In Provision No. 288 of May 21, 2025, the Italian Data Protection Authority fined an Italian company €420,000 for unlawful processing of an employee’s personal data later used to justify her dismissal.
The employee filed a complaint against the company, alleging improper use of her personal data extracted from her “Facebook” profile, the “Messenger” app, and certain chats from the “WhatsApp” platform. These data, made known to the company, were used to support two separate disciplinary notices.
In the first notice, dated February 16, 2024, the company quoted the contents of some comments made by the complainant on her Facebook profile, including quoted excerpts and descriptions of certain photos. In the second notice, dated March 21, 2024, it referred to a conversation on Messenger between the complainant and a third party (not employed by the company) who forwarded the conversation to the company via WhatsApp, including quoted excerpts. This second notice also included excerpts from a WhatsApp message the complainant sent to some colleagues on February 22, 2024.
Referring to Article 8 of Law No. 300/1970 (the Italian Workers’ Statute), which prohibits the employer from carrying out investigations – including via third parties – into an employee’s political, religious, or trade union opinions, as well as facts irrelevant to assessing the employee’s professional aptitude, the company claimed it had played no active role in collecting the data. It argued that the information had been reported to it and could therefore be used for disciplinary purposes, as this would not constitute a prohibited investigation under the Workers’ Statute.
The Italian Data Protection Authority used the occasion to recall that:
– The legal system protects the freedom and confidentiality of communications, recognized as fundamental rights, and any limitation is allowed only “by reasoned decision of the judicial authority, in accordance with the law” (Article 15 of the Constitution). This presumption of confidentiality, as clarified by the Constitutional Court, extends to all communication tools made available by technological evolution. (Lawfulness principle)
– The mere publication of data on publicly accessible platforms, such as social networks, does not imply that the data subject has given general consent for the free use of that data for any purpose. A specific legal basis is required for any processing other than the original purpose. (Purpose limitation principle)
– The need for data processing based on legitimate interest – the justification cited by the company in its defense – must also be evaluated under the principle of minimization. The data controller must verify that “the legitimate interest pursued cannot reasonably be achieved through less harmful means for the fundamental rights of data subjects, particularly their right to privacy”. In this case, the company failed to demonstrate that it had assessed the impact of the processing on the employee’s rights or considered less intrusive alternatives, even though the disciplinary measures could have been based on other elements. (Data minimization principle)
The Authority clarified that while it is not tasked with evaluating the disciplinary facts themselves, it is the employer – as the data controller – who must assess not only the lawfulness but also the adequacy, relevance, and proportionality of the data processing to be carried out. The Authority found numerous violations by the company, which, “once it became aware that the transmitted data concerned private communications and comments on a closed Facebook profile, […] should have refrained from using them.”
Other related insights:
Analysis and Implications of Constitutional Court Ruling No. 111/2025, Which Also Introduces a New Factual Variable in Dismissal Litigation: the Employee’s Psycho-Physical Health Status
With ruling No. 111/2025, filed on 18 July 2025, the Constitutional Court delivered a significant decision in labor law, declaring the partial constitutional illegitimacy of Article 6, first paragraph, of Law No. 604 of 15 July 1966. The Court found unconstitutional the provision to the extent that it does not allow a worker who is in a state of incapacity of mind at the time of receiving the dismissal notice—or during the 60-day period for extrajudicial challenge—to be exempted from the obligation of prior extrajudicial contestation and to instead challenge the dismissal directly through judicial proceedings (or by requesting conciliation or arbitration) within 240 days from the communication of the dismissal.
To understand the scope of the Constitutional Court’s ruling, it is necessary to outline the regulatory and jurisprudential context in which it is situated.
The core of the legislation is found in Article 6 of Law No. 604 of 15 July 1966. In its current form—shaped by amendments first introduced by Article 32 of Law No. 183/2010 and later by Article 1, paragraph 38, of Law No. 92/2012—the provision structures dismissal challenges as a progressive process, marked by two temporal thresholds:
First Term (Extrajudicial Challenge): The employee must contest the dismissal “under penalty of forfeiture within sixty days of receiving written notice”. The challenge may be made “through any written act, including extrajudicial, suitable to make the employee’s intention known”.
Second Term (Judicial Action): The extrajudicial challenge is considered “ineffective if not followed, within the subsequent one hundred and eighty days, by filing a claim with the labor court registry or by notifying the other party of a request for conciliation or arbitration”.
