Data processing performed in violation of the privacy code and article 4 of the Workers’ Charter is unlawful

The Data Protection Authority in charge of the protection of personal data, with order No. 479 dated 16 November 2017, deemed unlawful – and prohibited it – the processing of personal data of employees carried out by Poste Italiane S.p.A. through a system used for the management of the waiting times at the counter. In particular, Poste Italiane deemed this system to be a work tool and consequently did not (i) involve the trade unions and (ii) did not issue any specific information to the staff. The Data Protection Authority, on the other hand, noted that: (i) the system implemented could not be deemed, pursuant to article 4, paragraph 2, of the Workers’ Charter, as “essential” for work performance, being instead one of the available tools for organising work activity, from which indirectly remote monitoring of workers’ activity could result as a consequence. Therefore, its implementation would have required a trade union agreement and the submittal to the concerned employees of adequate information on the methods and purposes of the processing made possible through the system. In addition, in the opinion of the Data Protection Authority, the basic principles of necessity, relevance and not excess in relation to the aims pursued were violated, given the continuous monitoring of work performance, the impossibility for the concerned persons to interrupt such monitoring and the existence of different measures to achieve the same corporate purposes.