With an Order dated 11 January 2023, the Italian Data Protection Authority (Autorità Garante per la protezione dei dati personali, the ‘Authority’) imposed on a company the payment of an administrative fine equal to EUR 5,000 for having kept active and read the contents of the email account of a collaborator.

The facts

During some negotiations aimed at defining the acquisition of a cooperative company, a company agreed that a representative of the latter should collaborate, using the name of the purchasing company, in the promotion of a common supplier on the occasion of a trade fair.

A company email account was then activated for the collaborator in order to allow her to communicate with potential customers met at the event.

A few months later, the negotiations between the two companies were interrupted and the complainant requested the deactivation of the email account assigned to her. In order not to lose the contacts of potential new customers collected during the event, the company kept the account active and set up a system for forwarding incoming communications to the sales manager’s email, deactivating the complainant’s email address only after (approximately) six months from activation.

The outcome of the investigation by the Authority

The Authority first of all noted that the company has not complied with its obligation to inform the complainant about the processing of data carried out on her email account as instead required by Article 13 of Regulation (EU) 2016/679 (the ‘Regulation’). This obligation, the Authority recalls, also applies in the context of any pre-contractual negotiations as an expression of the principles of fairness and transparency (see Article 5 of the Regulation).

In the present case, the company:

1. processed personal data in the absence of a legitimation criterion to the extent that it has (i) viewed, without an appropriate legal basis, the correspondence received and sent to the account during collaboration with the complainant and (ii) set up, at the end of the collaboration, an automatic email forwarding system to a different company account;
2. did not achieve an adequate balancing of ‘the interests at stake’: on the one hand, in fact, the need for the company to continue its economic activities is recognized and on the other, the right to privacy of the data subject (namely the complainant). In this regard, the order reads, ‘the (legitimate) purpose of not losing useful contacts for one’s commercial activity, […], could have been pursued with less invasive processing activities and, therefore, compliant with data protection regulations, with respect to that carried out in the present case’;
3. did not comply with the obligation to facilitate the exercise of the rights of the data subject to the extent that it has not provided a suitable response to the request for cancellation – the so-called ‘right to be forgotten’ – submitted several times by the complainant.

◊◊◊◊

That said, the Authority recalls that: ‘[…] the legitimate interest in processing personal data to defend one’s legal claim [can]not lead to an a priori cancellation of the right to the protection of personal data recognized to the data subjects […]’.

The order in question also recalls a well-established orientation of the Authority according to which an adequate balancing of the interests as mentioned in letter b) above is achieved by activating an automatic response system with which the sender is provided with alternative addresses through which to contact the company, data controller, without accessing incoming communications, as instead done in the case in question in breach, among others, of the principle of data minimization (see Article 5 of the Regulation).

Other related insights:

Employers who keep the former employee’s email account active commits an offence

Company e-mail account and data processing (Legal – Le Fonti, N. 24 May 2018, Vittorio De Luca)

With judgment No 6902 of 8 March 2023 (which follows two further similar rulings: judgments No 5788 and No 5796, both dated 24 February 2023, of the Italian Court of Cassation), the Italian Supreme Court of Cassation ruled that the transferred employee, who sees the employment relationship with the transferor judicially restored, is not entitled to remuneration for the period between the date of transfer of the business branch and that of the publication of the judicial provision declaring the illegitimacy of the aforementioned transfer and can obtain compensation for the damage suffered due to the unjustified refusal of the transferor employer to receive his/her service only starting from the moment in which formal notice was provided to the transferor employer.

The facts of the case and the proceedings in first and second instances

Following the transfer of a business branch – subsequently declared unlawful in the context of separate proceedings – a transferred employee summoned the transferor company before the Court, seeking for the latter to be ordered to pay the damages consisting of the difference between what the employee transferred would have received if the transfer had not been implemented and how much, however, he received from the transferee.

As part of the proceedings, it was ascertained that the transferor company’s formal notice by the transferred employee occurred only after the judgment which had declared, with effect ex tunc, the illegality of the transfer.

The Court of Appeal upheld the employee’s request, ascertaining the right of the transferred employee to compensation for the damage suffered as a result of the invalid transfer, for the period from the date of the transfer and until the formal notice.

The ruling of the Italian Supreme Court

The transferor Company appealed to the Italian Court of Cassation against the judgment rendered by the Italian Territorial Court, challenging the contested judgment for having recognized amounts by way of compensation for damages also for the period prior to the formal offer of work by the transferred employee.