Failure to comply with even a single one of these deadlines results in the forfeiture of the right to challenge the dismissal and, consequently, in the stabilization of its effects, preventing the employee from seeking either reinstatement or the merely compensatory remedies provided by the special legislation.
The classification of the term as a “forfeiture period” is of crucial importance. Pursuant to Article 2964 of the Italian Civil Code, forfeiture is neither subject to interruption nor suspension, unless otherwise provided. This general principle renders the dismissal challenge period impervious to personal circumstances that would normally suspend the running of time, such as illness. The rationale behind this rule is to require the exercise of a right within a predetermined and brief timeframe, thereby crystallizing an otherwise uncertain legal situation.
The 60-day period (dies a quo) begins from the “receipt” of the dismissal notice. Since dismissal is a unilateral communicative act, its effectiveness and the commencement of the related deadlines are governed by Article 1335 of the Civil Code, which establishes a presumption of knowledge:
“A proposal, acceptance, revocation, or any other declaration addressed to a specific person is deemed known at the moment it reaches the recipient’s address, unless the recipient proves that, without fault, they were unable to have knowledge of it.”
It is precisely the interpretation of this provision that underpins the established jurisprudential orientation.
Indeed, the Supreme Court’s rulings, dating back to early decisions such as Cass. no. 5563 of 1982, have interpreted these rules in a rigorous and formalistic manner, prioritizing legal certainty.
The dominant approach follows the so-called “theory of receipt” or “theory of knowability”. Under this interpretation, what matters for the effectiveness of the act is not the actual knowledge of the recipient, but its mere knowability, which is presumed at the moment the act reaches the recipient’s address.
As a direct consequence, the rebuttal allowed under Article 1335 c.c. (“impossibility of knowledge without fault”) cannot relate to the recipient’s subjective conditions.
As highlighted by the United Sections in the ordinance referring the matter to the Constitutional Court:
“The evidence suitable to overcome the presumption must therefore concern circumstances not related to the recipient’s subjective conditions but to external and objective factors, concerning the connection between the individual and the place of delivery, sufficient to exclude the knowability of the act” (Cass., United Sections, ordinance of 5 September 2024, registered as no. 202/2024).
Therefore, the employee’s incapacity to understand and act (natural incapacity) – being purely subjective and internal – has consistently been considered irrelevant for the running of the forfeiture period. The period starts inexorably from the moment the dismissal letter is delivered, regardless of whether the employee is able to comprehend its content or respond.
The United Sections further excluded the possibility of protecting the incapacitated employee under Article 428 c.c., which governs the annulment of acts carried out by persons lacking capacity. The rationale is that Article 428 c.c. applies to commissive acts (e.g., signing a contract). The failure to challenge a dismissal, instead, is an omissive conduct, a “failure to act” in defense of one’s rights, to which the rule cannot extend.
Jurisprudence has always justified this strict interpretation by balancing the interests at stake. On one side, there is the employee’s right to job stability; on the other, the employer’s interest in continuity and stability of business management. Imposing a short forfeiture period serves this latter interest, preventing organizational decisions from remaining in uncertainty for an extended period. Forfeiture, in this perspective, is not a sanction for inaction, but the objective consequence of failing to meet a procedural obligation designed to protect economic relationships.
In summary, the legal and jurisprudential framework can be described as “rigid”, built on three pillars:
It is precisely against the rigidity of this consolidated system that the ordinance of the United Sections of the Supreme Court is directed. While acknowledging its internal coherence and purpose of certainty, the referring Court questioned its compatibility with fundamental constitutional principles (reasonableness, equality, right to work, right to defense, and right to health) when applied to extreme situations of absolute and blameless incapacity, where the balance of interests is manifestly disproportionate against the employee.
The constitutional question raised by the United Sections of the Supreme Court
The Constitutional Court’s ruling stems from a question raised by the United Sections of the Supreme Court in a case involving an employee dismissed while suffering from a severe illness, leaving her naturally incapable at the time of receipt of the dismissal and during the 60-day extrajudicial challenge period.
The referring judge highlighted that the rigid application of the forfeiture period, insensitive to the employee’s subjective condition, could violate multiple constitutional provisions, including:
The Supreme Court therefore requested the Constitutional Court to issue an additive ruling, making the forfeiture period run not from the receipt of the dismissal, but from the moment the employee regains capacity to understand and act.
Continue reading the full version published at Il Modulo 24 Contenzioso Lavoro.
With Ordinance No. 15987 of 2025, the Italian Court of Cassation established that a dismissal notice is presumed to be known by the recipient at the moment it is delivered to their residential address, even if the employee is not actually informed.
