Tutela della privacy e potere di controllo del datore di lavoro tra l’ordinamento italiano e le fonti europee
10.6092/issn.2421-2695/7576
L’articolo analizza la riforma dell’art. 4 St. lav. sul controllo a distanza dei lavoratori e verifica l’impatto di questa riforma sul divieto di indagini sulle opinioni previsto dall’art. 8 St. lav.Nell’ambito della descrizione dell’ultima modifica legislativa, l’articolo presenta un’analisi del rapporto tra le nuove regole sul potere di controllo datoriale e la legislazione relativa alla protezione dei dati. Da questo punto di vista, vengono forniti dettagli in merito al quadro europeo e internazionale, in particolar modo in relazione al nuovo Regolamento europeo 2016/679.
application/pdf
2421-2695
7576
2
en
Laura Tebano
Labour & Law Issues
Tutela della privacy e potere di controllo del datore di lavoro tra l’ordinamento italiano e le fonti europee
Text.Serial.Journal
https://labourlaw.unibo.it/
3
Comparative & International Overview
2017-12-14
2017-12-14
2017-12-14
2019-05-20
C. 1-20
LLI
Laura Tebano
2017/12/14
10.6092/issn.2421-2695/7576
C. 1
Università di Napoli, Federico II
2421-2695
2
en
20
Zilio Grandi G. - Biasi M. (eds.), Commentario breve alla riforma “Jobs Act”, Cedam, 2016.
Employees’ Privacy and employers’ control between the Italian legal system and European sources
https://labourlaw.unibo.it/article/download/7576/7279
3
Employees’ Privacy and employers’ control
    between the Italian legal system
        and European sources



              LAURA TEBANO
       Università Federico II di Napoli




              vol. 3, no. 2, 2017
                ISSN: 2421-2695
   Employees’ Privacy and employers’ control
       between the Italian legal system
           and European sources

                                                            LAURA TEBANO
                                             Università di Napoli, Federico II
                                 Professoressa Associata in Diritto del Lavoro
                                                        laura.tebano@unina.it



                                 ABSTRACT

        The paper examines the Italian reform which has modified the Article
4 of the law n. 300/1970 (so-called Statute of workers) regarding remote
monitoring devices used on workers and moves on to assess the impact of this
reform on the ban of opinion polls, as sanctioned by Art. 8 of the law n.
300/1970 (so-called "Knowledge checks”). In the presentation of the latest
regulation, the paper also contains an analysis of the relationship between the
new rules about employers’ power of control and the legislation concerning
data protection. In this light we give details about the European and
International framework, especially considering the General Data Protection
Regulation (EU) 2016/679.

Keywords: Privacy; Work challenges; Italian Reform; Supranational European
framework.
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



       Employees’ Privacy and employers’ control
  between the Italian legal system and European sources*
SUMMARY: 1. Introduction: technological innovation and changes in the labour market. – 2.
     The Italian reform of audiovisuals and other control devices at work. – 3 The use of
     information and the transparent control. – 4. The investigation concerning
     employees information (Article 8 Act n. 300/1970). The necessity of further steps to
     coordinate the various blocks of Italian legislation. – 5. The International
     framework. – 6. The European framework. – 7. Conclusion.



1. Introduction: technological innovation and changes in the labour
market

        Nowadays the debate about privacy at work is more intense than in the
past because new technology has changed everything: the world, the
organization of work and the production methods. Suffice to think that the
first cell phones date back to the early ‘90s or that the first calculating
machines were very expensive and as big as the first computers. Nevertheless
the views of the relation between technological evolution and the labour
market differ. On the one hand David Graeber makes pessimistic assumptions
and suggests that capitalism is inventing the “bullshit jobs” which are a means
of controlling people. Many people in fact - when they are not working -
spend their time updating their Facebook profiles or downloading missed tv
episodes. On the other hand Jeremy Rifkin makes optimistic assumptions and
suggests that the gig economy increases the opportunities on having different
experiences, with less controls and time constraints.
        In any event, modern production methods involve the use of new
technologies which are necessary in order to carry out work; and there are
mechanisms of monitoring employees’ activity which are physically less
cumbersome, but even more invasive. At the same time it cannot be excluded
that the modern system, formally installed to ensure safety at work, can be
used to control how hard the workers are working. For example in one Italian
case the workers wore a bracelet while distributing publicity materials, in the
other the workers were obliged to wear a belt or a bracelet containing a
microchip. In both cases the modern device was used not for safety (as the
employer had said), but for monitoring activity because the employees stated

         * Il contributo riprende, con l’aggiunta di note essenziali e alcuni aggiornamenti, il
testo della relazione presentata l’8 febbraio 2017 presso l’Università di Helsinki e in corso di
pubblicazione sulla rivista Liikejuridiikka.



      LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                     C. 3
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



that the bracelet rang if they were not physically moving for a period of ninety
seconds. Likewise, in a British case the workers were being made to
wear electronic armbands that managers used to monitor employees’ work
rates.
       In view of the foregoing, we examine the Italian reform regarding
remote monitoring devices used on workers and moves on to assess the
impact of this reform on the ban of opinion polls (par. 2-3). And then we
focus on the European and International framework, especially considering
the General Data Protection Regulation (EU) 2016/679 (par. 4-5).


