Privacy compliances for labour relations in Italy

The right to privacy in employment relations

The data protection in Italian labour law is important already in the HR recruitment phase. Firstly, it is important to remember that Italian law is influenced by European law. The General Data Protection Regulation n. 679/2016 is in place for all Member States of the European Union. Nevertheless, each State has its own system and its own Supervisor Authority which issues guidelines.

In Italy, the first rule that the employer must respect in the employer/employee relationship concerns personnel selection. The article 8 of the Italian Worker's Statute, L. 300/1970, has forbidden it to make investigations on special categories of personal data of the job applicants.  This activity could involve discrimination because it could reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

There are some obligations in this process regarding transparency and modalities of data processing, the employer should take appropriate measures to provide any information of the data processing. Furthermore, the employer needs to pay careful attention to the questions when administering an attitude test. The questions shouldn't refer to special categories of personal data.

The privacy policy should include the information of article 13 of GDPR.

Another important note regarding the entire relationship of personal data processing on work is that the consent of the worker cannot represent a lawfulness of processing.

In fact, consent can be an appropriate legal basis is given only freely. According to recital 62 of GDPR, consent should be given by a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

In the work relationship there is no equal balance because the employer is in a superior position. For this reason, consent cannot be considered free.

This is a rule that has been reiterated several times by the Italian Supervisory Authority. In Addition, the principle has also been taken up by the European Data Protection Board in its specific Guidelines on data processing at work.

The main obligations in the work relationship

As already mentioned, the employer is required to give specific privacy to the employees regarding how the data is processed. The information that must be given to the employees must be as clear as possible and, above all, be understandable to the worker, regardless of his or her function within the organization.

This obligation is detailed in Article 13 of the GDPR, but in Italian law the obligation of transparency is also established in Article 1a of Legislative Decree 152/1997, which was recently amended by the so-called Transparency Decree.

The decree incorporates the employer's obligation to inform employees of the use of automated decision-making or monitoring processes used to provide relevant indications affecting labour relations. In addition, the decree expressly recalls the obligation to provide guidance on the security measures applied to the processing of personal data concerning workers.

Additional prohibition under Italian law is not to know about the employee's health data. For this reason, the employer must appoint the doctor who, according to Legislative Decree 81/2008, is the only person who can know the health status of workers. This means that within the work environment, the employer must pay special attention to the storage of employee's health data. If the medical records sent by the doctor are paper based, they need to be stored in locked cabinets, while if they are digital, specific security measures are needed to safeguard the security of the data from computer incidents. In this context, it's important to give the instructions to the persons who are processing data.

The retention of workers' data

Another important aspect concerns the retention time of workers' data.

First, it should be said that the retention time of data collected during the employment relationship cannot be uniformly defined. To name a few the retention of records pertaining to social security and insurance obligations can be justified for a maximum of 10 years, based on the Inps Circular n. 31/2012, which stipulates that since Jan. 01, 1996, contributions of employees and all other mandatory pension schemes are prescribed within 5 years. However, this period may be extended to 10 years if the worker or heirs submit a request to INPS about the recovery of previously unobtained contributions. In fact, the Legislature by Article 6 the first paragraph of Ministerial Decree 9/07/2008 determines the retention time of the LUL (Single Labour Book) within 5 years of the date of the last registration.

The retention time must be identified and included in the records of processing activities in accordance with art. 30 GDPR. The indication of the retention time must then be made known to the data subject through a privacy policy. As pointed out by the Italian Authority in the June 10, 2021, Prov. the generic indication "data are processed only for the time strictly necessary to achieve the purposes" is in violation of the principle of limited retention and transparency.

In any case, the above-mentioned Transparency Decree clarifies that information must be retained and made accessible to the employee by the employer, who must retain proof of transmission or record of receipt for five years after termination of employment.

The technological control of workers

Another important aspect of the Italian legal system relates to the application of article 4 of the Workers' Statute, which regulates the technological control of workers. This provision is very important especially in the age of digitalization where the difference between a tool of work and a tool of control is less and less visible.

The Italian legislature allows technological remote control within specific limits and legitimate conditions. In addition, it is specified that for instruments necessary to render work performance and for those necessary to record attendance, control will be possible without necessary administrative authorization or the trade agreement and without the necessary presence of the legitimizing conditions provided by the law. Finally, it's crucial to know that if the employer wants to use the data collected by technological control, they must respect the Privacy Code.

The first step is to understand whether the tool is strictly necessary to render work performance, or from its use may result in control for the worker. In the former case, a specific agreement with trade unions or a specific Italian administration (Ispettorato del lavoro) will need to be made before installation. In the second case, no prior agreement or authorization will be required.

However, it remains the same that for both cases, the employer will have to comply with the Privacy Code requirements and in particular the obligation to provide information on how the instrument is used and how the employee may be monitored.