Italian Data Protection Authority Lays Guidelines On Workplace Email And Internet Use

1. Introduction

2. March 1, 2007 Resolution by the Italian Data Protection Authority

   2.1 Surveillance in the Workplace

   2.2 Company policies on email and internet use in the workplace

1. Introduction

   The Italian Data Protection Authority ("Authority") with a resolution issued on November 23, 2006 provided a set of guidelines aimed at clarifying following areas:

   Security Requirements: The employer must appoint specialized personnel with adequate training in the processing of confidential data. Furthermore, the employer must adopt measures to prevent third parties from obtaining employees' personal information.

   Badges: in order to identify employees, a badge with a specific identification code is sufficient; whenever possible, the badge must show the employees first name and/or his/her job title.

   Intranets: The employees' consent is required to publish personal information about the employees on an intranet (e.g., curriculum vitae, pictures and so on).

   Medical Data: The employer must keep separate any information regarding medical data of the employees.

   Biometric Data: The Authority allows the use of data derived from digitally recorded fingerprints (biometric data) only in particular cases (e.g., access to dangerous manufacturing processes, to confidential documents). The creation of a generalized data base of biometric data is never allowed.

   This resolution did not regulate the use of email and internet on the workplace, so the Authority announced that further measures would be enacted on these areas.

   2. March 1, 2007 Resolution By The Italian Data Protection Authority

   As announced in the November 23, 2006 resolution, the Authority by a resolution dated March 1, 2007 has set out a further set of a guidelines aimed this time at laying principles on the use of email and internet in the workplace.

   By this resolution the Authority has weighed two fundamental needs: (i) the protection of the employees' personal information and (ii) the employer's right to a correct use of new technologies (e.g., email and internet) in the workplace.

   On the one hand the new technologies increase resources available to employers, but on the other hand the same resources enable different forms of electronic surveillance, which may be used in such a way so to intrude upon certain rights and freedoms granted to employees by Italian law.

   In this context, when analyzing the use of email and internet, the Authority takes the view that prevention should be more...