2. The Italian reform of audiovisuals and other control devices at work

        In 2015, Article 23 of Italian Legislative Decree n.151 has modified the
discipline of the power of control by the employer by means of technological
devices1. The article has rewritten Art. 4 Act n. 300/1970 starting from the
heading that changes from “Audiovisual equipment” to «Audiovisual
equipment and other monitoring tools».
        According to new Article 4 (1) «audiovisual equipment and other
instruments which allow remote monitoring of employees may be used only
because of organization and production needs in order to ensure safety at
work and the protection of corporate properties and can be installed prior
collective agreement with unions». In the present formulation, there are two
pieces of news to remark. The first one concerns the overcoming of absolute
prohibition to install remote control equipment aiming at the direct
monitoring of working activity (in opposition to indirect or unintentional
control which was lawful also before the reform of 2015). The second one
applies to the widening of reasons that allow the use of audiovisual equipment
and other remote monitoring devices: in fact together with the traditional
needs of organization, production, and safety there is the addition of the
safeguard of corporate properties (patrimony protection). This allows
recognition by law to the so called protection control – that is control aiming
to detect employees’ illegal behaviour – and implies that the same procedures
(both referring to trade unions and administration) can be extended to remote
monitoring tools (2). Moreover the Criminal Chamber of the Italian Court of


         (1) Available: http://www.normattiva.it
         (2) The notion of defensive control has been elaborated by judges in the existence of
old art. 4 St. Lav., Tullini P., Videosorveglianza a scopi difensivi e utilizzo delle prove di reato commesso



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                         C. 4
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



Cassation recently confirmed that the installation of remote control equipment
without trade unions’ (or administrative) authorization constitutes an offence.
This offence in particular constitutes both when the employer has not installed
the remote control equipment, but he has acquiesced in its use (3) and even if
the employer has installed the audiovisual equipment, but has not put it into
operation (4).
        In addition, Article 4 provides that paragraph 1 shall not apply to
«instruments used by the employee to work and to instruments to record
attendance and access times». Italian literature has been discussing on that
provision for months by proposing two major interpretations. The first one
suggests that Article 4 has completely released the tools from the obligations
provided for in paragraph 1. In other words, the employer can have free
access to those instruments. On the other hand, it is necessary to make a
distinction: Instruments aiming to control the respect of working timetables
are completely free from any legal bonds mentioned in paragraph 1; instruments
to check employees’ movements at the workplace are partly free from those
bonds and in particular they do not require the trade unions’ (or
administrative) authorization, provided they abide by the needs of
organization, production, safety at work and patrimony protection (5).
        The second interpretation considers monitoring tools as a wide genus
inside which we can distinguish, species subtracted to the bonds of paragraph 1,
such as work instruments and instruments for the recording of access and
attendance. The peculiarity of this approach lies in the limits of the two kinds
of instruments. The instruments for working cannot be identified in advance
and in an abstract way, but are defined by two characteristics: a) they are
required in order to carry out tasks and are identified and supplied by the
employer acting as a manager; b) the employee has an active role in the use of
those instruments at work, in the sense that the instruments are actually used

dal dipendente, RIDL, 2011, I, p. 86. See Maio V., La nuova disciplina dei controlli a distanza
sull’attività dei lavoratori e la modernità post panottica, ADL, 2015, p. 1200. Contra Maresca A.,
Controlli tecnologici e tutele del lavoratore nel nuovo art. 4 dello Statuto dei lavoratori, RIDL, 2016, I, p.
525 that distinguishes between the general controls to defend corporate properties (to which
the article 4 shall be applied) and the controls to verify illegitimate behaviour (to which the
article 4 will not be applied).
            (3) See Italian Court of Cassation 8 September 2016 - 6 December 2016, n. 51897.
            (4) See Italian Court of Cassation 7 April 2016 - 26 October 2016, n. 45198.
            (5) Salimbeni M.T., La riforma dell’art. 4 dello Statuto dei lavoratori: l’ambigua risolutezza del
legislatore, RIDL, 2015, I, p. 589; Lambertucci P., La disciplina dei “controlli a distanza” dopo il Jobs
Act: continuità e discontinuità con lo Statuto dei lavoratori, in Jobs Act: un primo bilancio. Atti del XI
Seminario di Bertinoro-Bologna del 22-23 ottobre 2015, a cura di Carinci F., Adapt e-Book, 2016,
No. 54, p. 270.



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                          C. 5
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



by employees to carry out their tasks. As for the instruments to record access
and attendance, that species includes both instruments to record the beginning
and the end of the workday, and the instruments to detect the employees
movements during working hours and at the workplace (intending it physically
and digitally i.e. web access) (6).


3. The use of information and the transparent control

        Further news compared to the previous formulation of Art. 4 act n.
300/1970 concerning the possibility to use information gathered «to all ends
connected to employment relationship» and the necessity to inform the
employee about the «monitoring tools and the ways they are used» which have
to respect the Legislative Decree n. 196/2003 that is the general regulations
applicable to all citizens (hereinafter Privacy Cod) (7). Therefore, failing to
remit to the interpreter which consequences may derive from the violation of
the general rules by the employer fixed by Labour Law, the new provision
uniforms the limits established by Labour Law and those included in the
Privacy Code (i.e. the inaccessibility of data) (8).
        With regard to the consequences that the employer’s power of control
can have on employees, the new Art. 4 act n. 300/1970 introduces important
issues. Today, in fact, Labour Law presents an explicit reference to the Privacy
Code. That is to say that while in the past general provisions – the Privacy
Code – proceeded in parallel with specific regulations about monitoring
audiovisual devices in Labour Law, the 2015 reform and the consequent
“exchange of securities” created authentic interaction between Art. 4 act n.
300/1970 and the Privacy Code (9).
        Concerning the use of information, the new formulation makes an
immediate link between the employer’s power of control and the other
management powers: today the information - when they are lawfully acquired
- can be used by the employer for all purposes relating to the employment
relationship, including for disciplinary purposes (whereas before a number of


