With Decision No. 99878885 of February 22, 2024, the Italian Data Protection Authority (the “Authority”) has launched a public consultation on the issue of the time – limit to preserve the metadata of workers’ e-mails (day, time, sender, recipient, subject, size of e-mail).
This decision has come in the wake of numerous perplexities raised by Authority’s Decision No. 9978728 of 21/12/2023 (‘Computer programmes and services for the management of e-mail in the work context and the processing of metadata’ or ‘Guide-Lines’), due to the considerable organisational and implementation difficulties, as well as the risks it would generate, for employers.
This measure, we recall, limits the retention of metadata of workers’ e-mails to seven days (extendable to a maximum of nine). In order to retain metadata for a longer period, the Italian Data Protection Authority specifies, the employer must activate the procedure under Article 4 of Law 300/1970 (‘Workers’ Statute’) and therefore proceed to a trade union agreement or authorisation by the Labour Inspectorate.
This measure has given rise to a considerable amount of criticism, also in light of the fact that the preservation of company e-mails, in their entirety (including metadata), is very often necessary for the performance of the company’s and the worker’s work activities and, where necessary, a legal and evidentiary tool.
The opinions of public and private employers as well as those of experts and interested parties is therefore awaited, who may send their comments or proposals to the Authority within 30 days. Also the Guide -Lines have been suspended for a 30 days period.
The majority of opinions hopes that the retention period for metadata may once again be determined by the employer on the basis of its organisational, business and legal needs.