Cameras in the warehouse, trackers on delivery vans, software logging access to company systems: tools that make it possible to observe work are increasingly common. Employers have legitimate needs for security and organisation, but workers are entitled not to be monitored continuously and covertly. In Italy the balance between these interests is governed by a specific rule that sits alongside the GDPR.
The basic rule: Article 4 of the Workers' Statute
Article 4 of Law no. 300 of 20 May 1970, in its current wording, provides that audiovisual systems and other tools that also make it possible to monitor workers' activity remotely may be installed only for:
- organisational and production needs;
- workplace safety;
- protection of company assets.
In addition, installation requires a collective agreement with the company's trade union representatives or, failing that, authorisation from the Labour Inspectorate. Without one of these steps the system may not be installed, even if the stated purpose is lawful.
Deliberately monitoring work activity as such, meaning watching how much and how a person works, is not among the permitted purposes.
Work tools
The same article provides that an agreement or authorisation is not needed for:
- the tools the worker uses to perform their job, such as the computer, the company smartphone or the email account;
- tools for recording access and attendance, such as badges.
This does not mean anything goes with these tools: the employer must still comply with data protection law.
The notice requirement
Information collected with these tools may be used for all purposes connected with the employment relationship, including disciplinary ones, only if the worker has received adequate information on how the tools are used and how checks are carried out, and in compliance with privacy law.
In practice, the company should provide a policy explaining:
- which tools are in use and what they record;
- how long the data is kept;
- who can access it and in what circumstances;
- how checks may be carried out, preferably in stages, starting with reviews of aggregate data.
The GDPR in the workplace
Article 88 GDPR allows Member States to adopt more specific rules for processing data in the employment context, and the Italian Privacy Code expressly refers to the Workers' Statute. The general principles of Article 5 still apply: specified purposes, minimisation, storage limitation, transparency.
| Tool | What is reasonable | What is problematic |
|---|---|---|
| Cameras | Filming entrances, tills and warehouses for security and asset protection | Fixed views of a single employee's workstation; cameras in changing rooms and toilets |
| GPS on vehicles | Location for logistics and safety, with notice | Continuous tracking outside working hours too |
| Work email | Retention for business continuity, under known rules | Systematic reading of messages without rules or notice |
| Web browsing | Filters on categories of websites | Detailed, permanent logging of every page visited |
Opinions and private life
Article 8 of the Workers' Statute forbids employers from investigating, directly or through third parties, workers' political, religious or trade union opinions and facts not relevant to assessing their professional aptitude. This also applies to looking into employees' personal social media profiles.
Workers' rights
As data subjects, workers can exercise their GDPR rights against the employer:
- access to data concerning them, including recordings and logs, under Article 15;
- rectification of inaccurate data, for example in recorded attendance;
- information on purposes, retention periods and recipients, which should already appear in the Article 13 privacy notice;
- a complaint to the data protection authority if they believe the processing is unlawful.
For breaches of Article 4 of the Statute, trade union representatives and the Labour Inspectorate can also be involved.
A concrete example
A shop installs a camera pointing at the till, with no sign and no union agreement. Even if the stated aim is to prevent theft, the system was installed without the required procedure and the footage should not be used against employees. An employee can ask the company whether an agreement or authorisation exists and obtain a copy of the privacy notice.
In short
- Article 4 of the Workers' Statute allows remote monitoring tools only for organisational needs, safety and asset protection.
- Cameras require a union agreement or authorisation from the Labour Inspectorate.
- Computers, smartphones and badges need no agreement, but the data can be used only with adequate notice.
- Employers may not investigate opinions and private facts unrelated to work.
- Workers can exercise access and rectification and complain to the data protection authority.