           (6) Marazza M., Dei poteri (del datore di lavoro), dei controlli (a distanza) e del trattamento dei
dati (del lavoratore), CSDLE It., n. 300/2016.
           (7) Available: http://www.normattiva.it
           (8) Alvino I., I nuovi limiti al controllo a distanza dell’attività dei lavoratori nell’intersezione fra
le regole dello Statuto di lavoratori e quelle del Codice della privacy, LLI, 2016, No. 1, p. 30.
           (9) Del Punta R., La nuova disciplina dei controlli a distanza sul lavoro (art. 23, d. lgs. n.
151/2015), RIDL, 2016, I, p. 107.



        LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                              C. 6
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



legal academics argued that also the use of information complied the
conditions attached to the equipment’s installation, namely only for the needs
of the organization, production, and safety). Additionally, it was held that the
use of information coincides with the data’s examination and evaluation (10).
In other words, some commentators on the new Article 4 have observed that
a distinction can be made between the data collection and storage, on one
hand, and, on the other, the data’s examination and evaluation (11).
Consequently, the duty to inform should be related only to the data’s
examination and evaluation because this is the first act of use. In line with this
thinking, the duty to inform aims to protect the interest of employees to check
the correct procedure of the processing of personal data and not the right to
confidentiality (12).
        The duty to inform, as already mentioned, relates to the «monitoring
tools and the ways they are used». In that respect, then, the information
obtained through any equipment and instruments capable of monitoring the
employee may be used but only if the employee was adequately informed
beforehand about the manner in which he or she was monitored, i.e. through a
detailed internal policy; and only in compliance with the Italian Privacy Code
(from 2018 EU Reg. 2016/679) in terms of information and consent of the
employee, necessity and proportionality of a lawful monitoring.
        With regard to the adequacy, it should be emphasised that the
information must be targeted and specific, namely must cover only
the monitoring tools used or those that may be used. In other words, the duty
to inform is not widespread both as regards the employees and as regards
the monitoring tools.


4. The investigation concerning employees information (Article 8 Act n.
300/1970). The necessity of further steps to coordinate the various
blocks of Italian legislation

       Italian 2015 reform has not touched the other part of the employer’s
control power which intersects the employees’ privacy, namely Art. 8, act n.


          (10) See Maresca A., Controlli tecnologici e tutele del lavororatore nel nuovo art. 4 dello Statuto
dei lavoratori, RIDL, 2016, I, p. 538.
          (11) See Proia G., Trattamento dei dati personali, rapporto di lavoro e l’«impatto» della nuova
disciplina dei controlli a distanza, RIDL, 2016, I, p. 562 s.; Maresca A., op. cit., p. 538.
          (12) See Maresca A., op. cit., p. 541.



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                         C. 7
   L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



300/70 (13). That provision provides for a strict prohibition to enquire into
«the employee’s opinions as for politics, religion and trade unions», a softer
denial to access to «non relevant facts in the evaluation of professional
attitude». In other words the employee’s protection of privacy is complete as
for politics, religion or trade unions, being them areas that can never be
investigated; while the protection is partial as for personal facts which bear a
relevance in the evaluation of professional attitude, falling these fact out of the
forbidden area.
        Similarly unchanged is the relationship between Art. 8 act n. 300/70
and the Privacy Code. The latter moves along the independent path of data
processing and only avows formal respect to specific provisions: it asserts in
fact full applicability of Labour Law.
        Nonetheless from the realistic interaction between the two bodies of
Law it is evident that the Privacy Code has substantially disabled the
prohibition fixed by Art. 8 act n. 300/70. In particular Art. 26 of the Privacy
Code provides that it is not necessary to get every single consent to the
processing of sensitive data, but it is sufficient to have the authorization of the
independent authority «when data have to be processed to fulfill special
requirements provided for by law or by Community rules or legislation about
the management of employment relationship». As a consequence the
independent authority has introduced a general provision (called Authorization
to sensitive data processing in employment relationship) in which the single
authorizations have been made unnecessary and it has officially set the limits
within which data processing is possible (14). In other words that general
provision has enhanced the relevance of data processing in contrast with the
management (together with the creation and termination) of an employment
relationship, which implies that the processing of an employee’s sensitive data
(the ones concerning politics, religion and trade unions) may be consented to
because falling within the general authorization of the independent authority
instead of being forbidden as complying to Art. 8 act n. 300/70.
        In conclusion, redefining the discipline of the power of control by the
employer, the Legislative Decree n. 151/2015 gives the interpreter a more
modern and updated framework. The legislator, far from insisting on a
defensive approach forbidding any invasion of the employees’ privacy, has
elaborated a new balance between the contrasting interests of employers and
employees keeping in mind both the ordinary use of information technology

       (13) Available: http://www.normattiva.it
       (14) Available: http://www.garanteprivacy.it.



     LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                     C. 8
   L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



in the production process and the new perception of privacy among the young
generations that – as observed – do not get connected to the internet, but are
continuously connected (15).
        The new social-economic context, different from the one that in the
1970’s had prompted those choices in Labour Law, should justify
modifications also in the other aspect of employers’ control power intersecting
the Privacy Code, namely Art. 8 act n.300/70. Although that disposition
remains formally unchanged, it is evident, however, that much has changed in
the facts. General regulations about privacy have made art. 8 act n. 300/70
inconsistent, while that provision in interaction with Art. 4 act n. 300/70 was
and (even more today) is disabled. In other words art. 8 act n. 300/70
(although formally untouched) is actually overwhelmed by two heavy weights: a)
Art. 4 act n. 300/70 having a vocation confirmed and reinforced by the 2015
reform; b) the Privacy Code which, still advancing parallel to the specific
framework about workers’ opinion control, proves capable of overcoming
unrealistic and obsolete biases.
        Consequently it is an interpreter’s task to establish both what rule is
applied when the data collected by employer through the remote controls
channel (Art. 4) involve sensitive information (Art. 8) and when the processing
in the employment relationship fall in the prohibition fixed by Art. 8. In a
recent case, for example, a company installed some software programs
(websense, mailbox and Voip) for the formal reason of the protection of company
property. The independent authority observed that: the installation of these
softwares is not compliant with Art. 4 and 8 of the Italian Workers’ Statute.
And the Court confirms this approach and statues: storage and categorization
of employees’ personal data, concerning surfing the internet, using e-mail and
telephone numbers called, acquired by the employer, are illegal. Processing
these data results also in the violation of article 8 of the Workers’ Statute
(which prohibits the employer from carrying out directly or by using third
party investigations concerning opinion or information on his employees’ life)
even when the employer doesn’t use the data at all (16).
        In other words it is an interpreter’s task to overcome the persisting
contradictions of the system, while waiting for further reforms which – once
an ad hoc discipline on employees’ data processing has been dismissed – may
change the framework about control on employees’ opinions along the lines of

         (15) Ray J.E., «La loi qui libère …», Droit Social, 2015, p. 752.
         (16) Italian Court of Cassation 19 September 2016, n. 18302, Notiziario di
Giurisprudenza del Lavoro, 6-2016, p. 609 ss.



     LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                     C. 9
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



an interaction between general and specific framework launched by Legislative
Decree n.151/2015.


5. The International framework

       The national regulations regarding the intersecting between the
employees’ privacy and the employers’ power of control entails a particularly
serious interference with the European and International framework (17).
       At International level it should be recalled that, as Article 8 of the
Convention for the Protection of Human Rights and Fundamental Freedoms
(hereinafter cited as Convention) confirms, the right of respect for private life
is not defined in the Convention. Thus, the European Court of Human
Rights (“the Strasbourg Court”) is given the task of determining the content of
this fundamental right and of establishing the limitations that may be imposed
on the exercise of this right, particularly in compliance with employers’ power
of control. In that respect, it should be borne in mind that in the Bărbulescu
judgement the Strasbourg Court finds that «it is not unreasonable for an
employer to want to verify that the employees are completing their
professional tasks during working hours» (18). In particular, the 2016
judgment concerns the employer’s decision to terminate the employment
contract of an engineer (Mr Bărbulescu), who maintained he had been asked by
his employer to open a Yahoo Messenger account in order to reply to clients’
enquiries. These communications were monitored by the employer and
showed that the engineer had used the Internet for personal purposes,
contrary to internal regulations. The Strasbourg Court was asked whether or
not this dismissal should be considered as a breach of right to respect of his
private life. The Court, saying that apparently only the communications on the
Yahoo Messenger account were examined, but not the other data and
documents that were stored on the company’s computer, gives a negative
answer to this question. It therefore assessed that the employer’s monitoring




           (17) See, for a focus on the Finnish legislation and its application concerning the
employer’s right to access and monitor employees’ email, T. Jaatinen - E. Rautanen, Accessing
Employees’ Email in the Workplace – a Gordian Knot?, EDPL, 2016, p. 2 ss.
           (18) Case of Bărbulescu v. Romania, 12 January 2016, application no. 61496/08,
paragraph 59. See, for a comment, G. Consonni, Il caso Bărbulescu c. Romania e il potere di
controllo a distanza dopo il Jobs Act: normativa europea e italiana a confronto, DRI, 2016, n. 4, p. 1171.



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                    C. 10
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



was limited in scope and proportionate (19). Differently the Strasbourg Court
has stated in the Copland judgement which highlighted the collection and
storage of personal information relating to the applicant’s telephone (Ms
Copland), as well as to her e-mail and Internet usage, without her knowledge,
amounted to an interference with her right to respect for her private life and
correspondence within the meaning of Article 8 of the Convention (20). In
this case, indeed, the employer’s monitoring was abusive because these
activities were considered as neither transparent, nor proportionate in manner.
The employer’s conduct lacked transparency because the employee had been
given no warning that her calls would be liable to monitoring, therefore the
employee had a reasonable expectation as to the privacy of calls made from
her work telephone (and the same expectation Ms Copland should apply in
relation to her e-mail and Internet usage). The employer’s conduct was
disproportionate because there were reasonable and less intrusive methods
that the employer could have used, such as drafting and publishing a policy
dealing with the monitoring of employees’ usage of the telephone, Internet
and e-mail.
        In general, however, the Strasbourg Court does not exclude that the
monitoring of an employee’s telephone, e-mail or Internet usage at the place
of work may be considered “necessary in a democratic society” in certain
situations in pursuit of a legitimate aim. Specifically, the effect of Bărbulescu
judgement is that the right to respect of private life is a fundamental but not
an absolute right: it may imply restrictions proportional to legitimate
necessities. Consequently the worker’s right has to be balanced with the
employer’s right to check the proper fulfilment of the working performance.
        Much more interventionist appears to be the Strasbourg Court sitting
as a Grand Chamber in its recent judgment of 5 September 2017 (21).
Returning to the previous case Bărbulescu the Grand Chamber stated that
Article 8 has been infringed. The Court's reasoning is developed in two steps.
        First, the Court examines the case in terms of the State’s negative or
positive obligations, noting that: “While the essential object of Article 8 of the
Convention is to protect individuals against arbitrary interference by public