The Italian Court of Cassation – overturning the decision of the Court of Appeal – noted that, in the time span between the transfer to the transferee’s employment and the judicial assessment of the illegitimacy of the transfer, the lack of work performance in favour of the transferor excludes the right to receive remuneration from the transferor.

According to the Judges of the Court of Cassation, for this period, the transferor can only be held liable for compensation for any damages commensurate with the lost wages.

All of this, however, on condition that the transferred employee has previously taken steps to give formal notice to the employer, remaining available to perform his services or by enjoining the employer to receive the service.

And in fact – continues the Court – only from the moment in which the employee has taken steps to give formal notice to the transferor employer, the same will be able to obtain, pursuant to Article 1217 of the Italian Civil Code, compensation for the damage suffered due to the unjustified refusal of the employer to receive it, deducting any aliunde perceptum.

On these assumptions, the Italian Supreme Court therefore upheld the appeal filed by the transferor company, declaring that no compensation for damages was due to the employee for the period between the transfer and the formal notice of the transferor company.

Other related insights:

 The Court of Cassation rules on business branch transfers

Contract term ineffectiveness if there is a company transfer

Italian Legislative Decree no. 24 of 10 March 2023 (the ‘Decree’), implementing Directive (EU) 2019/1937 and ‘on the protection of persons who report breaches of Union law and containing provisions concerning the protection of persons who report breaches of national regulatory provisions’ (so-called Whistleblowing Directive),has been published in the Italian Official Gazette no. 63 of 15 March 2023.

The provisions referred to in the Decree apply, among others, to entities in the private sector that in the last year:

• have employed an average of at least 50 workers with permanent or fixed-term employment contracts;
• despite having employed fewer than 50 workers, adopt organization and management models envisaged by Italian Legislative Decree 231/2001 (Modelli di organizzazione e gestione – “MOG“).

Entities in the private sector, having heard the trade unions’ representatives or organisations, must set up and activate internal reporting channels that guarantee the confidentiality of the identity (i) of the reporting person, (ii) of the person concerned or of the person in any case referred to in the report as well as (iii) the content of the report and related documentation.

The management of the internal reporting channels can be entrusted (i) internally, to a person or to an autonomous internal office dedicated to this and made up of personnel specifically trained for the management of the reporting channel or (ii) externally to a third party, also autonomous and with specifically trained personnel. Furthermore, specific procedures for managing the internal reporting channels are envisaged which must be promptly implemented and applied by the employers and the information relating to the channel, the procedures and the conditions for making reports shall be displayed and made easily visible to all recipients.

Any processing of personal data must be carried out in compliance with current legislation on the protection of personal data, today represented by Regulation (EU) 2016/679 (the ‘GDPR’) and by Italian Legislative Decree 196/2003, as amended by Italian Legislative Decree 101/2018 (the ‘Privacy Code’). Employers addressees of the new legislation must therefore adopt all the necessary formalities required by the legislation on the subject of protection and safeguard of personal data processed.

For the violation of the provisions of the Decree, the imposition of administrative sanctions ranging from EUR 10,000 to 50,000 is envisaged:

• when retaliation is committed against the whistle-blowers, it is ascertained that the report has been obstructed, an attempt has been made to hinder it or the confidentiality obligation has been breaches;
• if reporting channels have not been established, procedures for making and managing reports have not been adopted or the adoption of the procedures does not comply with the provisions of the Decree.

Penalties ranging from EUR 500 to 2,500 are also envisaged in the cases in which the criminal liability of the whistle-blower for the crimes of defamation or slander is ascertained.

The provisions of the Decree take effect from 15 July 2023 (17 December 2023 for companies with over 249 employees).

Other related insights:

De Luca & Partners and HR Capital launch a new whistleblowing task force (Legalcommunity, 6 February 2023) – De Luca & Partners (delucapartners.it)

DID YOU KNOW THAT… The transposition of the (EU) Whistleblowing Directive will lead to new employer obligations?

De Luca & Partners signed off on the Italian pages of the Employment & Labour Law guide, 2022 edition published by English publisher Global Legal Insights. The volume gathers information and analysis on employment trends, changes in the legislative framework, relevant rulings, and reforms in progress and under discussion in 18 countries. Aimed at General Counsel, HR professionals, lawyers, advisors and managers who wish to have a series of useful global snapshots on relevant labour law issues, the Employment & Labour Law guide is now online.

Request the pdf of the Italy chapter by filling out the form below.

Alberto De Luca contributed to the drafting of the chapter dedicated to Italy in the “Labour & Employment” guide published by Lexology, illustrating the main legislative and jurisprudential news in a labour law manner and providing his point of view.

Click here to read more.