The employee filed a complaint against the company, alleging improper use of her personal data extracted from her \u201cFacebook\u201d profile, the \u201cMessenger\u201d app, and certain chats from the \u201cWhatsApp\u201d platform. These data, made known to the company, were used to support two separate disciplinary notices. Referring to Article 8 of Law No. 300\/1970 (the Italian Workers\u2019 Statute), which prohibits the employer from carrying out investigations – including via third parties – into an employee\u2019s political, religious, or trade union opinions, as well as facts irrelevant to assessing the employee\u2019s professional aptitude, the company claimed it had played no active role in collecting the data. It argued that the information had been reported to it and could therefore be used for disciplinary purposes, as this would not constitute a prohibited investigation under the Workers\u2019 Statute. Other related insights:<\/strong><\/strong><\/p>\n\n\n\n
In the first notice, dated February 16, 2024, the company quoted the contents of some comments made by the complainant on her Facebook profile, including quoted excerpts and descriptions of certain photos. In the second notice, dated March 21, 2024, it referred to a conversation on Messenger between the complainant and a third party (not employed by the company) who forwarded the conversation to the company via WhatsApp, including quoted excerpts. This second notice also included excerpts from a WhatsApp message the complainant sent to some colleagues on February 22, 2024.<\/p>\n\n\n\n![\"\"](\"https:\/\/www.delucapartners.it\/wp-content\/uploads\/2025\/02\/shutterstock_1701231727-1024x623.jpg\")
<\/figure>\n\n\n\nThe Authority\u2019s position<\/strong><\/h2>\n\n\n\n
The Italian Data Protection Authority used the occasion to recall that:
– The legal system protects the freedom and confidentiality of communications, recognized as fundamental rights, and any limitation is allowed only \u201cby reasoned decision of the judicial authority, in accordance with the law\u201d (Article 15 of the Constitution). This presumption of confidentiality, as clarified by the Constitutional Court, extends to all communication tools made available by technological evolution. (Lawfulness principle)
– The mere publication of data on publicly accessible platforms, such as social networks, does not imply that the data subject has given general consent for the free use of that data for any purpose. A specific legal basis is required for any processing other than the original purpose. (Purpose limitation principle)
– The need for data processing based on legitimate interest – the justification cited by the company in its defense – must also be evaluated under the principle of minimization. The data controller must verify that \u201cthe legitimate interest pursued cannot reasonably be achieved through less harmful means for the fundamental rights of data subjects, particularly their right to privacy\u201d. In this case, the company failed to demonstrate that it had assessed the impact of the processing on the employee\u2019s rights or considered less intrusive alternatives, even though the disciplinary measures could have been based on other elements. (Data minimization principle)
The Authority clarified that while it is not tasked with evaluating the disciplinary facts themselves, it is the employer – as the data controller – who must assess not only the lawfulness but also the adequacy, relevance, and proportionality of the data processing to be carried out. The Authority found numerous violations by the company, which, \u201conce it became aware that the transmitted data concerned private communications and comments on a closed Facebook profile, [\u2026] should have refrained from using them.\u201d<\/p>\n\n\n\n