Main background information

The defensive use of video surveillance by the employer if directed to ascertain illegal behavior and damage to assets and corporate image are exempt from the scope of application of art. 4 l. n. 300/1970, and do not require compliance with the guarantees provided by that law, especially when the video surveillance is arranged after a crime is committed, so as to disregard the mere supervision on the execution of work performance (see Criminal Cassation section III, 14/12/2020, n. 3255)“.

This is the principle that the Italian Criminal Court of Cassation has expressed and that deserves to be contextualized and interpreted correctly in order not to fall into the misunderstanding of believing that one can install a video surveillance system in the workplace sic et simplicter without incurring any criminal sanctions.

The case submitted for examination by the Court of Cassation concerned the installation of a video surveillance system by the owner of a retail business in the absence of a prior agreement with the company’s trade union representatives or the authorization of the Labor Inspectorate. The employer, in particular, had installed this system because of some shortages (e.g., products were missing) in the employer’s warehouse. The system was therefore installed to protect the company’s assets. In this case, the cameras pointed exclusively on the shelves and towards the tills.

Main topic

The question that arises in the case under analysis requires verification of whether and when the crime pursuant to article 171 of Legislative Decree no. 196/2003 (“Personal Data Protection Code”) can be committed, which is inferred from the combined provisions of articles 4 and 38 of Law no. 300 of May 20, 1970 (the so-called “Workers’ Statute”). Pursuant to the aforementioned provisions, the offence occurs whenever audiovisual equipment or other instruments that may be used to remotely monitor the activities of employees are installed in the absence of an agreement with trade union representatives or without authorization from the (Territorial or National) Labour Inspectorate (hereinafter, for the sake of simplicity, only the “Conditions”) and, therefore, in breach of the regulations set out in art. 4, paragraph 1 of the Workers’ Statute.

It should be pointed out that, following the successive reforms that have taken place over time, art. 4 paragraph 1[1] of the Workers’ Statute has[2], on the one hand, maintained its main rationale of prohibiting the installation of equipment designed to remotely monitor a worker’s activities in the absence of the Conditions. On the other, however, it has “strengthened” the provision of specific exceptions aimed at protecting the company’s assets, exceptions that we will analyze in greater detail below and on which the judgment under review is based.

The development of jurisprudence over time, in fact, has taken into account, in some pronouncements, the exceptions of art. 4, paragraph 1 of the Statute, not always deeming the case under art. 171 of the Personal Data Protection Code to be integrated in absence of the Conditions.

In particular, the Supreme Court of Cassation has shown an ambivalent attitude on the subject, considering in some pronouncements even the mere installation of a video surveillance system by the employer as unlawful conduct, even where a “fake” camera or when a camera is not actually used, in the absence of the Conditions (see, in particular, Sect. 3, no. 45198 of 07/04/2016, Luzi, Rv. 268342-01, and Sect. 3, no. 4331 of 12/11/2013, dep. 2014, Pezzoli, Rv. 258690-01). In others it has expressed a principle of law which is more favorable to the employer, considering legitimate the so-called hidden defensive controls of the employer aimed at ascertaining unlawful conduct of the employee (thus, in motivation, Sect. 3, no. 8042 15/12/2006, Fischnaller, Rv. 236077-01, which also cites, as a further precedent, “Cass. 16/06/2002, no. 8388”). In these last sentences, in the event of concrete evidence of unlawful acts by employees to the detriment of the company’s assets, hidden surveillance by the employer in the workplace has been deemed admissible in order to dispel doubts as to the existence or otherwise of such conduct, even in the absence of the Conditions.

This principle has also been embraced by the Strasbourg Court[3], which has deemed legitimate the hidden surveillance carried out by the employer in the workplace even in the absence of the Conditions, provided that the surveillance activity respects the criterion of proportionality, which exists in the hypothesis of:

    • serious and concrete indications that the employee is committing wrongdoing[4];
    • surveillance limited to the sole purpose of ascertaining the wrongdoing being committed by the employee, and in a manner proportionate to that sole purpose[5]; and
    • discontinuation of covert surveillance once the investigation of the case has been completed.

Obviously, this cannot allow the employer to carry out generalized and indiscriminate surveillance.

