Remote control over the employee’s working activity pursuant to Italian labour law and data protection law

The rules on remote controls, as set out in art. 4 of Law no. 300/1970 (Workers' Statute) as amended by Legislative Decree no. 151/2015, are always up-to-date and this is demonstrated by the Italian case law and doctrine as well as the provisions of the Supervisory Authority. Under the Italian labour law perspective, art. 4, paragraph 1 of the Workers’ Statute, that is a mandatory provision being intended to protect the fundamental rights of employees and cannot be derogated, states that “audiovisual equipment and other instruments from which derives the possibility of remote control of employees' activities may be used exclusively for organizational and production reasons, for safety in the workplace and for the protection of the company's assets and may be installed by prior collective agreement with the company trade unions. [...]“.

Such provision appears in line with the Recommendation CM/Rec (2015) 5 of the Council of Europe, that almost takes up verbatim the provision of the Statute: “The introduction and use of information systems and technologies for the direct and principal purpose of monitoring employees' activity and behaviour should not be permitted”.

Therefore, audiovisual equipment and other devices, from which the possibility of remote control of employees' working activities may derive, may be used on condition that there is a justification considered appreciable by the legislator. In other words, there must be an interest worthy of protection that the legislator identifies in the organizational and production needs, in the safety of work and in the protection of the company's assets. If at least one of the above conditions is met, another mandatory step is required: art. 4 establishes in fact that the implementation can only take place after a prior agreement with the Unions or, lacking such an agreement, the relevant equipment and devices may be installed subject to a preventive authorization from the territorial office of the National Labour Inspectorate or, alternatively, in the case of companies with production units located in the areas of competence of more than one territorial office, from the central office of the National Labour Inspectorate.

The provision referred to in art. 4, paragraph 1 shall not apply to the devices and equipment used by the employee for the purpose of rendering his/her working activity and to the devices aimed at recording access to the working premises and presence at work. Unfortunately, it is not always that easy to distinguish between an instrument allowing remote control and an instrument or device or tool (whatever definition may be used) assigned to the employee for performing his/her working activity.

Therefore, it is necessary to clarify the difference between control as an expression in the broad sense of the - undisputed - executive power of the employer and control by means of IT tools that can be of different types, thanks to the constant technological evolution (e.g., telephone programs, gps, management softwares, etc.), specifying how the legislator of art. 4 of the Workers' Statute is cautious of a de-personalized control such as the one carried out on the working activity through IT tools. In fact, it is not the content of the control but the ("hidden") modality thereof that is prohibited. This is the case, irrespective of who materially manages the instrument (from which the control on the working activity may originate), with respect to whoever is the effective employer, since it is always the latter who benefits from the results of the controls carried out. According to the interpretation developed over time on art. 4 of the Workers' Statute, in fact, what is prohibited is also indirect control through IT tools by third parties in favour of the actual employer.

Under the data protection stand-point (art. 4, paragraph 3 of the Workers’ Statute), the employer as data controller must inform in advance the employee, as data subject, about (i) the instruments allowing remote control in their characteristics and operation, (ii) the modalities and rules for the use of such instruments, (iii) the type of controls that may be carried out by the company, (iv) the stored data and persons entitled to access them, (v) the data retention periods, (vi) the disciplinary sanctions that may be imposed on the employee. In addition to these elements, such relevant information to the employee shall also include those recalled under art. 13 GDPR.

The timely handing over of said information to employees, together with the compliance with the provision of art. 4 of Workers’ Statute, has always been outlined by the Supervisory Authority (i.e., most recently and among other, in its decisions web doc. no. 9586936 of 15 April 2021 and web doc. no. 9669974 of 13 May 2021) as an evidence, together with the necessary balance of interests, and adequate organizational and security measures, of the data controller’s accountability under art. 24 GDPR.