The case at hand concerns a dismissal imposed due to absolute and permanent unfitness for work, communicated to the employee by registered letter sent to their residential address. Specifically, the dismissal letter, properly delivered, was collected by the employee’s mother, who lived with him, and who decided not to hand it over to her son in order to protect him from potential psychological repercussions that the news of the dismissal might cause. Consequently, the employee challenged the dismissal after the statutory deadline of 60 days from receipt of the communication, invoking as justification for the late challenge the lack of knowledge of the dismissal.
However, both the Court of First Instance and the Court of Appeal of Bologna (second-instance judgment) declared the appeal inadmissible, due to the expiration of the challenge period, considering the communication received at the employee’s address to be fully valid. They relied on a legal presumption of knowledge, based on the substantial legal equivalence between “knowledge” and “knowability” in relation to the delivery of an act to the recipient’s domicile.
The Court of Cassation subsequently confirmed this interpretation, reaffirming that, under Italian law, there is a legal presumption of knowledge of acts: an act is deemed to be known when it reaches the recipient’s address. This presumption can only be rebutted in the presence of objective obstacles beyond the employee’s control, such as natural disasters, serious postal disruptions, or prolonged absences due to force majeure, but not by subjective factors attributable to the recipient.
In conclusion, the ruling reiterates that, under Italian law, the deadlines to contest a dismissal are strict and start from the moment the communication reaches the employee’s address, even in cases where subjective factors prevent the employee from becoming aware of the disciplinary measure imposed on them.
By Judgment No. 315 of June 5, 2025, the Court of First Instance of Vicenza ruled that, for the purposes of territorial jurisdiction, the residence of a remote worker can only be considered relevant if it is demonstrated that a substantial and organized part of the work is carried out there on a stable basis, thereby anchoring the performance of the work to that location.
The employee, working as an external sales representative, contested his dismissal by bringing the case before the court in the district of his residence – where he also used the company – provided laptop and mobile phone.
The employer responded by raising a preliminary objection, challenging the court’s territorial jurisdiction.
The Court of first instance of Vicenza first referred to Article 413, paragraph 2 of the Italian Code of Civil Procedure, which, as is well-known, links territorial jurisdiction to three alternative criteria: namely, the district where (i) the employment relationship arose, (ii) the company or (iii) one of its branches to which the employee was assigned or where the employee performed work at the end of the employment relationship is located.
Following the Supreme Court’s previous rulings, the Court of first instance of Vicenza emphasized the need to interpret the concept of company branch broadly, in order to “make the proceedings more efficient and swift, anchoring them in locations normally closer to the employee’s residence, where the evidence necessary for the case can be more easily found” (Supreme Court judgments No. 506/2019 and No. 6458/2018).
That said, the Court of First Instance clarified that, in any case, “there must always be an objective or subjective connection between the place where the employee performs their work and the company’s organization.”
It should be considered that when remote work can be performed interchangeably from any location, without “any other element (or objective or subjective connection, as previously highlighted) emerging that would in any way characterize the employee’s residence as a company branch, in the sense described, then this criterion cannot be taken into account for determining territorial jurisdiction, leaving only the criteria of the place where the contract was concluded (…) or the office to which the employee was assigned (…).”
On this basis, the Court of First Instance of Vicenza – finding no evidence that a stable and organized portion of the employee’s fundamental work performance was carried out at his residence, so as to firmly anchor the activity to that place – upheld the employer’s objection of lack of territorial jurisdiction.
Managing employee surveillance is a sensitive issue, especially with the rise of new technologies. Recent rulings from Italy’s Court of Cassation have clarified the legal boundaries surrounding this practice.
The role of Investigative Agencies
Employers may use private investigators to check potential employee misconduct, such as unapproved absences or misuse of leave. However, these investigations must be focused, proportional, and lawful, ensuring they do not interfere with an employee’s work duties.
Monitoring company devices
Employers may need to access employees’ devices, such as emails or laptops, especially when there is reasonable suspicion of misconduct. The Italian Supreme Court has recently clarified that checking an employee’s email is only permitted when there is concrete suspicion, and such checks must not be arbitrary or excessive.
Balancing business needs and employee privacy
It is essential to strike a balance between business needs and employee privacy. Surveillance must be justified, proportionate, and never indiscriminate. Employers must ensure they follow legal guidelines to avoid misuse of the information collected.
Best practices
By following these principles, employers can protect their business interests while respecting employee privacy.
Continue reading the full version published on Agenda Digitale.
