In Provision No. 288 of May 21, 2025, the Italian Data Protection Authority fined an Italian company €420,000 for unlawful processing of an employee’s personal data later used to justify her dismissal.
The employee filed a complaint against the company, alleging improper use of her personal data extracted from her “Facebook” profile, the “Messenger” app, and certain chats from the “WhatsApp” platform. These data, made known to the company, were used to support two separate disciplinary notices.
In the first notice, dated February 16, 2024, the company quoted the contents of some comments made by the complainant on her Facebook profile, including quoted excerpts and descriptions of certain photos. In the second notice, dated March 21, 2024, it referred to a conversation on Messenger between the complainant and a third party (not employed by the company) who forwarded the conversation to the company via WhatsApp, including quoted excerpts. This second notice also included excerpts from a WhatsApp message the complainant sent to some colleagues on February 22, 2024.
Referring to Article 8 of Law No. 300/1970 (the Italian Workers’ Statute), which prohibits the employer from carrying out investigations – including via third parties – into an employee’s political, religious, or trade union opinions, as well as facts irrelevant to assessing the employee’s professional aptitude, the company claimed it had played no active role in collecting the data. It argued that the information had been reported to it and could therefore be used for disciplinary purposes, as this would not constitute a prohibited investigation under the Workers’ Statute.
The Italian Data Protection Authority used the occasion to recall that:
– The legal system protects the freedom and confidentiality of communications, recognized as fundamental rights, and any limitation is allowed only “by reasoned decision of the judicial authority, in accordance with the law” (Article 15 of the Constitution). This presumption of confidentiality, as clarified by the Constitutional Court, extends to all communication tools made available by technological evolution. (Lawfulness principle)
– The mere publication of data on publicly accessible platforms, such as social networks, does not imply that the data subject has given general consent for the free use of that data for any purpose. A specific legal basis is required for any processing other than the original purpose. (Purpose limitation principle)
– The need for data processing based on legitimate interest – the justification cited by the company in its defense – must also be evaluated under the principle of minimization. The data controller must verify that “the legitimate interest pursued cannot reasonably be achieved through less harmful means for the fundamental rights of data subjects, particularly their right to privacy”. In this case, the company failed to demonstrate that it had assessed the impact of the processing on the employee’s rights or considered less intrusive alternatives, even though the disciplinary measures could have been based on other elements. (Data minimization principle)
The Authority clarified that while it is not tasked with evaluating the disciplinary facts themselves, it is the employer – as the data controller – who must assess not only the lawfulness but also the adequacy, relevance, and proportionality of the data processing to be carried out. The Authority found numerous violations by the company, which, “once it became aware that the transmitted data concerned private communications and comments on a closed Facebook profile, […] should have refrained from using them.”
Other related insights:
Managing employee surveillance is a sensitive issue, especially with the rise of new technologies. Recent rulings from Italy’s Court of Cassation have clarified the legal boundaries surrounding this practice.
The role of Investigative Agencies
Employers may use private investigators to check potential employee misconduct, such as unapproved absences or misuse of leave. However, these investigations must be focused, proportional, and lawful, ensuring they do not interfere with an employee’s work duties.
Monitoring company devices
Employers may need to access employees’ devices, such as emails or laptops, especially when there is reasonable suspicion of misconduct. The Italian Supreme Court has recently clarified that checking an employee’s email is only permitted when there is concrete suspicion, and such checks must not be arbitrary or excessive.
Balancing business needs and employee privacy
It is essential to strike a balance between business needs and employee privacy. Surveillance must be justified, proportionate, and never indiscriminate. Employers must ensure they follow legal guidelines to avoid misuse of the information collected.
Best practices
By following these principles, employers can protect their business interests while respecting employee privacy.
Continue reading the full version published on Agenda Digitale.
Exceeding the sick leave period represents a delicate balance between employee rights and business needs. Over the years, case law has provided important guidance on the matter. What checks must the employer carry out, and what are the employee’s responsibilities?
The issue of exceeding the sick leave period is a key aspect of human resource management. On the one hand, employees suffering from serious or prolonged illnesses need sufficient time off to recover without losing their job. On the other hand, businesses must ensure operational continuity and may struggle to manage prolonged absences.
Managing the exceeding of the sick leave period requires a balanced and careful approach. Employers must verify compliance with contractual regulations and act in good faith, avoiding hasty or discriminatory measures.
Employees, in turn, have a duty to properly communicate their condition and comply with the rules set by their contract and the law. Over time, case law has provided essential guidance to balance these interests. However, only a case-by-case assessment can ensure the right equilibrium between employee protection and business needs.
The accrual period is mainly regulated by Article 2110 of the Civil Code, which states that in the event of illness, the employee has the right to keep his job for a period determined by collective agreements. Once this limit has been exceeded, the employer may terminate the relationship, subject to the right to compensation for notice.
Moreover, Law 300/1970 (Workers’ Statute) in Article 18 goes into the merits of the termination of employment: the rule protects the worker from dismissals announced in violation of Article 2110, second paragraph, of the Civil Code, providing the right to reinstatement in the workplace.
Over the years, several Supreme Court rulings have made headlines regarding the exceeding of the sick leave period and have clarified that the employer must consider the specific situation of the employee and evaluate possible alternatives before proceeding with dismissal.
In addition to the case that gained media attention of an employee dismissed when only a few days remained before the end of the sick leave period (Supreme Court Ruling No. 24766/2017), here are some rulings that have made history:
To avoid legal disputes, the employer must carry out careful checks before taking disciplinary measures. In particular, they must:
Continue reading the full version published on HR Link.
