions in the face of certain events, assessments or measures issued against company employers, executives, managers or the self-employed worker. Without prejudice to this, it is also provided that reduced credits can be reinstated.
Verification of the holding of the licence is delegated to the principal or to the works manager. Carrying on work in the absence of a licence or while holding a licence with a score lower than the minimum gives rise to an administrative fine of up to EUR 12,000 and exclusion from participation in public works for a period of six months.
◊◊◊◊
Prior to 1 October 2024, and considering that there may be amendments to the decree before it is converted into law, companies and self-employed workers who are subject to the new obligations must take steps as to ensure compliance with the provisions of the new accreditation system.
Other related insights:
With order no. 642 of 21 December 2023 entitled “Computer programs and services for the management of e-mail in the workplace and metadata processing”, the Italian Data Protection Authority (‘DPA’) has provided guidelines for public and private employers on the use of computer programs and services for corporate e-mail management.
The document was issued following investigations carried out by the Italian DPA during which it emerged that there was a risk that computer programmes and services for e-mail management, marketed by providers in cloud or as-a-service mode, could collect by default, in a pre-determined and generalised manner, metadata relating to the use of e-mail accounts in use by employees, retaining them for an extended period of time. “Metadata” means information such as, for example, the day, time, sender, recipient, subject and size of the e-mail.
To ensure compliance with data protection legislation as well as the sector regulations on remote control – as is well known, governed by Article 4 of Italian Law no. 300/1970 (the “Workers’ Charter”), employers must:
In other words, if, to meet organisational and production needs, the protection of company assets and occupational safety, the retention of data cannot be limited to the periods indicated by the DPA, employers will have to sign a trade union agreement or obtain an authorisation from the Labour Inspectorate.
In the absence of this, there is considered to be remote control of worker’s activities which may also have criminal consequences, in addition to breach of the personal data protection legislation with the following consequences; (i) the unlawfulness of the processing of personal data, (ii) the breach of the principle of limitation of retention, and (iii) breach of the principles of data protection by design and by default as well as the principle of accountability.
In any event, it should be noted that, pending the completion of the guarantee procedures, the metadata must not be used.
Other related insights:
Among the topics we explored at our Team Meeting this week was the area of employer checks carried out through investigative agencies, analysing Court of Cassation judgment of 11 October 2023, no. 28378. In that case a dismissal based on evidence collected by a private investigator who had not been indicated by name in the appointment document was declared null and void.
If you would like to learn more about this topic, contact us or request our slides here.
With Ruling of 14 September 2023, the Italian Data Protection Authority (Garante per la protezione dei dati personali, ‘DPA’) found that the processing of data carried out by a company appointed to read gas, electricity and water meters (the ‘Company’) was unlawful, confirming that the employer has an obligation to provide a full response to requests to exercise the right of access, including by communicating geolocation data.
The case arose from a complaint submitted to the DPA by three Company employees who had not received a satisfactory response to a request for access to their personal data collected through the company’s smartphone, on which a geolocation system had been installed that allowed workers to identify the route to take to reach the meters to be dealt with.
In particular, the employees asked for the information used to process mileage reimbursements and the monthly hourly wage, as well as the procedure for establishing the remuneration due to verify the accuracy of their pay slip.
The DPA, during the preliminary investigation, found that the Company had not provided an adequate response to the three workers’ request, despite the fact that the request was clear and detailed. In fact, it had not provided the employees with the data processed through the GPS system, but had limited itself to indicating the methods and purposes for which they were processed and to providing the privacy policy already signed by the concerned workers.
At the outcome of the preliminary investigation, the DPA found that the Company, in its capacity as Controller, carried out the processing in breach of:
The Company should have provided all the data collected through the geolocation system, responding to the specific requests received from the three complainants;
At the outcome of the preliminary investigation, the DPA clarified that, since the Company processed, among other things, data relating to the geolocation of smartphones provided to employees for the performance of their work, such processing “indirectly provided the geolocation of the complainants themselves”: for this reason, the Company should have provided a complete and exhaustive response to the requests to exercise the right of access, indicating, in particular, the data relating to the employees’ geolocation or explaining the reasons for any failure to comply with the requests received.
In light of all the above, the DPA fined the Company EUR 20,000, and also ordered the publication of the Ruling on its website.
Other related insights:
With Ruling dated 6 July 2023, the Italian Data Protection Authority (Garante per la protezione dei dati personali, ‘DPA’) found that data processing carried out by a public utility service company (the “Company”) was unlawful. The DPA ruled that an employer has an obligation to allow a worker to access all his or her personal data, including data contained in a report produced by an investigative agency appointed by the employer to collect information about the worker and used by the Company for disciplinary purposes.
The facts
The matter originates from a complaint submitted to the DPA by an employee who did not receive a full response to multiple requests for access to his personal data submitted to the employer Company after receiving a disciplinary complaint. The disciplinary complaint was followed by the dismissal of the worker, and contained “specific references” to conduct unrelated to the actual work activity and which therefore suggested potential monitoring “contrary to the regulations in force (condotta non iure) and detrimental to the personal legal status of others protected by law (condotta contra ius) and, consequently leading to data collected being unusable”.
The Company justified the denial of access to the personal data processed by arguing that the requests presented by the worker were too general and that he should have indicated in detail the information he wanted to access.
Furthermore, it emerged that the employee only learned of the existence and content of the investigative report when the Company entered an appearance in the proceedings appealing the dismissal before the competent judicial authorities.
The outcome of the preliminary investigation
At the time of the investigation, the DPA found that the Company, in its capacity as data Controller, carried out processing in breach of:
In this case, the Company should have provided all the data collected with the investigative report, considering that it also contained information relating to the worker but which had not been mentioned in the disciplinary complaint;
The DPA’s decision
For all the reasons set out above, the DPA found the processing carried out by the Company in relation to Articles 5, paragraph 1, letter (a), 12 and 15 of the GDPR to be unlawful. It reiterated that “unless otherwise explicitly requested by the data subject, the request to exercise the right of access is understood in general terms, including all personal data concerning them”. The DPA therefore, ordered the employer Company to pay an administrative fine of EUR 10,000 and also ordered the publication of the Ruling on its website.
Other related insights:
