On 10 June, the Italian Data Protection Authority approved the new ” Cookie Guidelines.”The term cookie refers to a small text file that a website (publisher or “first party”) can autonomously send to the user’s device (e.g. Smartphone, PC or Tablet) when viewing a web page or different sites or web servers (“third parties”). Usually, cookies make it possible to store the preferences expressed by the user so that they do not have to be re-entered later. The browser saves the information and transmits it to the site’s server when the user visits that website again.
The Guidelines, adopted by the Data Protection Authority, considered what emerged during the public consultation promoted at the end of last year. The guidelines aimed to strengthen users’ decision-making power over the use of their data when surfing online.
Here are the main changes.
Under Regulation (EU) 2016/679 on the protection of personal data (better known as the “GDPR“), the policy to be issued to users/data subjects shall specify (i) possible recipients, (ii) the retention periods of personal data processed and (iii) a description of all the consequences of any action taken by the user/data subject.
The Data Protection Authority recommends that Analytics cookies, which the Data Controller uses to assess the effectiveness of a service, be used only for statistical purposes.
The multi-layer privacy policy is confirmed, with a banner (short policy) when accessing the site containing specific information on positioning, size, font and content, and a link to the extended policy.
The user/data subject must choose between consent or modulating their preferences on tracking and be provided with a link to another area to select the functions, third parties and cookies, possibly grouped by similar categories, to the use of which the user consents.
The mere “scrolling down” of the page cursor is unsuitable for the collection of an appropriate consent to the installation and use of profiling cookies or other tracking tools by the data controller.
Given the controller’s autonomy in identifying the most appropriate solutions to achieve compliance with data processing regulations, the Data Protection Authority invites the controller to assess every possible solution rigorously. According to the Data Protection Authority, if the user action does not correspond to any unmistakable, documentable computer event with the mentioned features, including user awareness, it will be impossible to attribute the consent validity under applicable regulations.
Obtaining consent for cookies may not be repeated unless (i) the processing conditions change significantly, (ii) the site operator can’t record the user’s previous choice due to a user decision and (iii) at least six months have elapsed since the previous request.
Users/data subjects shall be provided with the ability to review choices made at any time and in a simple, immediate and intuitive manner. This can be done using a dedicated area made accessible through a link placed in the footer of the site that makes the function explicit and says “review your choices on cookies” or similar.
Website owners have six months to comply with the principles contained in the Guidelines.
Other related insights:
The Court of Appeal of Venice, in ruling no. 476 of 28 June, 2021, ruled about remote control, considering video recordings of cameras on company premises to be entirely usable.
A company (a gambling house) had used the images collected through a video surveillance system installed on the company’s premises to initiate two separate disciplinary proceedings against an employee.
The employee, a cashier, was accused of embezzling money from the company’s cash register through various contrivances to make up for shortfalls, attributable to her, in the payment of winnings to customers and realise capital gains to her own advantage.
The judge during the summary proceeding considered the video recordings to be entirely usable as they were covered by the trade union agreement under the legislation on remote control. The only formal defect was that the employer had failed to produce the footage collected during the disciplinary proceedings.
Against the employee objection, the judge reformed the order of the summary proceeding, considering that the video recordings could not be used. Therefore the unlawful acts were not proved, with a consequent order for the company to reinstate the employee in her job (under art. 18, paragraph 4 of the Workers’ Statute).
The losing company appealed.
The Court of Appeal, upholding the company’s appeal, noted that:
In addition, interpreting the trade union agreement signed, the Court of Appeal noted that the images collected through the video surveillance system installed could be used for disciplinary purposes if there had been conduct “of particular importance or seriousness.”
For these reasons, the Court of Appeal considered the employee’s conduct to be “undoubtedly serious and capable of irreparably damaging the employer’s trust in the correctness of future performance” and recognised that all the conditions for dismissal for just cause were met.
Decree-Law no. 82/2021 (the “Decree“) was published in the Official Gazette on 14 June, containing “urgent provisions on cyber-security – definition of the national cyber-security architecture and establishment of the National Cyber-security Agency” .
The term “Cyber-security” means “activities necessary to protect networks, information systems, computer services and electronic communications from cyber threats, ensuring their availability, confidentiality, integrity and resilience” (Art. 1, paragraph 1, letter a).
The Decree, which consists of 19 articles, institutionalises the “Interministerial Committee for cyber-security” (“CIC“). CIC performs advisory, proposal and supervisory functions in the field of cyber-security policies, including the protection of national security in cyberspace. In addition, CIC has the following tasks:
Among the Decree’s main features is the establishment of the “National Cyber-security Agency” (“NCA” or “Agency“). The Decree specifies its functions by clarifying its composition and organisation. A special regulation, to be approved within 120 days from the entry into force of the Decree, shall define the Agency’s functioning, which is composed of eight general management level offices and thirty non-general management level offices within the available resources (art. 12 paragraph 1).