The negative implications of criminally unlawful acts on the proper execution of work performance, in compliance with the employee’s obligations, constitute just cause for dismissal.
The Supreme Court, in ruling no. 31866 of December 11, 2024, established that unlawful conduct outside the workplace may have disciplinary relevance, as the employee is not only required to perform the assigned tasks but also, as an ancillary obligation, to refrain from engaging in behaviors outside the workplace that could harm the employer’s moral and material interests or compromise the relationship of trust. If such conduct is of a particularly serious nature, it may also justify dismissal for just cause.
As is well known, Article 2119 of the Civil Code defines just cause for termination as “a cause that does not allow the continuation, even temporarily, of the employment relationship.” This means an event, attributable to one of the parties, of such severity that any alternative to immediate termination would be inadequate to protect the interests of the terminating party.
The concept of just cause is rooted in the broad scope of its definition and is classified among the so-called “general clauses” (Supreme Court ruling no. 10964 of May 8, 2018). It is an open-ended concept that requires interpretation through the assessment of factual elements (including the evolution of social awareness and the perception of the severity of certain events) and legal considerations.
As stated by the Supreme Court, “just cause for dismissal is a concept that the law, in order to adapt regulations to a complex and ever-changing reality, defines through a provision (classified among the so-called general clauses) with limited content, outlining a generic model that requires specification through interpretation by considering both external factors related to general awareness and the principles implicitly referenced by the provision itself” (Supreme Court, September 30, 2022, No. 28515).
Moreover, it has been recently reaffirmed that the consideration of external factors related to general awareness is an integral part of the interpretative process (Supreme Court, August 22, 2024, No. 23029).
In outlining the types of employee behavior that may constitute just cause for dismissal, case law has established that the breach of trust may result either from a violation of contractual obligations or from off-duty conduct.
An employee is required not only to fulfill contractual obligations but also to adhere to ancillary behavioral duties, which, even outside the workplace, mandate the protection of the employer’s moral and financial interests. Violating these obligations undermines the trust necessary for the proper continuation of the employment relationship.
For example, in several cases, the courts have deemed violations of the so-called “minimum ethical standard” as just cause for dismissal. This refers to conduct that any reasonable person—including the employee—should recognize as contrary to the fundamental principles of civil coexistence, fairness, and good faith.
One significant case involved the dismissal for just cause of a school bus driver following a final criminal conviction for engaging in acts unequivocally aimed at causing the termination of his partner’s pregnancy. The Supreme Court of Cassation upheld the legitimacy of the dismissal, citing the objective severity of the offense and its social disvalue, which directly impacted the employer’s public image (Supreme Court, April 3, 2024, No. 8728).
Similarly, the off-duty possession of a significant quantity of narcotics for trafficking purposes was considered to seriously affect the employment relationship, particularly in terms of the employee’s future reliability. The Supreme Court ruled that an employee is required not only to perform their assigned tasks but also to refrain from behaviors—outside the workplace—that could compromise the trust-based relationship with the employer, which is subject to the assessment of the trial judge (Supreme Court, August 6, 2015, No. 16524).
In that case, the Supreme Court upheld the lower court’s decision, which had deemed the employee’s conduct particularly severe in terms of future reliability. The employee, a “chef de rang” at a thermal resort, was responsible for room service, a role involving frequent contact with guests. The court found the conduct even more serious given that the drugs were purchased from a colleague.
Continue reading the full version published on Modulo 24 Contenzioso Lavoro.
According to Article 29, paragraph 2, of Legislative Decree 276/2003 (known as the “Legge Biagi”), in the context of service contracts (“contratti di appalto” in Italian parlance), the principal company or employer is jointly and severally liable with the contractor, as well as with any subcontractors, within two years after the termination of the contract, for the payment of amounts owed to workers for work performed during the contract period, including:
However, joint and several liability does not apply to civil sanctions, for which only the defaulting party is responsible.
Consequently, in the context of service contracts, although the obligation to pay salaries and social security contributions falls on the contractor — the company directly hiring the workers and managing the service contract — Italian law assigns the principal a “guarantee” role regarding these obligations, introducing a genuine joint obligation on the principal.
In concrete, this guarantee allows workers to act against either the contractor or the principal to obtain payment of unpaid salaries owed for work performed under the service contract.
Moreover, the principal’s joint and several liability also applies to compensation and social security obligations of self-employment workers, pursuant to Article 9 of Legislative Decree 76/2013, converted with amendments into Law No. 99 of August 9, 2013.
The principal’s joint and several liability is subject to a two-year limitation period, starting from the termination of the contract. However, this two-year period applies exclusively to claims made by workers, while, according to case law, it does not apply to recovery actions initiated by social security or insurance institutions such as INPS (the Italian National Social Insurance Agency) or INAIL (the Italian National Institute for Insurance against Accidents at Work), which remain subject to a five-year statutory limitation period.
The principal, who, due to joint and several liability, has paid the workers the salaries or contributions owed, may seek recovery from the contractor under the general rules provided by the Civil Code. However, the principal can no longer invoke the benefit of prior enforcement against the contractor, as was allowed until 2017.
Finally, the Court of Cassation recently stated that joint and several liability between the principal and the contractor is not limited to contracts formally classified as “service contracts”. It applies whenever workers are employed in a mechanism of outsourcingwhere “detachment between the ownership of the employment relationship and the utilization of the labor activity was established, which could justify applying the guarantee provided by Article 29” (see Court of Cassation, Labor Section, order no. 26881 of October 16, 2024). Based on this principle, joint liability has been deemed applicable, for example, in cases of “department delegation contracts” (“affidamento di reparto” in Italian parlance) or supply contracts.
Other related insights:
