Italian Data Protection Authority Restricts Employer Use of Social Media Evidence in Disciplinary Proceedings

The Italian Data Protection Authority has issued a new decision further restricting employers' ability to use information from third-party reports, private conversations, or social media posts as evidence in disciplinary proceedings. This decision adds to the ongoing debate on the subject and introduces additional constraints, particularly regarding the use of message conversations that may have disciplinary relevance.

The Italian Data Protection Authority (DPA) has issued a decision ruling that employers are not allowed to use private communications and social media content as evidence in disciplinary proceedings. The decision came after an employee complained that her company had unlawfully used data from her private social media and messaging accounts in the context of disciplinary proceedings. The employee was dismissed for cause, and the DPA investigated whether the company had complied with the principles of lawfulness, purpose limitation, and data minimization as required by the EU General Data Protection Regulation (GDPR) and Italian privacy law.

Key Takeaways:

• The Italian Data Protection Authority has restricted employers' ability to use information from third-party reports, private conversations, or social media posts as evidence in disciplinary proceedings.
• The decision emphasizes that even the mere receipt and subsequent use of such data in disciplinary proceedings is sufficient to trigger data protection obligations.
• Employers are not allowed to use private communications and social media content as evidence in disciplinary proceedings without a specific legal basis.
• The DPA distinguished between data made publicly available and data shared within a closed or private context, finding that even if information is accessible to a limited group, there is a legitimate expectation of privacy.
• Italian law prohibits employers from collecting or processing information about employees' opinions or facts irrelevant to their professional role, regardless of how the information is obtained.
• The DPA declared the company's processing of the employee's personal data to be unlawful and imposed a significant administrative fine of EUR420,000.
• The decision underscores the heightened level of protection afforded to employees' personal data in the workplace, particularly regarding private communications and opinions expressed outside the scope of employment.

Statistics:

• EUR420,000: the administrative fine imposed by the DPA on the company for violating the principles of lawfulness, purpose limitation, and data minimization.
• May 21, 2025: the date of the DPA's decision.
• A month later: the time period between the decision and its publication.

Sources:

• Garante per la Protezione dei Dati Personali (Italian Data Protection Authority)
• EU General Data Protection Regulation (GDPR)
• Italian privacy law (Law 300/1970 and Article 113 of the Privacy Code)
• Social media platforms (Facebook, Messenger, WhatsApp)