         (19) Case of Bărbulescu v. Romania, 12 January 2016, application no. 61496/08,
paragraph 60.
         (20) Case of Coplnd v. The United Kingdom, 3 April 2007, application no. 62617/00,
paragraph 44. See, for a comment, Golisano G., Posta elettronica e rete internet nel rapporto di
lavoro. Usa, Unione europea e Italia, ADL, 2007, n. 7, p. 1327.
         (21) Grand Chamber, case of Bărbulescu v. Romania, 5 September 2017, application
no. 61496/08.



      LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                C. 11
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



authorities, it may also impose on the State certain positive obligations to
ensure effective respect for the rights protected by Article 8” (22). In this case,
the interference on the privacy was not performed by a State authority but by
a private employer; consequently, the complaint should be examined from the
standpoint of the State’s positive obligations. The choice of the means
calculated to secure compliance with Article 8 of the Convention in the sphere
of the relations of individuals between themselves is in principle a matter that
falls within the Contracting States’ margin of appreciation. This wide margin
of appreciation is explained both because labour law has specific features (and
it is governed by its own legal rules, which differ considerably from those
generally applicable to relations between individuals) and because there is no
European consensus on the regulation of the right to privacy as exercised by
employees (23).
        Second, the Court considers that the proportionality and procedural
guarantees against arbitrariness are essential. In this perspective, the Court
does not confine itself to stating the general principles, but applies the
proportionality test in order to limit the discretion of the national authorities.
More specifically, the Court determines how the national authorities took the
proportionality criteria into account in their reasoning when weighing the
applicant’s right to respect for his private life and correspondence against the
employer’s right to engage in monitoring, including the corresponding
disciplinary powers (24). In this way, it is necessary to check whether the
worker received prior notice from his employer of the prohibition of personal
use of company resources and whether the worker had been informed of the
nature or the extent of the monitoring, or to the degree of intrusion into his
private life and correspondence (25). In addition, it is necessary to check firstly
the specific reasons justifying the introduction of the monitoring measures;
secondly, whether the employer could have used measures entailing less
intrusion into the applicant’s private life and correspondence. The Grand
Chamber concludes that “the domestic authorities did not afford adequate
protection of the applicant’s right to respect for his private life and

        (22) Grand Chamber, paragraph 108.
        (23) See paragraph 119 : the Court takes the view that the Contracting States must
be granted a wide margin of appreciation in assessing the need to establish a legal framework
governing the conditions in which an employer may regulate electronic or other
communications of a non-professional nature by its employees in the workplace.
        (24) And also the principles of necessity, purpose specification, transparency,
legitimacy and security set forth in Directive 95/46/EC (see paragraph 131).
        (25) Both with regard to spatial limits and content limits.



      LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                C. 12
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



correspondence and that they consequently failed to strike a fair balance
between the interests at stake” (26).
        In conclusion, this judgment represents a deviation from the past
because in the normal approach the Strasbourg Court is quite deferential when
it finds that States have a wide margin of appreciation.
        At International level, in the context of the increased use of new
technologies in the relations between employers and employees the Council of
Europe adopted the Recommendation CM/Rec(2015)5 (27). This
Recommendation - after reiterating that “employers should minimize the
processing of personal data only to the data necessary to the aim pursued in
the individual cases concerned” (Article 4) - introduces relevant modifications
regarding the use of Internet and electronic communications in the workplace.
In particular the Recommendation underpins the distinctions between work
tools and monitoring instruments.
        In relation to monitoring instruments the Recommendation contains an
approach, which is differentiated according to whether the introduction and
use of information systems and technologies has, on the one hand, the direct
and principal purpose of monitoring employees’ activity or, on the other, the
indirect consequence of monitoring employees’ activity (28). Indeed Article 15
of the Recommendation provides that «the introduction and use of
information systems and technologies for the direct and principal purpose of
monitoring employees’ activity and behaviour should not be permitted».
Although the same Article provides that «where their introduction and use for
other legitimate purposes, such as to protect production, health and safety or
to ensure the efficient running of an organization has for indirect consequence
the possibility of monitoring employees’ activity, it should be subject to the
additional safeguards (…), in particular the consultation of employees’
representatives».
        In relation to work tools Article 14 of the Recommendation provides
that «in the event of processing of personal data relating to Internet or
Intranet pages accessed by the employee, preference should be given to the
adoption of preventive measures» and that «the access by employers to the
professional electronic communications of their employees who have been


         (26) See paragraph 141.
         (27) See A. Sitzia, I controlli a distanza dopo il « Jobs Act » e la Raccomandazione R(2015)5
del Consiglio d’Europa, LG, 2015, n. 7, p. 671.
         (28) A comparable distinction is found in Article 16 in relation to equipment
revealing employees’ location.



