Supreme Court of Cassation: requirements for the lawful processing of personal data relating to an employee’s travels taken from the Telepass system.

With Order No. 15391 of 3 June 2024, the Court of Cassation specified the requirements under which the employer may legitimately process data from the Telepass system installed on the company car. A company technician had been dismissed for objective justification, having disclosed geolocation data (taken from a PDA in use by the employee and from the movements recorded at the toll booths by the Telepass system) omissions and failure to perform work activities. While the Court of First Instance had rejected the application for the annulment of the dismissal, the Court of Appeal had held that the data taken from the Telepass system could not be used for an illegitimate - albeit ex post - remote control of the worker because it was not based on ‘adequate information’ within the meaning of Article 4(3) of the Workers' Statute, which permits the use ‘for any purpose of the employment relationship’ of personal data collected by means of control instruments provided that the worker is given adequate information about ‘the manner of use of the instruments and the performance of the controls’ and that the conditions set out in the Privacy Code (rectius: by the applicable data protection legislation). Since the employer had failed to provide the due information of transparency on the installation of the Telepass on the company car (even though it was a work tool assigned to the transfer technician for the performance of his duties), the Court held that the data on which the dismissal was based were unusable (whereas the employer had correctly processed the data taken from the PDA, for which there was both the specific privacy notice and the correct setting pursuant to Article 4 of the Workers' Statute). Therefore, the Court of Cassation once again emphasised the fundamental importance of transparency vis-à-vis employees as a discriminating factor between lawful and unlawful collection of data and between remote control that complies or does not comply with Article 4 of the Workers' Statute.