The case under examination follows exactly these hermeneutical principles, as it states that for the purposes of the admissibility of the installation of the system in the absence of Conditions, it is necessary that this “is strictly functional to the protection of corporate assets, provided, however, that its use does not imply a significant control on the ordinary course of work of employees, or must remain necessarily ‘confidential’ to allow the detection of serious misconduct of the same”.

This interpretation, according to the Court, is consistent with the regulatory provisions, as art. 4 of the Workers’ Statute requires prior agreement when the installation of the system is functional to the control, even potential, of the working activity of the employees and not when, exceptionally and occasionally, it is set up for the sole purpose of controlling the activity of a single worker in order to protect the company’s assets and in the presence of certain circumstances and protections in the field of confidentiality and the protection of personal data[6].

Conclusions and practical implications

As seen from the brief notes above, the installation of a video surveillance system is not permitted in the absence of protections for the worker, but it is necessary to verify how to proceed on a case-by-case basis, according to the principle of proportionality. In particular, the interpretation of art. 4 of the Workers’ Statute requires a fair and reasonable balance between the constitutional provisions. First of all, on one hand, the right to dignity and freedom of the worker in the exercise of its services and the right of the citizen to respect for his or her person must be guaranteed (Articles 1, 3, 35 and 38 of the Constitution), and the free exercise of the activities of the company). At the same time, on the other hand, the free exercise of entrepreneurial activities must be guaranteed (art. 41 Constitution), with the further consideration that “it would not respond to any logical-systematic criterion to guarantee the worker – in the presence of unlawful conduct punishable criminally or with the expulsion sanction – a protection to his ‘person’ greater than that recognized to third parties unrelated to the company” (so, verbatim, in the grounds, Civ. Sec. Lab. No. 10636 of 2017).

In order to comply with the above principle, the employer must therefore equip itself with management and control systems that are adequate and proportionate to the type of machinery and system installed and integrated with the various applicable regulations, including the protection of personal data and the rights enshrined in labor law, in order to adequately weigh the risks to be prevented and provide appropriate protection measures identified on the basis of a risk-based approach.

In other words, even in the exceptional cases mentioned above, all necessary requirements should be followed in order to make the video surveillance system compliant with the various applicable regulations so that the employee can be monitored in the absence of the Conditions. Among the precautions to be taken into consideration with a view of achieving maximum compliance with the principle of proportionality referred to above, one cannot forget (1) the limitation of the visual angle subject to video surveillance and (2) the temporal limitation of filming what is strictly necessary in relation to the exceptional purposes pursued.

Exceptions will therefore have to be assessed on a case-by-case basis, bearing in mind in any case the importance of protecting workers by strengthening their internal management and control systems to safeguard personal data and the guarantees provided for by employment law.

To this end, from the point of view of accountability[7] and with a view to the maximum protection of the employer, it is suggested that a specific procedure be drawn up detailing the employer’s methods of action, both in the event of so-called “defensive” controls and in the event of any other type of control. Finally, it is suggested that a specific procedure is drawn up detailing the action to be taken by the employer, both in the case of so-called “defensive” controls and in all cases where it is necessary to access video surveillance images, in order to respect the principle of data minimization and the opposing needs (protection of assets and respect for the freedom of workers) at stake, adequately examining the needs of the company from the point of view of labor law, data protection, and criminal law (which may be relevant both from the point of view of the Personal Data Protection Code and pursuant to Legislative Decree 231/2001).

In all other cases, the following points should be noted:

    1. it is necessary to prepare a prior trade union agreement with the company trade union representatives or, alternatively, to request authorization from the Territorial Labor Inspectorate;
    2. it is necessary to follow the indications of the European Data Protection Board expressed in the Guidelines 3/2019 on the processing of personal data through video devices, in addition to the principles expressed by the Italian Supervisory Authority[8] on the subject;
    3. to carry out a data protection impact assessment pursuant to Article 35 of the European Regulation 2016/679 (“GDPR”)[9],
    4. Draft a privacy policy/information notice (both short and extended versions) pursuant to Article 13 of the GDPR and following the above-mentioned prescription,
    5. to carry out a legitimate interest assessment (Article 6(1)(f) of the GDPR).