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                 C. 13
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



informed in advance that such possibility can only occur, where necessary,
because of security or other legitimate reasons».
        Finally, at International level it should be remember the 1997 ILO
Code of Practice on the Protection of Workers' personal data. The point 6 this
code concerns the collection of personal data. In this regard, two aspects
should be noted: the first concerns the need for the employer to inform the
worker and indicate the purposes of the processing, the sources and means the
employer intends to use; the second concerns the monitoring of workers,
which requires the prior information of workers and the choice of less
intrusive methods and means of monitoring. The point 11 concerns the
individual rights and focuses on the employer’s duty to provide workers with
regular information so that they can appreciate the significance of the data
being processed. In this perspective the employer must also avoid indirect
restrictions, such as asking workers to indicate why they wish to have access
and which data they want to see, imposing costs on them or preventing them
from exercising their right during normal working hours (29). It should also be
pointed out that point 11 gives the worker the possibility of assistance in the
exercise of the right of access either by a co-worker or by a workers’
representative


6. The European framework

       As regards European framework, the Charter of Fundamental Rights of
the European Union - under title Freedoms - contains both the right of
respect for private and family life (Art. 7) and the right to the protection of
personal data (Art. 8). The first Article - in contrast with Article 8 of the
Convention - does not provide for the possibility of imposing restrictions on
the right of respect for private and family life (30). Nevertheless it can’t be
ignored that the reference in Article 52 of the Charter to Convention may only
be construed as constraining by the same limits provided for by the
Convention. According to this possibility, the Court of Justice has stated that
the right to respect for private life with regard to the processing of personal

        (29) However if access during normal working hours creates difficulties,
arrangements should be made to take into account both the interests of the worker and the
employer.
        (30) See Martinico G., Commento articolo 7, in Carta dei diritti fondamentali dell’Unione
Europea, a cura di Mastroianni R. - Pollicino O.- Allegrezza S.- Pappalardo F.- Razzolini O.,
Giuffrè. 2017, p. 114.



      LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                C. 14
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



data, recognised by Articles 7 and 8 of the Charter, concerns any information
relating to an identified or identifiable individual and the limitations which
may lawfully be imposed on the right to the protection of personal data
correspond to those tolerated in relation to Article 8 of the Convention (31).
         Instead, Article 8 of the Charter contains a relatively detailed rule for
the protection of personal data: that provision establishes the principle of
protection, details rules for the implementation of this principle and
establishes the control by an independent authority. The European framework
is supplemented by Directive 95/46/EC, which states that national law must
guarantee the right to privacy, which is recognized both in Article 8 of the
Convention and in the general principles of Community law (32). As a
commentator observed: Art. 8 of the Charter marks the passage from a
negative approach (as recognized in the Convention) to a positive dimension
with the introduction of subsequent rules and principles (33). It follows that,
as Guy Braibant notes (about the origin of the provision) clarifying the inter-
relationship between the different legal instruments: ces textes s’inspirent des même
principes et tendent aux mêmes objectives par les mêmes moyens; ils ont contribué à former
une doctrine européenne des relations entre l’informatique et les libertés (34).
         At the same time, the Court of Justice has demonstrated considerable
dynamism ensuring an interpretation of the European disposition in line with
technological evolution. It is suffice to think that in Google Spain case the Court
stated «as the data subject the person may, in the light of his fundamental
rights under Articles 7 and 8 of the Charter, request that the information
relating to him personally no longer be made available to the general public by
its inclusion in such a list of results, it should be held that those rights
override, as a rule, not only the economic interest of the operator of the search




         (31) Joined Cases C-92/09 and C-93/09, Court of Justice 9 November 2010, case
Volker, paragraph 52.
         (32) On the basis of Article 94 of Regulation (EU) 2016/679, the Directive
95/46/EC is repealed with effect from 25 May 2018.
         (33) See Pollicino O. - Bassini M., Commento articolo 8, in Carta dei diritti fondamentali
dell’Unione Europea, cit., p. 136.
         (34) “These texts are inspired by the same principles and aim at the same objectives
by means of the same legal instruments; they have contributed to form a European doctrine
about the relationships between information technology and freedom”. Braibant G., La
Charte des droits fondamentaux de l’Union européenne. Témoignage et commentaires de Guy Braibant,
Éditions du Seuil, 2001, p. 113.



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                               C. 15
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



engine but also the interest of the general public in finding that information
upon a search relating to the data subject’s name» (35).
       Recently, the European framework was supplemented by the
Regulation (EU) 2016/679 which replaces the Directive 95/46/EC (and a new
Directive for the police and criminal justice sector) and will become applicable
law as of May 2018 (36). The choice of legal instrument is an important
choice: as we know a regulation is directly applicable and does not require
additional domestic implementation. As a commentator observed «the
Regulation has set itself an ambitious task: the coordination of twenty-eight
Member States, their respective Data Protection Authorities, national laws and
courts is by no means an easy task; the bar of expectations has been raised
high because the Commission has promised nothing less than a «strong, clear
and uniform legislative framework at European level” that does away with the
patchwork of legal regimes across 27 member states» (37). That objective is
pursued by a clear set of principles (principle of lawfulness, fairness and
transparency; principle of purpose limitation; principle of data minimization;
principle of accuracy; principle of storage limitation; principle of integrity and
confidentiality; principle of accountability) and details rules, but there is plenty
of doubt whether and how will work in practice (38).
       Concerning the right to privacy in the employment context Article 88
of the new Regulation (EU) 2016/679 provides that «Member States may (…)
provide for more specific rules to ensure the protection of the rights and
freedoms in respect of the processing of employees' personal data». In
particular, those rules adopted by the Member States «shall include suitable