The Agency is the main body in the cyber-security field, acting as a national authority and centralising the various expertise hitherto attributed to other bodies, including those of the Ministry of Economic Development. Its tasks include:
The Agency is supported by the “Cyber-security unit“, which supports the Prime Minister, for aspects relating to the prevention and preparation for possible crises and the activation of warning procedures. The main tasks entrusted to this body include:
◊◊◊◊
By 30 April of each year, the Prime Minister must report to Parliament on the Agency’s activity in the previous year. As an Italian National Coordination Centre, the Agency will interface with the “European Cyber-security Industrial, Technology and Research Competence Centre“, contributing to increasing the European strategic autonomy in the sector.
Other related insights:
Under the Law No. 81 of 22 May 2017 on “Measures for the protection of non-entrepreneurial self-employment and measures aimed to facilitate flexibility in regard to locations and times of subordinate work”, smart working has been recently regulated in the Italian legal regime for the first time. This is a flexible style of working, regulated within the employment relationship and characterised by the absence of time- and workplace constraints and by forms of organisation of work by stages, cycles and objectives.
When implementing smart working in their company, employers must take personal data protection regulations into account.
Regulation (EU) 2016/679 on the protection of personal data (the “GDPR”) introduced the principle of accountability, namely the requirement for the data controller (in our case the employer) to take proactive steps to show that concrete measures have been put in place to ensure the implementation of this Regulation. Essentially, the employer is obliged to identify and manage risks associated with the data processing carried out, in accordance with the principle of data protection “by design” (involving the protection of specific data processing operations) and “by default”.
This means that, in the case of smart working, the employer must carry out a proper risk assessment and, where necessary, an impact assessment in order to analyse all existing and potential risks and identify the technical and organisational data security measures that are required in order to guarantee secure data protection operations. The employer, accordingly, must adopt Regulations, Policies or Guidelines which set out the conduct that smart workers must adopt in order to ensure the confidentiality, integrity and availability of data processed in the course of their duties.
The employer must also ascertain and verify that remote controls are not invasive in nature, in contravention of Article 4 of Law 300/1970. This means that the systems that allow continuous monitoring of employees’ use of work tools and the company network must be subject to detailed scrutiny.
For this very reason, smart workers must receive detailed information on the various ways in which the employer exercises its power of control, and on what forms of conduct could potentially trigger or attract disciplinary sanctions.
Beyond this, the employer must train smart workers so that they are fully cognisant of and familiar with the tools available to them, the various risks, and the measures to be adopted while smart working.
The exit of the United Kingdom from the European Union (“Brexit“) will have an impact on international mobility for work purposes and personal data transfer to the United Kingdom.
The United Kingdom allows EU citizens already present in the UK for at least five years on 31 December 2020, to request confirmation of their right of residence (for work, study, etc.) beyond that date. The request can be made online by 30 June 2021 by filling the EU Settlement Scheme made available on the British Government website, obtaining the settled status.
If the permanence period is less than five years, it will be possible to apply to remain in the United Kingdom to complete it by obtaining the pre-settled status through the above form. Unlike the settled status, pre-settled status is lost when a person is absent from the country for two or more years.
This procedure will guarantee the same rights that an EU citizen residing in the UK had before Brexit. They will be able to stay in the UK indefinitely, work, use the health service, study, and have access to public funds such as social benefits and pensions.
For new entrants from 1 January 2021, however, it will be necessary to apply for a visa under the new points-based immigration system.
Italy has a procedure for confirming the rights acquired by British citizens present in the country on 31 December 2020. They can request the “residence document in electronic format” at the local Questura (police station). The same procedures as for non-EU citizens will be applied to those who will enter the country after 1 January 2021.
For the transfer of personal data to the United Kingdom, the Italian Data Protection Authority (the “Guarantor”) clarifies that it is necessary to refer to the “Trade and Cooperation Agreement” (“Agreement”) signed on 30 December 2020 by the European Union and the United Kingdom (“Trade And Cooperation Agreement Between The European Union And The European Atomic Energy Community, Of The One Part, And The United Kingdom Of Great Britain And Northern Ireland, Of The Other Part”).
Under the Agreement, the Regulation (EU) 2016/679 on the protection of personal data (“GDPR”) will continue to apply in the United Kingdom for a maximum of six months, i.e. until 30 June 2021. According to the Guarantor, “during this period, any communication of personal data to the UK may take place under the same rules that applied on 31 December 2020 and will not be considered a transfer of data to a third-party country.”
During this transitional period, the United Kingdom and the European Union have undertaken to adopt mutual adequacy decisions under this Agreement. In the absence of such decisions, the provisions of Chapter V of the GDPR governing the transfer of data from the EU to third-party countries will apply. These provisions require the existence of adequate safeguards, such as binding corporate rules, standard contractual clauses, and codes of conduct (see Art. 46 of GDPR). This is subject to exceptions, such as data subject consent or a transfer necessary for contract purposes or important reasons of public interest (Art. 49 of GDPR).
From 1 January 2021, Data Controllers and Processors based in the UK and who are subject to GDPR because they process data for offering goods and services or monitoring the behaviour of data subjects within the EU (see Art. 3, paragraph 2, GDPR), shall designate a Representative in the European Economic Area under Article 27 of GDPR.
Other insights related: