Employer controls, disciplinary measures and the right to confidentiality (Norme & Tributi Plus Diritto – Il Sole 24 Ore, 20 December 2021 – Alberto De Luca, Martina De Angeli)

On 12 November 2021, in its ruling no. 33809, the Court of Cassation returned to the issue of employer controls using electronic tools, considering the principles and restrictions applicable to personal data protection. The Supreme Court confirmed that an employee’s PC data are company assets. Therefore, an employer can acquire and use the data for disciplinary and defence purposes without violating the privacy legislation, and in compliance with the duties of fairness, relevance and non-excessiveness. Over time, the legislation on personal data protection has evolved as case law has revealed the fundamental principles balancing the employer’s right to control and the employee’s right to privacy.

The key provision is Art. 4 of the Workers’ Statute (Law 300/1970); in its original version, i.e. before the amendment made by the Jobs Act (Legislative Decree no. 151/2015), the rule provided for two levels of protection of the worker’s private sphere “one through the prohibition of audio-visual systems and other equipment for worker remote control purposes which is unsupported by reasons inherent to the company. The other, weaker protection, is when the controls were attributable to the objective needs of the company. This is without prejudice to controls with “guarantee procedures”” (see Court of Cassation 22 September 2021, ruling no. 25732). Following the reform implemented by the Jobs Act, the new Article 4 re-proposed the prohibition of using audio-visual equipment and other tools which involve the possibility to remotely controlling workers’ activities. The rule confirmed the general exception to this prohibition which, in the presence of a trade union agreement or, based on the Labour Inspectorate authorisation, justifies the installation of systems and tools allowing remote control, provided that it is justified by (i) organisational and production requirements, (ii) safeguarding safety at work and (iii) protection of the company’s assets. 

A change of significant regulatory impact (although reduced in practice and case law by a protective approach) was introduced by the second paragraph of the new provision. This paragraph stated that the general prohibition (with the obligation of agreement or authorisation) does not apply to tools used by workers to perform their work or those for recording access and attendance.

Without prejudice to the above, information collected through lawful controls, under Art. 4 of the Workers’ Statute may be used for purposes related to the employment relationship (including disciplinary purposes), subject to certain conditions, i.e., a) the worker has received adequate information about the tools’ use and control methods and b) compliance with the provisions set out in the data protection (represented by Regulation (EU) 2016/679 and Legislative Decree no. 101/2018.

Continue reading the full version published in Norme & Tributi Plus Diritto of Il Sole 24 Ore.