Share This Article
The Italian privacy authority has issued a GDPR fine for installing CCTV systems in the workplace in violation of obligations under Article 4 of the Workers’ Statute.
In an Order dated March 2, 2023, the Italian Privacy Authority (the Garante) issued a GDPR fine against a well-known clothing brand for installing and using CCTV systems at a multiplicity of outlets in the absence of an agreement with trade union representatives or authorization issued by the Labor Inspectorate under Article 4 of Law No. 300 of 1970 (the “Workers’ Statute“).
In particular, the Data Protection Authority reiterated that under the aforementioned Art. 4 of the Workers’ Statute, CCTV systems may be used, if it derives from them “also the possibility of remote control” of employees’ activities, “exclusively for organizational and production requirements, for work safety and for the protection of company assets,” and their installation must, in any case, be carried out subject to the prior entrance into a collective agreement with the trade union representatives or, where it has not been possible to reach such an agreement or in the absence of the representatives, only insofar as it is preceded by the issuance of appropriate authorization by the Labor Inspectorate.
For the Garante, in fact, the activation of such a guarantee procedure does not integrate a mere formality nor can it be qualified as a mere documentary fulfillment. On the contrary, this procedure is to be considered “an indispensable condition for the installation of video surveillance systems” as it “protects interests of a collective and super-individual nature.” In the absence of the trade union agreement or the authorization of the Labor Inspectorate, therefore, the collective interests to protect which they are placed must be considered harmed, as, moreover, also confirmed by the jurisprudence of legitimacy. Indeed, in this way, the legislation tends to diminish the disproportion that exists between the employer’s position and that of the workers.
Only through this procedure, therefore, is the employer able to properly assess, through the intervention of trade union representatives or the Labor Inspectorate, the suitability of technological tools from which remote control of workers (such as video surveillance equipment i.e. CCTV technologies) may result, as well as the actual compliance of such equipment with technical-productive or safety requirements, to harm the dignity of workers.
The possible lack of a union agreement or the authorization of the Labor Inspectorate, where necessary, however, also integrates a violation of the principle of lawfulness of the data processing referred to in Article 5, par. 1, letter a) of the EU Regulation 679/2016 (“GDPR“) in relation to the provisions of Article 88 of the GDPR itself as well as Article 114 of Legislative Decree 196/2003, as most recently amended by Legislative Decree 101/2018 (the “Italian Privacy Code“).
In fact, the aforementioned norms expressly state that a processing of personal data carried out in the context of the employment relationship, in order to be considered lawful, must comply with the specific rules that the national system deems necessary to “safeguard the human dignity, legitimate interests and fundamental rights of the data subjects,” with particular reference to the prohibition of control or monitoring of work activity.
In this regard, the Garante clarified that the relevant provisions of the GDPR and the Italian Privacy Code are in addition to (and do not replace or come less than) the provisions of the Workers’ Statute or the Labor Inspectorate.
The Garante has, in fact, reiterated that the areas of operation of the two pieces of Italian legislation (labor law and privacy), although related, are autonomous. On the one hand, Art. 4 of the Workers’ Statute provides for “the competence of the Labor Inspectorate to issue the administrative authorization necessary for the installation of audiovisual equipment and other instruments from which also derives the possibility of remote monitoring of workers for organizational and production needs, for the safety of work and for the protection of company assets, with reference to purely labor-law profiles.” On the other hand, on the other hand, Article 114 of the Italian Privacy Code “hinges the competence of the Garante in relation to the verification of compliance with the rules on the protection of personal data” in the context of labor relations, including with reference to the rules on remote controls.
On a similar topic, you can find interesting the following article “CCTV cameras under strict data protection law obligations“.
Photo by Nick Loggie on Unsplash
