In Provision No. 288 of May 21, 2025, the Italian Data Protection Authority fined an Italian company €420,000 for unlawful processing of an employee’s personal data later used to justify her dismissal.
The employee filed a complaint against the company, alleging improper use of her personal data extracted from her “Facebook” profile, the “Messenger” app, and certain chats from the “WhatsApp” platform. These data, made known to the company, were used to support two separate disciplinary notices.
In the first notice, dated February 16, 2024, the company quoted the contents of some comments made by the complainant on her Facebook profile, including quoted excerpts and descriptions of certain photos. In the second notice, dated March 21, 2024, it referred to a conversation on Messenger between the complainant and a third party (not employed by the company) who forwarded the conversation to the company via WhatsApp, including quoted excerpts. This second notice also included excerpts from a WhatsApp message the complainant sent to some colleagues on February 22, 2024.
Referring to Article 8 of Law No. 300/1970 (the Italian Workers’ Statute), which prohibits the employer from carrying out investigations – including via third parties – into an employee’s political, religious, or trade union opinions, as well as facts irrelevant to assessing the employee’s professional aptitude, the company claimed it had played no active role in collecting the data. It argued that the information had been reported to it and could therefore be used for disciplinary purposes, as this would not constitute a prohibited investigation under the Workers’ Statute.
The Italian Data Protection Authority used the occasion to recall that:
– The legal system protects the freedom and confidentiality of communications, recognized as fundamental rights, and any limitation is allowed only “by reasoned decision of the judicial authority, in accordance with the law” (Article 15 of the Constitution). This presumption of confidentiality, as clarified by the Constitutional Court, extends to all communication tools made available by technological evolution. (Lawfulness principle)
– The mere publication of data on publicly accessible platforms, such as social networks, does not imply that the data subject has given general consent for the free use of that data for any purpose. A specific legal basis is required for any processing other than the original purpose. (Purpose limitation principle)
– The need for data processing based on legitimate interest – the justification cited by the company in its defense – must also be evaluated under the principle of minimization. The data controller must verify that “the legitimate interest pursued cannot reasonably be achieved through less harmful means for the fundamental rights of data subjects, particularly their right to privacy”. In this case, the company failed to demonstrate that it had assessed the impact of the processing on the employee’s rights or considered less intrusive alternatives, even though the disciplinary measures could have been based on other elements. (Data minimization principle)
The Authority clarified that while it is not tasked with evaluating the disciplinary facts themselves, it is the employer – as the data controller – who must assess not only the lawfulness but also the adequacy, relevance, and proportionality of the data processing to be carried out. The Authority found numerous violations by the company, which, “once it became aware that the transmitted data concerned private communications and comments on a closed Facebook profile, […] should have refrained from using them.”
Other related insights:
With Ordinance No. 15987 of 2025, the Italian Court of Cassation established that a dismissal notice is presumed to be known by the recipient at the moment it is delivered to their residential address, even if the employee is not actually informed.
The case at hand concerns a dismissal imposed due to absolute and permanent unfitness for work, communicated to the employee by registered letter sent to their residential address. Specifically, the dismissal letter, properly delivered, was collected by the employee’s mother, who lived with him, and who decided not to hand it over to her son in order to protect him from potential psychological repercussions that the news of the dismissal might cause. Consequently, the employee challenged the dismissal after the statutory deadline of 60 days from receipt of the communication, invoking as justification for the late challenge the lack of knowledge of the dismissal.
However, both the Court of First Instance and the Court of Appeal of Bologna (second-instance judgment) declared the appeal inadmissible, due to the expiration of the challenge period, considering the communication received at the employee’s address to be fully valid. They relied on a legal presumption of knowledge, based on the substantial legal equivalence between “knowledge” and “knowability” in relation to the delivery of an act to the recipient’s domicile.
The Court of Cassation subsequently confirmed this interpretation, reaffirming that, under Italian law, there is a legal presumption of knowledge of acts: an act is deemed to be known when it reaches the recipient’s address. This presumption can only be rebutted in the presence of objective obstacles beyond the employee’s control, such as natural disasters, serious postal disruptions, or prolonged absences due to force majeure, but not by subjective factors attributable to the recipient.