           (35) Case C-131/12, Court of Justice 13 May 2014, case Google Spain SL, Google Inc. v
Agencia Española de Protección de Datos (AEPD), Mario Costeja González, paragraph 97. See
Pollicino O., Interpretazione o manipolazione? La Corte di giustizia definisce un nuovo diritto alla privacy
digitale, http://www.federalismi.it/nv14/articolo-documento.cfm?artid=28017
           (36) Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC (General
Data Protection Regulation) published in OJ L 119, 4.5.2016, p. 1-88. This reform derives
from a long process: for a comment about the draft General Data Protection Regulation, see
Victor J.M., The EU General Data Protection Regulation: Toward a Property Regime for Protection Data
Privacy, The Yale Law Journal, 2013, vol. 123, 2, p. 513.
           (37) See de Hert P. - Papakonstantinou V., The new General Data Protection Regulation:
Still a sound system for the protection of individuals?, Computer Law and Security Review, 2016, Vol. 32,
2, p. 182.
           (38) See Burri M. - Schär R., The Reform of the EU Data Protection Framework. Outlining
Key Changes and Assessing Their Fitness for a Data-Driven Economy, Journal of Information Policy,
2016, Vol. 6, p. 489 and 501. For an optimistic opinion, see Stanzione M. G., Il Regolamento
Europeo sulla Privacy : origini e ambito di applicazione, Europa e diritto privato, 2016, 4, p. 1264.



       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                      C. 16
    L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



and specific measures to safeguard the data subject's human dignity, legitimate
interests and fundamental rights, with particular regard to the transparency of
processing, the transfer of personal data within a group of undertakings, or a
group of enterprises engaged in a joint economic activity and monitoring
systems at the work place». Under the Italian system Article 88 will have direct
effects on the Privacy Code, but will not involve the employment legislation
that is comply with the principle of Recommendation CM/Rec(2015)5 (39).
        In order to provide a high level of privacy protection for users of
electronic communications services and to ensure consistency with the
Regulation (EU) 2016/679, the Directive 2002/58/EC (the so-called
"ePrivacy Directive") (40) is currently being reviewed (41). The new Proposal
for a Regulation concerning the respect for private life and the protection of
personal data in electronic communications is a lex specialis in comparison with
the Regulation (EU) 2016/679 and aims to particularise and complement it as
regards electronic communications data that qualify as personal data (42).
Additionally, the Proposal aims to fill a void of protection of communications
conveyed through new services: the Commission has verified that the ePrivacy
Directive has not kept pace with technological developments because the
Over-the-Top communications services ("OTTs") are in general not subject to
the current Union electronic communications framework.
        Finally, it should be highlighted that the Proposal does not include any
specific provisions in the field of data retention. Accordingly Member States
are free to keep or create national data retention frameworks that provide,
inter alia, for targeted retention measures, in so far as such frameworks comply
with Union law, taking into account the case-law of the Court of Justice on the
interpretation of the ePrivacy Directive and the Charter of Fundamental
Rights.




         (39) Ogriseg C., Il Regolamento UE n. 2016/679 e la protezione dei dati personali nelle
dinamiche giuslavoristiche: la tutela riservata al dipendente, LLI, 2016, vol. 2, 2, p. 55.
         (40) Directive 2002/58/EC of the European Parliament and of the Council of 12
July 2002 concerning the processing of personal data and the protection of privacy in the
electronic communications sector (Directive on privacy and electronic communications) (OJ
L 201, 31.7.2002, p.37).
         (41) See the document of 8 September 2017 available: http://eur-lex.europa.eu/legal-
content/IT/TXT/?uri=consil:ST_11995_2017_INIT
         (42) COM/2017/010 final .



      LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                C. 17
   L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



7. Conclusions

       The previous pages clearly state that national and international legal
tools on this field are technically different and offer different solutions that
only partially meet the needs arising from the intersection of workers’ privacy
and employers’ power of control.
       Internationally, an approach has prevailed which tends to balance the
contrasting interests involved. Flexibility in proportionality, good sense and
transparency does not allow to draw a clear line around a worker’s right to
privacy and always leaves margins to grant the employer with lawful power of
control.
       In Europe the right to privacy is only apparently more comprehensive
both because of the reference in Art. 52(3) of the Charter of the Convention,
and because of the new opening established in Art. 88 of the new Regulation
(EU) about data processing in work relationships.
In the Italian legal system, the approach does not appear homogeneous. On
one side, in fact, the reform of 2015 on control with audiovisual equipments
and other monitoring tools finds a balance between the contrasting interests
following the logic of fairness. On the other, data processing turns out to be
almost always allowed provided it be relevant in the management (as well as in
sign-on and severance) of working relationship leaving alone the privacy of
workers.




     LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                C. 18
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



