Do I need consent to process employee data?

The consent is generally not a lawful legal basis on which rely on in the processing of personal data of the employee. Indeed, the relationship between employer (data controller) and employee (data subject) results in an imbalance of powers. Due to the nature of such relationship, it is therefore unlikely that the employee is able to deny his consent and the consent would not be freely given. The consent could be a lawful legal basis only in exceptional circumstances, when the employer can demonstrate that the employee will not suffer any adverse consequence in case, he denies his consent. The processing of the personal data of the employee carried out by the employer usually relies on a legal basis different from consent, such as the performance of the employment agreement or a legal obligation.

What are the privacy and data protection issues inherent in alcohol / drug testing?

Please note that alcohol/drug testing cannot be demanded indiscriminately by the employer but only when the nature of the activities and/or the specific tasks authorise its demand. The personal data related to alcohol / drug testing of the employee are accessible only to the company doctor and not to the employer.

How can I legitimately monitor employees’ email, internet usage and social media?

In Italy, monitoring via electronic devices of employees is prohibited. Where monitoring is necessary for security reasons and/or in any case related to corporate welfare, it is possible to derogate from the prohibition through specific authorisation procedures that may also involve trade unions.

It is then possible that the control is a consequence and automatic effect of the type of device (tablet, smartphone, company mail, etc.) used by the employee to perform his duties.

In this case, the company may carry out checks and collect data, but only if the employee has been informed in advance by means of a specific and detailed information notice and if the data collected are used by the company for reasons and purposes related to the employment relationship.

What are the limits of using artificial intelligence in employment?

The Italian legislator has recently regulated the implementation in the management of the employment relationship of automated decision-making systems, such as those based on artificial intelligence, used in different areas of the employment relationship, such as recruitment, termination, assignment of tasks, evaluation, fulfilment of contractual obligations. According to such regulation, before the establishment of the employment relationship, the employer must provide the employee with detailed information on such systems, such as the aspects of the employment relationship affected by the use of the same; their purposes, aims and operating logic; the data categories and main parameters used to program or train the systems; the control measures and correction processes; the level of accuracy and cybersecurity of the systems.

What are the data protection issues in whistleblowing?

The confidentiality on the identity of the whistle-blower must be guaranteed. Therefore, specific technical and organizational measures to ensure a level of security appropriate to the risk must be implemented to all processing related the personal data of the whistle-blower and the information related to the reporting. The whistle-blower must be provided with a data protection notice specifying, among others, the subjects to whom his personal data will be disclosed, and the record of processing activities must contain a specific section related to the processing of personal data related to whistleblowing. Furthermore, according to a specific provision of the Italian Data Protection Code, the rights under article 15-22 GDPR may not be exercised by making a request to the controller or lodging a complaint to the Supervisory Authority if the exercise of such rights may prove factually, effectively detrimental to confidentiality regarding the identity of whistle-blowers.