ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
and, at the same time, withdraw any consent previously given to the processing of their per - sonal data for telephone marketing purposes. In fact, the data controller who intends to carry out telemarketing activities is required to consult the register at least every 15 days or, in any event, before the start of a new campaign. On the other hand, online marketing may consist primarily of an activity carried out through the use of profiling and advertising cookies (see 4.1 Use of Cookies ), or of behavioural advertising and targeting activities carried out through the use of external databases (especially those of social networks). In this second case, the juris - prudence of the Court of Justice of the Euro - pean Union and the interpretation provided by the EDPB in Guidelines 8/2020 clarify the need to carry out the activity on the basis of the prior consent of the data subject and, as a general rule, to reconstruct the privacy roles between the company and the social network as joint con - trollers of the processing to be regulated under Article 26 of the GDPR. 4.3 Employment Privacy Law Processing carried out in the employment con - text is one of the sectors to which the GDPR defers to its regulation under national law, with - out prejudice to certain common guidelines and orientations first shared by WP29 and then by the EDPB, specifically regarding the vulnerable position of the data subject employee vis-à-vis the data controller employer (a situation that results in the presumption of the invalidity of any consents requested from the employee due to a lack of freedom). Managing the Selection Process and the Employment Relationship In these phases, the employer’s activities must respect – more than ever – the principle of mini -
misation, ensuring that only personal data that is essential for the performance of work duties and that, to a large extent, is governed by labour law provisions (eg, Article 8 of Law No 300/1970 or Legislative Decree No 81/2008) is requested
from the candidate or employee. Remote Monitoring of Workers
Without prejudice to a general prohibition on the use of instruments (also based on AI) to moni - tor employee activities, this case is governed by Article 4 of Law No 300/1970, which legitimises the use of such tools solely for organisational purposes and the protection of company assets (eg, cybersecurity purposes). In this case, with - out prejudice to instruments that are essential and prearranged for the performance of work duties, the use of instruments for remote moni- toring is permitted only if doing so is: • agreed with the trade union representatives present in the company; or • authorised by the competent Labour Inspec - torate in the absence of trade union repre - sentatives in the company or in the event of there being no agreement. In these cases, the employee data subject will have to be provided with additional and detailed information on what is normally provided for under Articles 13 and 14 of the GDPR; this can be done by adopting an internal regulation on the use of IT tools, for example, which also informs employees of the possible controls and their purposes. However, although the agreement with trade union representatives or administrative authori - sation is sufficient to legitimise the activity from the point of view of labour law, this does not exempt the employer from complying with the principles on the protection of personal data
234 CHAMBERS.COM
Powered by FlippingBook