The Italian Data Protection Authority (‘IDPA’), with a Ruling of 7 March 2024 [announced in the Newsletter of 3 May 2024] upheld a complaint filed by a worker who had asked her former employer company for access to her personal file to find out what information could have given rise to a disciplinary sanction against her.
The company had not given an adequate response to the request and had only provided an incomplete list of the documentation collected, omitting information which formed the basis of the disciplinary sanction which was then imposed. The omitted information was only provided to the worker after the start of the IDPA’s investigation.
In its note of reply, the company claimed that it had not provided the worker with the above-mentioned documentation in order to protect its right of defence in court as well as the confidentiality of the third parties involved. The company also alleged that the complainant lacked standing to access the information, since it had been requested at a time when the disciplinary proceedings could no longer be challenged.
The IDPA reiterated that the right of access recognised by Regulation (EU) 2016/679 (‘GDPR’) is intended to allow the data subject to exercise control over his or her personal data and to verify its accuracy. Consequently, this right cannot be denied or limited depending on the purpose of the request. In fact, according to the provisions of the GDPR, data subjects are not asked to indicate a reason or a particular need to justify their requests to exercise their rights, nor can the data controller verify the reasons for the request.
Therefore, access to personal data cannot be denied because the data requested could be used by the data subject to defend himself or herself in court in the event of dismissal.
“The jurisprudence has on several occasions reiterated that the right of access derives, in addition to the legislation on personal protection data, from the ‘respect for the principles of good faith and fairness incumbent on the parties to the employment relationship under Articles 1175 and 1375 of the Italian Civil Code. This is confirmed by the fact that, for some time, the relevant sector’s collective bargaining agreement has provided that the employer must keep, in a special personal file, all the deeds and documents produced by the entity or by the employee himself or herself, which relate to his or her professional development, the activity performed and the most significant facts concerning him or and that the employee has the right to freely view the deeds and documents included in his or her personal file’ (Italian Court of Cassation, 7 April 2016, no. 6775)”.
Based on the points set out above, the IDPA imposed a fine of EUR 20,000.00 on the company.
◊◊◊◊
Summary of the right of access:
Other related insights:
On Wednesday 24 April 2024, MEPs adopted the text of the new Directive on the working conditions of platform workers. As can be learned from the press release published on the Parliament’s institutional website, the Directive “aim[s] to ensure that platform workers have their employment status classified correctly and to correct bogus self-employment”by introducing “a presumption of an employment relationship (as opposed to self-employment) that is triggered when facts indicating control and direction are present, according to national law and collective agreements […]”.
Among the initiatives introduced by the Directive, as far as is of interest here, there are limitations on the processing of personal data carried out by means of automated monitoring or decision-making or systems. For example, the following may not be subject to any processing operation: (i) data on the emotional or psychological state of the person performing platform work; (ii) personal data in relation to private conversations; (iii) data belonging to the category of special data (former sensitive data) or biometric data or, again, (iv) the data of the worker who carries out activities through a digital platform may not be collected when he or she is not carrying out his or her activity through the platform itself.
These provisions will apply from the start of the recruitment and selection procedures and for the entire duration of the relationship. It is understood that, given the type of processing and the high risk to the rights and freedoms of natural persons, processing of personal data by a digital work platform will be subject to specific impact assessments under Article 35 of Regulation (EU) 2016/679. The impact assessments carried out by the employer will then have to be shared with the workers’ representatives.
Another key element is the transparency obligations. Persons who perform work through digital platforms will have to be promptly made aware, in a transparent, intelligible and easily accessible form using clear and plain language, about the categories of decisions that are taken or supported or by automated decision-making or monitoring systems. The Italian national legal system is already familiar with this aspect following the introduction of the provisions of Regulation (EU) 2016/679 and the adoption of the so-called “Transparency Decree”.
Finally, it is understood that Member States will have to ensure that digital work platforms guarantee sufficient human resources to effectively monitor and assess the impact of individual decisions taken or supported by automated decision-making or monitoring systems.
◊◊◊◊
Next steps
The text approved by the European Parliament will now also have to be formally adopted by the Council and then published in the Official Journal of the European Union. After publication, each Member State will have two years to incorporate the new provisions into its national law.
Other related insights:
On Wednesday 13 March 2024, the European Parliament approved the draft text of the so-called “AI Act”, the first Regulation on artificial intelligence. The Regulation establishes obligations in relation to the use of AI on the basis of possible risks and level of impact with the aim of protecting individuals’ fundamental rights, democracy and environmental sustainability from “high-risk” systems.
