“The employer may collect employees’ Internet browsing logs and email metadata only under specific conditions and safeguards. This was affirmed by the Italian Data Protection Authority (i.e. “Garante Privacy”) when imposing a €50,000 fine on the Lombardy Region” (Provision No. 243 of April 29, 2025).
As stated on the Authority’s official website, this ruling follows an inspection aimed at verifying the Region’s compliance with privacy regulations concerning the processing of employee data. The measure comes almost a year after the publication of the guidance document titled “Programs and IT services for managing e-mail in the workplace and the processing of metadata” (Provision No. 364 of June 6, 2024).
Although this case specifically involved public administration, it is worth clarifying that all findings, observations, and clarifications issued by the Authority fully apply to private-sector data controllers as well.
“Metadata” refers to information related to the sending, receiving, and routing of messages. This may include the sender’s and recipient’s email addresses, IP addresses of the servers or clients involved in message routing, timestamps of sending, retransmission or receipt, message size, presence and size of any attachments, and, in certain cases depending on the email management system used, even the subject of the sent or received message.
Browsing logs, on the other hand, allow tracking of activities during web navigation and contain data such as visited IP addresses, URLs of opened web pages, connection times and durations, type of device and browser used, as well as any downloads or uploads performed.
The June 6, 2024, guidance clarifies that the maximum retention period for such data is 21 days. Any retention beyond this period is permissible only under specific conditions that justify the extension, and, in any case, one of the safeguards provided by Italian law under Article 4 of Law No. 300/1970 (the Workers’ Statute) must be satisfied: (i) an agreement with trade unions or, failing that, (ii) authorization from the local Labour Inspectorate.
This is because all such information allows the employer to identify behavioral patterns, understand workers’ relationships and habits, and infer elements such as performance and productivity. In other words, it may amount to indirect remote monitoring of employees’ activities.
During the Authority’s inspection, it emerged that the Region retained:
Other related Insights:
By Judgment No. 315 of June 5, 2025, the Court of First Instance of Vicenza ruled that, for the purposes of territorial jurisdiction, the residence of a remote worker can only be considered relevant if it is demonstrated that a substantial and organized part of the work is carried out there on a stable basis, thereby anchoring the performance of the work to that location.
The employee, working as an external sales representative, contested his dismissal by bringing the case before the court in the district of his residence – where he also used the company – provided laptop and mobile phone.
The employer responded by raising a preliminary objection, challenging the court’s territorial jurisdiction.
The Court of first instance of Vicenza first referred to Article 413, paragraph 2 of the Italian Code of Civil Procedure, which, as is well-known, links territorial jurisdiction to three alternative criteria: namely, the district where (i) the employment relationship arose, (ii) the company or (iii) one of its branches to which the employee was assigned or where the employee performed work at the end of the employment relationship is located.
Following the Supreme Court’s previous rulings, the Court of first instance of Vicenza emphasized the need to interpret the concept of company branch broadly, in order to “make the proceedings more efficient and swift, anchoring them in locations normally closer to the employee’s residence, where the evidence necessary for the case can be more easily found” (Supreme Court judgments No. 506/2019 and No. 6458/2018).
That said, the Court of First Instance clarified that, in any case, “there must always be an objective or subjective connection between the place where the employee performs their work and the company’s organization.”
It should be considered that when remote work can be performed interchangeably from any location, without “any other element (or objective or subjective connection, as previously highlighted) emerging that would in any way characterize the employee’s residence as a company branch, in the sense described, then this criterion cannot be taken into account for determining territorial jurisdiction, leaving only the criteria of the place where the contract was concluded (…) or the office to which the employee was assigned (…).”
On this basis, the Court of First Instance of Vicenza – finding no evidence that a stable and organized portion of the employee’s fundamental work performance was carried out at his residence, so as to firmly anchor the activity to that place – upheld the employer’s objection of lack of territorial jurisdiction.
By Order No. 15987 of 2025, the Italian Supreme Court – Labour Section – reaffirmed the strict application of Article 1335 of the Civil Code, establishing that the presumption of knowledge of “legal notices” (i.e. “atti recettizi”) cannot be rebutted by subjective obstacles, even when the recipient is in a vulnerable physical or mental condition and the notification is intentionally concealed by a cohabiting family member.
The case concerned the dismissal of an employee due to permanent and absolute unsuitability, communicated via letter sent to the employee’s registered residential address. Specifically, the dismissal letter was duly delivered but collected by the employee’s mother, who deliberately withheld the information with the stated intention of protecting her son from potential psychological harm. As a result, the employee contested the dismissal after the statutory deadline had expired.
Both the Court of first instance and the Bologna Court of Appeal declared the employee’s appeal inadmissible due to the expiration of the challenge period, holding that the presumption of knowledge was perfected by the proper delivery of the notice to the recipient’s address.
The Supreme Court subsequently upheld the ruling of the Court of Appeal of Bologna. The core of the decision lies in the strict interpretation of Article 1335 of the Italian Civil Code, according to which a legal notice is presumed known from the moment it is received at the recipient’s address, unless the recipient proves that they were in an objective and blameless condition preventing them from becoming aware of it. Subjective impediments or acts of third-party cohabitants do not bear relevance in this context.
In this specific case, the Italian Supreme Court rejected the argument that the employee’s health condition or the mother’s decision to conceal the letter could constitute an objective impediment. These circumstances pertain to the recipient’s personal and family sphere and are insufficient to overcome the legal presumption of knowledge. Only external factors, beyond the recipient’s control – such as natural disasters, postal errors, or prolonged absence due to force majeure – may constitute valid grounds to rebut the presumption.
