The processing of employee data is only permitted if “indispensable”
Abstract by Damiana Lesce
Under article n. 267 of June 15, 2017, of the Italian Personal Data Protection Authority rejected the request of an employer, aimed at processing the personal data of employees in compliance with the terms of a commercial contract, whereby the employer undertook to notify to its clients the name of its employees with criminal records.
Under the General Authorization n. 7/2016, the Data Protection Authority authorized employers to process judicial data if this is “essential for fulfilling specific obligations or performing specific tasks provided as at law, and in regulations or collective bargaining agreements and for the purpose of managing the employment relationship”. In the specific case decided with the resolution n. 267/2017, the company’s request was rejected in consideration that they had not proved the existence of a legal basis (legislative, regulatory or contractual) adequate to legitimize the processing of judicial data or the disclosure of data to the client.