The outbreak of Novel Coronavirus (COVID-19) has sparked fears of a worldwide pandemic. In Italy, where the outbreak of COVID-19 is extremely severe, the Government has implemented a number of emergency measures, including the closure of schools and universities in the entire Italian territory and severe restrictions to commercial and leisure activities (such as gyms, theatres, offices, restaurants, etc.) in the vast majority of the North of Italy.

Understandably, this may be creating great concern and unrest for you and amongst your workforce. Below we answer some key questions to clarify employers' legal obligations and support you in protecting your business and people.

What are employers' obligations in respect of COVID-19?

According to the President of the Council of Ministers' decree of 4 March 2020:

1) Smart working agreements are recommended in all the Italian Regions. Such arrangements can easily be activated without the need for any formalities. A form may be downloaded from the Ministry of Labor website.

2) All public and private companies are strongly recommended to cancel business trips across all the Italian Regions. Employers must opt for voice calls or video conferences. Of course all business trips to and from the quarantined areas are totally forbidden.

3) Any scheduled fairs, conferences, events and conventions of whatever nature must be delayed as well as any meetings due to be attended by physicians or people in charge of public services.

4) Employers must restrict access to common areas such as canteens, relaxation areas, coffee rooms, smoking areas, etc. The number of people who can have access to such areas must be limited and a "security distance" of at least 1 meter must be ensured among people standing in the same room.

5) Employers must limit access to corporate offices/premises to third parties (e.g. suppliers, providers, etc.) to only those that are strictly necessary; and

6) Employers must notify the Health Authority of any data or information they have become aware of in relation to persons possibly infected in order to investigate potential spread of the virus.

In addition to the above, all employers have health and safety obligations to keep employees informed about health risks that may arise in carrying out their duties and to ensure that working practices do not create undue risks to employees.

As such, employers should carry out a risk assessment and consider any factors that may make employees particularly susceptible to infection. Employers should also consider circulating up-to-date information on good hygiene practices and provide any necessary equipment to facilitate this, such as hand sanitisers. For example, we recommend issuing a reminder on action employees can take to help stop viruses like coronavirus spreading. Such advice may include:

  • Cover your mouth and nose with a tissue or your sleeve (not your hands) when you cough or sneeze
  • Put used tissues in the bin immediately
  • Wash your hands with soap and water often – use hand sanitiser gel if soap and water are not available
  • Try to avoid close contact with people who are unwell

We further recommend notifying employees where they can access more information if they are concerned.

Finally, from a health and safety standpoint, employers should assess, in coordination with the company physician and the Head of the Prevention and Protection Service (RSPP), the existence of a specific biological risk related to Covid-19.

If such a risk exists, a Risk Assessment Document (DVR) must be updated and a specific prevention and protection plan must be implemented with the aim of eliminating, or at least reducing, the occurrence of dangerous situations, possibly providing for individual protection measures.

It should also be noted that, pursuant to Art. 26 paragraph 3-bis of Legislative Decree No. 81/2008, in case of service contracts involving contact between the provider and the principal's employees, a DUVRI (Interferential Risk Assessment Document) must be drafted even in case of services which are of an intellectual nature only, if there are risks arising from the presence of biological agents (such as infection from COVID-19).

Can employers request or require information from an employee about potential or actual exposure to the virus?

The question of whether an employee can be asked to sign a declaration about where they have been, their exposure to the virus, or be required to provide information to an employer in order for the employer to provide confirmation to a customer sits firmly in the crossover between data privacy and employment.

Italian employers are under a duty to provide a safe and secure working environment under the Legislative Decree No. 81/2008. The collection of such data may be necessary to protect the health, safety and welfare of other employees. Italian employees are subject to a more general obligation to comply with reasonable instructions or requests issued by their employer, and an employer may take further action including disciplinary action where an employee fails to do so. Employers in principle may therefore require an employee to confirm and specify where he/she has spent the past 15 days in order to assess the level of risk to the workforce. Employers may not, however, ask employees to confirm that they are not infected or request a medical certificate to the same effect.

