ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
Managing the Selection Process and the Employment Relationship
Guidelines adopted by the GPDP on 1 March 2007 or the Guidelines on the metadata collected through the use of email accounts. Whistle-Blowing and the Transparency Decree The national legislation on whistle-blowing was updat - ed to transpose Directive (EU) 2019/1937 through Legislative Decree No 2023/24, which made discipline uniform between the private and public sectors. With regard to the protection of personal data, the general principles dictated by the GDPR remain valid, con - cerning the obligations to set up reporting and man - agement processes in compliance with the principles of privacy by default and by design, and with the need to ensure the confidentiality of the reporter (resulting in the inadequacy, for instance, of the email channel), carry out a Data Protection Impact Assessment (DPIA) on the processing, train and instruct the people who access the data and manage the reports, etc. Further obligations (mainly informative) are also imposed by Legislative Decree No 104/2022 (the so- called “Transparency Decree”), which prescribes the need to carry out a DPIA and to provide additional information to data subjects in the event of “the use of automated decision-making or monitoring systems designed to provide indications relevant to the recruit - ment or assignment, management or termination of the employment relationship, the assignment of tasks or duties, as well as indications affecting the monitor - ing, assessment, performance and fulfilment of con - The value of personal data and consent databases as a corporate asset is often underestimated in corpo - rate transactions. In this context, with regards to the sector in question, the main activity may consist of verifying the lawfulness and correctness of the pro - cessing of personal data that makes up a company’s databases; this can be done by verifying the correct - ness and completeness of the information that the data controller had to provide to the data subjects pursuant to Articles 13 and 14 of the GDPR, and by examining the evidence of compliance with this infor - mation notice obligation. tractual obligations of workers”. 4.4 Data Protection in M&A
In these phases, the employer’s activities must respect – more than ever – the principle of minimisation, ensur - ing that only personal data that is essential for the per - formance of work duties and that, to a large extent, is governed by labour law provisions (eg, Article 8 of Law No 300/1970 or Legislative Decree No 81/2008) is requested from the candidate or employee. Remote Monitoring of Workers Without prejudice to a general prohibition on the use of instruments (also based on AI) to monitor employee activities, this case is governed by Article 4 of Law No 300/1970, which legitimises the use of such tools solely for organisational purposes and the protection of company assets (eg, cybersecurity purposes). In this case, without prejudice to instruments that are essential and prearranged for the performance of work duties, the use of instruments for remote moni- toring is permitted only if doing so is: • agreed with the trade union representatives present in the company; or • authorised by the competent Labour Inspectorate in the absence of trade union representatives in the company or in the event of there being no agree - ment. In these cases, the employee data subject will have to be provided with additional and detailed informa - tion on what is normally provided for under Articles 13 and 14 of the GDPR; this can be done by adopting an internal regulation on the use of IT tools, for example, which also informs employees of the possible controls and their purposes. However, although the agreement with trade union representatives or administrative authorisation is suf - ficient to legitimise the activity from the point of view of labour law, this does not exempt the employer from complying with the principles on the protection of per - sonal data (eg, the principle of minimisation). In this sense, unencrypted or clear monitoring of the URLs surfed by employees is unlawful because, in terms of security purposes, the same results can be achieved by implementing filters that inhibit the surfing of potentially risky websites. On this point, see also the
210 CHAMBERS.COM
Powered by FlippingBook