In conclusion, the ruling reiterates that, under Italian law, the deadlines to contest a dismissal are strict and start from the moment the communication reaches the employee’s address, even in cases where subjective factors prevent the employee from becoming aware of the disciplinary measure imposed on them.
On 20 February 2025, Decree-Law No. 6/2025, known as the ‘Decreto Milleproroghe’, was definitively approved by the Chamber of Deputies, which once again intervenes on fixed-term contracts, in particular on the reasons justifying such temporary employment relationships.
The Decree extends until 31 December 2025 the possibility for private employers to enter into fixed-term contracts exceeding 12 months, and in any case not exceeding 24 months, also for needs of a technical, organisational or productive nature, if not already provided for by collective agreements.
This provision applies to all sectors, with an initial application that could affect the tourism sector, pending updates of the relevant collective agreements.
Other related insights:
Italian Law 104/1992 grants employees paid leave to assist family members with disabilities, with the cost covered by INPS (the National Institute for Social Security). However, misuse of this benefit has led to judicial investigations to identify potential violations of the law. Case law has helped clarify what constitutes abuse.
The law grants leave for caregiving but does not clearly define the conditions under which its use becomes abusive. In general, courts have adopted a broad interpretation, stating that caregiving includes all tasks a disabled person cannot perform independently, not just personal assistance at home.
In a recent ruling (October 10, 2024, no. 26417), the Italian Supreme Court clarified that caregiving does not require constant presence at the family member’s home, but can include errands, as long as they are aimed at the disabled person’s well-being. The Court also confirmed that using leave outside working hours does not count as abuse, since the leave is granted on a daily, not hourly, basis.
In another ruling (September 9, 2024, no. 24130), the Court stated that personal activities, as long as they do not interfere with caregiving, are not considered abusive. However, if the employee engages in activities far from caregiving, such as going to the beach instead of assisting a family member (Cass. Civ., Labor Section, June 16, 2021, no. 17102), it is considered misuse, and the employer can take disciplinary action, including dismissal for just cause.
Employers can hire investigative agencies to check for abuse, but these investigations must be conducted within legal boundaries, respecting the employee’s privacy.
Continue reading the full version published in Il Sole 24 Ore.
In its order no. 26440 dated October 10, 2024, the Court of Cassation, Labor Section, reaffirmed the legitimacy of the dismissal imposed on an employee who had addressed a client in a rude and vulgar manner, once again underscoring the boundaries of judicial review in determining “just cause” for termination.
The judicial proceedings originated from the disciplinary dismissal of an employee assigned to the butcher counter of a supermarket, who had been accused by the employer of addressing an elderly customer with aggressive and inappropriate language.
While the court of first instance upheld the employee’s challenge to the dismissal, the Court of Appeal of Cagliari reversed this decision, confirming the legitimacy of the dismissal order.
In this case, the appellate court considered the employee’s behavior a serious breach of his contractual obligations, particularly the duty to “use courteous manners with the public and maintain a conduct consistent with civic duties,” warranting disciplinary dismissal pursuant to Article 215 of the collective bargaining agreement for employees in the Tertiary, Distribution, and Services sector, which governed the employment relationship.
The Court specifically emphasized the seriousness of the employee’s conduct, noting that the counter attendant, on that occasion, not only failed to apologize to the elderly customer but also escalated the argument with increasingly heated tones, resulting in what was described as “an undignified and somewhat concerning scene.” In assessing the appropriateness of the dismissal, the Court of Appeal also took into account the employee’s prior disciplinary record from the preceding two years. Although these prior incidents were not specifically similar, they highlighted a pattern of repeated non-compliance with company rules, rendering the continuation of the employment relationship unsustainable.
In the ruling under discussion, the Court of Cassation, by rejecting the employee’s appeal against the Cagliari Court’s decision, seized the opportunity to consolidate its stance and reaffirm certain prevailing principles concerning termination for just cause under Article 2119 of the Civil Code.
In particular, the Court of Cassation observed that “just cause,” understood as conduct that precludes even temporary continuation of the employment relationship, falls within the scope of so-called general clauses—normative provisions of limited and general content that require judicial specification in interpretation, “through consideration of both external factors relating to general societal awareness and principles implicitly referenced by the provision itself.”
Continue reading the full public version on Norme e Tributi Plus Lavoro del Il Sole 24 Ore.