In response to a request for clarification concerning the possibility of collecting data concerning employees' flu symptoms or recent travels, the Italian Data Protection Authority (DPA) issued a message on 2 March 2020 stating that employers "must refrain from collecting, a priori and in a systematic and generalized way, also through specific requests to employees or unauthorized investigations, information on the presence of any flu symptoms of the employee and his closest contacts or in any case falling within the non-working sphere". The Italian DPA clarified that such investigations are reserved for the competent authorities.

This position expressed by the Italian DPA suggests that caution should be exercised when collecting such information, which should be evaluated on a case-by-case basis in light of factors such as the peculiarities of the case, the area in which the company operates and the tasks of the employees.

However, for the processing of such information to be considered permitted, it must be processed in accordance with the applicable privacy requirements. Information about an employee's health (such as whether the individual has been diagnosed with the virus or is suffering from any symptoms) is sensitive personal data and accordingly additional requirements and obligations apply to the processing of such data. Despite the GDPR being EU-wide legislation, the position is complex from a European data privacy perspective. Employers will find that the type and extent of the information they can compliantly process, and the legal basis for doing so, varies from country to country.

  • In Italy, employers should be able to process such employee information by relying on Article 9(2)(b) GDPR, on the basis of the health and safety duty referred to above.
  • Italian employers would need to show that the collection of employee information is necessary to protect the health, safety and welfare of its employees, and should document its consideration of the risk to its employees and of any alternatives considered.
  • Employers would need to have an appropriate policy document in place for such processing and the usual key principles and obligations (such as transparency, data minimisation and security requirements).

Employers may also face situations where a customer/client requires travel or health information relating to their employees when visiting the customer/client's site.

In these circumstances, the customer/client may collect such information autonomously (i.e. without involving the employer) from the employees visiting his site in compliance with its GDPR obligations. Customers/clients are therefore required to provide a privacy policy providing information on the features of processing and the lawful basis for such processing (e.g. consent, or other basis under section 9 GDPR). This information should not be communicated between the employer and the customer/client, as such communications would not be considered proportionate.

Further to the above, the position regarding European data privacy rules and how they impact information relating to COVID-19 is developing. A number of EU governments have issued further guidance (including Italy, as set out above) and more still are considering whether emergency legislation may be required, particularly if the situation escalates. The position will need to be kept under review as the situation evolves and further guidance becomes available.

What should employers do if an employee is absent or infected?

Infected employees

If an employee is infected with COVID-19, the employer must inform the company doctor and the Health Manager (RSPP). The company doctor will then take the appropriate steps and inform the competent authorities, who will then give the company the necessary instructions. There is currently no specific requirement for employees to inform staff representatives, the whole workforce or customers.

It is recommended, however, to inform clients or third parties who have been in contact with infected employees. The authorities will provide more information on this where relevant.

Infected employees will be indemnified under regular sick leave provisions (which will be paid by the employer but offset by the National Social Security Agency).

Potentially Infected employees

Employers should immediately inform the public authorities about the identity of possible exposed or infected employees. The authorities will then take relevant measures.

Quarantined employees

If an employee is in quarantine without symptoms (for example if an employee lives in the 'red zone') they must be considered to be on sick leave.

What are employers' obligations where offices are partially or fully closed?

If an employer voluntarily closes its business in Italy, employees must be treated as being on paid leave and therefore be paid their normal salary. However, if the employer can prove that it was unavoidable to take such a protective measure, the absence may be unpaid.

If businesses are closed due to a "sudden and significant event or order from public authorities" caused by circumstances not attributable to the company, the Ordinary Wage Guaranteed Fund (CIGO) can be requested.

The Italian government has also allocated €20 million to the national emergency fund, but at the time of writing it is unclear how this will be used.

Where can employers and employees access local and national advice?