In conclusion, this ruling highlights the peremptory nature of the deadlines for contesting dismissals, even in situations where subjective elements prevent the employee from being made aware of the disciplinary measure imposed against them.
Other related insights:
In its judgment No. 19985 of 7 May 2025, the Italian Supreme Court (i.e. “Corte di Cassazione”) upheld the legitimacy of a dismissal for just cause issued to an employee who, in performing his duties as a cashier, had committed repeated accounting irregularities. These mainly involved the failure to register sales transactions and the omission of issuing fiscal receipts.
According to the Court, such conduct – although involving relatively small amounts and in the absence of clear evidence of misappropriation – was nonetheless sufficient to irreparably undermine the relationship of trust between the employer and the employee.
The case originated from an internal investigation initiated by the company through a private investigation firm, which uncovered repeated anomalies in the employee’s handling of cash transactions. These findings led to the initiation of disciplinary proceedings and the subsequent dismissal for just cause.
The dismissal was challenged in court by the employee.
The Court of first istance, by way of an interim order issued at the end of the summary phase under Article 1, paragraphs 51 et seq. of Law No. 92/2012, and a subsequent confirmatory judgment issued at the opposition stage, upheld the employee’s claim. It annulled the employer’s dismissal and ordered the payment of compensation.
According to the first-instance judge, the employer had failed to provide sufficient evidence to support the allegations made against the employee. In particular, the accounting records submitted by the company were deemed unreliable; the identified cash discrepancies were considered to be within normal operational margins and not disciplinarily relevant. Furthermore, the absence of a precise correlation between unrecorded transactions and cash surpluses did not, in the court’s view, support an inference of misappropriation. The Court also noted that the shared use of the same cash register by multiple employees, all operating under a single identification code, made it impossible to conclusively attribute the irregularities to the dismissed worker.
The Court of Appeal overturned the lower court’s decision, upheld the employer’s appeal, and fully rejected the employee’s challenge.
In contrast with the first-instance rulings, the Court of Appeal found that the allegations had been sufficiently substantiated through a set of consistent circumstantial elements, including statements from the investigative personnel, evidence of cash shortages, and a thorough evaluation of witness and documentary evidence.
As a result, the appellate judges deemed the dismissal lawful, holding that the employee’s conduct – given the nature of his role and despite the relatively small sums involved – constituted a serious and repeated breach of the duties of honesty and loyalty, thus justifying the immediate termination of the employment relationship.
The employee filed an appeal before the Italian Supreme Court, raising five grounds of challenge, including the alleged failure by the Court of Appeal to examine key facts of the case – specifically, the claim that the employee had appropriated the proceeds from sales.
The Supreme Court dismissed the appeal in its entirety, fully upholding the lower Court’s decision. According to the Court, dismissal for just cause can be justified without proving misappropriation in the strict legal sense. It is sufficient that the employee’s conduct – by its objective and subjective seriousness – is capable of irreparably damaging the bond of trust with the employer.
In the case at hand, the repeated failure to record sales and to issue receipts, without any plausible justification, amounted to willful misconduct. Even in the absence of a significant financial loss, such behavior undermines the employee’s future reliability in the performance of his duties.
The Court further reiterated that the principle of proportionality must be assessed not only in relation to the actual economic damage, but also with regard to the nature and frequency of the violations, as well as the employee’s role within the company. The modest amount of money involved is therefore irrelevant; what prevails is the need to safeguard the integrity of the fiduciary relationship – particularly where the conduct is repeated over time and clearly attributable to the employee.
In conclusion, the Supreme Court held that the failure to record cash transactions and issue fiscal receipts – even for small amounts – may constitute just cause for dismissal when such conduct reflects a willful, repeated, and disloyal attitude that irreparably undermines the employer’s trust. Specific proof of misappropriation is not required; it is sufficient that the behavior gives rise to serious doubts about the employee’s future trustworthiness.
Continue reading the full version published on Norme & Tributi Diritto de Il Sole 24 Ore.
Legislative Decree No. 23/2015 survived the recent referendum on June 8 and 9, which, with a turnout of 30.6 percent, did not reach a quorum. The result is not surprising, but the repeal of Legislative Decree No. 23/2015 would, in any case, have been of little consequence from the point of view of the protections offered to workers.
Recall that the system of ‘increasing protections’ was born, as part of the 2014 labor market reform, to create an organic discipline of the sanctioning apparatus of illegitimate dismissals announced, both by employers with more than 15 employees and by those ‘sub-threshold’, to workers hired since March 7, 2015. In the intentions of the legislature, the reform was supposed to come into force gradually being, precisely, intended to apply only to new employment relationships initiated from that date.
Compared to Article 18 of the Workers’ Statute, which had already been deeply amended by the ‘Fornero Reform’ in 2012, Legislative Decree No. 23/2015 aimed to introduce a new system of protections based on two principles. The first, the introduction of a compensation indemnity increasing according to the length of service of the employee concerned and, the second, the limitation of the scope of application of reinstatement protection. In fact, the reform in question had provided, in line with the disciplines adopted in Germany and Spain, a rigid mathematical formula parameterized by seniority, to eliminate the discretion of judges in determining compensatory indemnities.
Continue reading the full version published on Radiocor of Il Sole 24 Ore.
