On June 15, 2017, the Italian Data Protection Authority, Garante per la Protezione dei Dati Personali, rejected the request of an Italian service company to be authorized to process its employees’ judiciary data because of lack of an adequate legal basis.
The Italian company was looking to process the judiciary information of its employees to allegedly fulfill a contractual duty and to communicate them to a third contractor. The processing of the judicial data would have allowed the contracting company to grade the performance of the employees employed in the services.
The Italian DPA rejected the request and highlighted that the requesting company did not indicate a valid legal basis allowing that type of processing. Private entities shall indicate the relevant interests that the public has in the processing, the type of data processed and the requested type of processing. Furthermore, analyzing the employment agreement, the DPA could not find a contractual basis for the processing of the employees’ judiciary data to carry out their attributed tasks. Finally, the DPA found that private entities may process their employees’ judicial data only if expressly authorized to do so by law or by the DPA.
Decision n. 267, doc. web n. 6558837, dated June 15, 2017, is available (in Italian) at http://www.garanteprivacy.it…
For more information on Italian data protection law, contact Francesca Giannoni-Crystal and Federica Romanelli
Follow us on& Like us on