“High risk” means AI systems intended to be used:
For more information on this topic, please contact us at info@delucapartners.it
With order no. 642 of 21 December 2023 entitled “Computer programs and services for the management of e-mail in the workplace and metadata processing”, the Italian Data Protection Authority (‘DPA’) has provided guidelines for public and private employers on the use of computer programs and services for corporate e-mail management.
The document was issued following investigations carried out by the Italian DPA during which it emerged that there was a risk that computer programmes and services for e-mail management, marketed by providers in cloud or as-a-service mode, could collect by default, in a pre-determined and generalised manner, metadata relating to the use of e-mail accounts in use by employees, retaining them for an extended period of time. “Metadata” means information such as, for example, the day, time, sender, recipient, subject and size of the e-mail.
To ensure compliance with data protection legislation as well as the sector regulations on remote control – as is well known, governed by Article 4 of Italian Law no. 300/1970 (the “Workers’ Charter”), employers must:
In other words, if, to meet organisational and production needs, the protection of company assets and occupational safety, the retention of data cannot be limited to the periods indicated by the DPA, employers will have to sign a trade union agreement or obtain an authorisation from the Labour Inspectorate.
In the absence of this, there is considered to be remote control of worker’s activities which may also have criminal consequences, in addition to breach of the personal data protection legislation with the following consequences; (i) the unlawfulness of the processing of personal data, (ii) the breach of the principle of limitation of retention, and (iii) breach of the principles of data protection by design and by default as well as the principle of accountability.
In any event, it should be noted that, pending the completion of the guarantee procedures, the metadata must not be used.
Other related insights:
Italian Legislative Decree no. 24/2023, which implements Directive (EU) 1937/2019 and introduces the new legal framework on whistleblowing has come into effect. Laws on whistleblowing have already been in force for some years in companies required to implement the 231 Models and detailed and specific provisions on procedure and sanctions now apply to all companies.
The term “whistleblowing’ refers to the activity of reporting breaches of national or EU regulatory provisions of which workers have become aware in the context of work. For companies with more than 250 employees, the obligation to adopt adequate reporting systems has been in force since 15 July 2023, while for small and medium-sized enterprises the obligation came into force on 17 December.
Conduct, acts or omissions that harm the public interest or the integrity of the public administration or private entity and that consist of breaches attributable to the specific cases listed in the decree must be reported.
A person who believes that the conditions for a report are met may use the following channels: (i) internal reporting; (ii) external reporting, if there is no mandatory activation of the internal reporting channel, or if this has already been done without follow-up, if the whistleblower has reasonable grounds to believe that the internal report would not be followed up or there would be a risk of retaliation or if the whistleblower has reasonable grounds to believe that the breach constitutes a danger to the public interest; (iii) public disclosure, if the whistleblower has already made an internal and/or external report without feedback, if there is reasonable ground to believe that the breach may constitute a danger to the public interest, or if there is reasonable ground to believe that the external report may involve the risk of retaliation or may be ineffective; (iv) complaint to the judicial authority, at any stage.
Internal channels must ensure the confidentiality of the reporting person, the content of the report, the facilitator and the person concerned. When establishing internal reporting channels, it is necessary to use suitable tools to receive reports both orally and in writing, as the whistleblower is guaranteed both methods.
In this regard, the Italian National Anti-Corruption Authority (Autorità Nazionale Anticorruzione, ‘ANAC’) with resolution 311 of 12 July 2023 considered that ordinary e-mail and certified e-mail (PEC) did not guarantee confidentiality, and thus required the use of online platforms. As far as the paper report is concerned, the ANAC has requested that it be placed in two sealed envelopes (one with the identification data and the second with the actual report), then both envelopes should be inserted in a third sealed envelope with the external wording “confidential” for the manager of the report.
To implement the new regulatory obligation, companies must identify the channel in an organisation specific document; inform trade union representatives; make clear information available to the reporting person about the channel, procedures and conditions for making internal or external reports (e.g. via the website or platform page); guarantee the training of those who are entrusted with the management of the reporting channel and of all internal staff; adapt the 231 organisational model (if adopted) and put in place all the measures required under the regulations on the protection of personal data and the processing carried out to comply with it. Finally, companies will have to adopt a sanctioning system in the event of breach of the decree provisions.
In conclusion, under the regulatory framework that arises from Italian Legislative Decree no. 24/2023, companies and operators must pay great attention to the preparation of policies and organisational and management tools necessary for the implementation of legal obligations to ensure the protection and enhancement of each organisation’s ethical principles.
