THE PROCESSING OF “META DATA” FROM COMPANY EMAILS

With the Guideline Document dated 21.12.2023, the Italian Data Protection Autorithy has issued precise provisions regarding the treatment of “metadata” from company emails. Firstly, it is important to clarify the exact scope of the mentioned provision: as can be inferred from its wording, the Supervisor intends to refer to emails sent and received from company email accounts, which therefore can only concern issues and business matters of the company for which the employee works. The “metadata” refers to data concerning, for example, the date and time of sending, sender and recipient, and so on. Starting from an improper or at least unwise interpretation of Article 4 of the Workers’ Statute, the Supervisor asserts that storing such information in the cloud, even using third-party programs, without a very specific time limit would be illegitimate and, consequently, establishes that metadata can be stored: “… Normally for a few hours or a few days, in any case not exceeding seven days, extendable, in the presence of proven and documented needs justifying their extension, by a further 48 hours.” We do not hesitate to affirm that the aforementioned provision is incorrect, not only due to the incorrect interpretation of Article 4 of the Workers’ Statute but also due to a technical error that is puzzling: the Supervisor considers the computer as the “tool” of work, without considering that, in this case, the work tool is the program, namely the application for sending, receiving, and archiving email. In any case, the wording of the aforementioned Article 4 is, or should be, clear: for all tools used to monitor work performance, prior authorization must be obtained from the employer. According to paragraph 2 of the regulation, however, such authorization is not required for “… tools used by the worker to perform work…”. The application used for email is a work tool. However, the aforementioned Provision is in force, and caution suggests that it should be taken into account. In this regard, it is advisable, first of all, that with a specific communication to be signed by all parties concerned, it is prescribed that company email accounts, namely those with the extension name@company…, should be used only for work purposes. Secondly, if it is believed that archiving metadata is not necessary for proper company management, it is advisable to comply with the Supervisor’s prescription. The Firm remains available for any clarification that may be necessary. Best regards.