References
Alvino I., I nuovi limiti al controllo a distanza dell’attività dei lavoratori nell’intersezione fra le regole dello
         Statuto di lavoratori e quelle del Codice della privacy, Labour & Law Issues, 2016, No. 1, p.
         30.
Bellavista A., Il controllo sui lavoratori, Giappichelli, 1995.
Bianca C.M. - Busnelli F.D. (eds.), La protezione dei dati personali. Commentario al D. Lgs. 30
         giugno 2003, n. 196, Cedam, 2007.
Braibant G., La Charte des droits fondamentaux de l’Union européenne. Témoignage et commentaires de
         Guy Braibant, Éditions du Seuil, 2001.
Burri M. - Schär R., The Reform of the EU Data Protection Framework. Outlining Key Changes and
         Assessing Their Fitness for a Data-Driven Economy, Journal of Information Policy, 2016, Vol.
         6, pp. 479-511.
Carinci M. T., Il controllo a distanza dell’attività dei lavoratori dopo il “Jobs Act” (art. 23 D. Lgs.
         151/2015): spunti per un dibattito, Labour & Law Issues, 2016, No. 1, p. VII.
Chieco P., Privacy e lavoro. La disciplina del trattamento dei dati personali del lavoratore, Cacucci,
         2000.
Consonni G., Il caso Bărbulescu c. Romania e il potere di controllo a distanza dopo il Jobs Act: normativa
         europea e italiana a confronto, DRI, 2016, n. 4, p. 1171.
De Hert P. - Papakonstantinou V., The new General Data Protection Regulation: Still a sound system
         for the protection of individuals?, Computer Law and Security Review, 2016, Vol. 32, Issue 2,
         p. 179-194.
Del Punta R., La nuova disciplina dei controlli a distanza sul lavoro (art. 23, d. lgs. n. 151/2015),
         RIDL, 2016, I, p. 107.
Golisano G., Posta elettronica e rete internet nel rapporto di lavoro. Usa, Unione europea e Italia, ADL,
         2007, n. 7, p. 1327.
Iaquinta F. - Ingrao A., La privacy e i dati sensibili del lavoratore legati all’utilizzo di social networks.
         Quando prevenire è meglio che curare, DRI, 2014, p. 1027
Jaatinen T. - Rautanen E., Accessing Employees’ Email in the Workplace – a Gordian Knot ?, EDPL,
         2016, p. 1.
Lambertucci P., La disciplina dei “controlli a distanza” dopo il Jobs Act: continuità e discontinuità con
         lo Statuto dei lavoratori, in Jobs Act: un primo bilancio. Atti del XI Seminario di Bertinoro-
         Bologna del 22-23 ottobre 2015, a cura di Carinci F., Adapt e-Book, 2016, No. 54, p.
         270.
Maio V., La nuova disciplina dei controlli a distanza sull’attività dei lavoratori e la modernità post
         panottica, ADL, 2015, p. 1186.
Marazza M., Dei poteri (del datore di lavoro), dei controlli (a distanza) e del trattamento dei dati (del
         lavoratore), CSDLE It., n. 300/2016.
Maresca A., Controlli tecnologici e tutele del lavororatore nel nuovo art. 4 dello Statuto dei lavoratori,
         RIDL, 2016, I, p. 513.
Martinico G., Commento articolo 7, in Carta dei diritti fondamentali dell’Unione Europea, a cura di
         Mastroianni R. - Pollicino O.- Allegrezza S.- Pappalardo F.- Razzolini O., Giuffrè.
         2017, p. 114.




        LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                             C. 19
     L. TEBANO, Employees’ Privacy and employers’ control between the Italian and European system



Ogriseg C., Il Regolamento UE n. 2016/679 e la protezione dei dati personali nelle dinamiche
         giuslavoristiche: la tutela riservata al dipendente, Labour & Law Issues, 2016, Vol. 2, No. 2,
         pp. 28-64.
Pollicino O., Interpretazione o manipolazione? La Corte di giustizia definisce un nuovo diritto alla privacy
         digitale, http://www.federalismi.it/nv14/articolo-documento.cfm?artid=28017
Pollicino O. - Bassini M., Commento articolo 8, in Carta dei diritti fondamentali dell’Unione Europea,
         a cura di Mastroianni R. - Pollicino O.- Allegrezza S.- Pappalardo F.- Razzolini O.,
         Giuffrè. 2017, p. 132.
Proia G., Trattamento dei dati personali, rapporto di lavoro e l’«impatto» della nuova disciplina dei
         controlli a distanza, RIDL, 2016, I, p. 547.
Ray J.E., «La loi qui libère …», Droit Social, 2015, p. 752.
Salimbeni M.T., La riforma dell’art. 4 dello Statuto dei lavoratori: l’ambigua risolutezza del legislatore,
         RIDL, 2015, I, p. 589.
Sitzia A., I controlli a distanza dopo il « Jobs Act » e la Raccomandazione R(2015)5 del Consiglio
         d’Europa, LG, 2015, n. 7, p. 671.
Stanzione M.G., Il Regolamento Europeo sulla Privacy: origini e ambito di applicazione, Europa e diritto
         privato, 2016, 4, pp. 1249-1264.
Tebano L., La nuova disciplina dei controlli a distanza: quali ricadute sui controlli conoscitivi?, RIDL,
         2016, I, p. 356.
Trojsi A., Il diritto del lavoratore alla protezione dei dati personali, Giappichelli, 2013.
Tullini P. (ed.), Tecnologie della comunicazione e riservatezza nel rapporto di lavoro. Uso dei mezzi
         elettronici, potere di controllo e trattamento dei dati personali, Cedam, 2010.
Tullini P., Videosorveglianza a scopi difensivi e utilizzo delle prove di reato commesso dal dipendente,
         RIDL, 2011, I, p. 86.
Victor J.M., The EU General Data Protection Regulation: Toward a Property Regime for Protection Data
         Privacy, The Yale Law Journal, 2013, vol. 123, No. 2, p. 513-528.
Zilio Grandi G. (ed.), I poteri del datore di lavoro nell’impresa. Atti del Convegno di Studi Venezia 12
         aprile 2002, Cedam, 2002.
Zilio Grandi G. - Biasi M. (eds.), Commentario breve alla riforma “Jobs Act”, Cedam, 2016.




       LLI, Vol. 3, No. 2, 2017, ISSN 2421-2695                                                      C. 20
