By means of Provision No. 363/2025, the Italian Data Protection Authority (Garante per la protezione dei dati personali) issued an unfavourable opinion concerning the display of employee absences on company notice boards or within internal communications, even where such information is conveyed through acronyms or abbreviations.
Background of the Case
The trade union FAISA Cisal Molise, acting on behalf of certain employees of SATI S.p.A. – Società Autocooperative Trasporti Italiani (hereinafter, the “Company”) – submitted a formal complaint to the Data Protection Authority, alleging the unlawful disclosure by the Company of personal data, including sensitive data, relating to the reasons for employees’ absences from work.
The information in question was disclosed through the use of abbreviated codes (e.g., “MAL” to indicate illness, “104” for leave under Law No. 104/1992 concerning assistance to disabled persons, “INF” for injury, “SOSP” for disciplinary suspension or sanction, “PS” for trade union leave, “ric.osp.” for hospitalization, and “AVIS” for blood donation). These codes were made accessible to all employees through the posting of shift schedules on company notice boards located at transportation depots used in the operation of the service, as well as through the dissemination of emails to company personnel.
In response to the Authority’s request for clarification, the Company asserted that the use of such abbreviations served to ensure transparency and to prevent disputes among employees required to cover for absent colleagues.
The Company further informed the Authority that it had taken steps to eliminate all abbreviations and codes referenced in the complaint and had opted instead to use solely the letter “A” to generically denote any type of absence, stating that this change was made “in order to comply with the prescribed requirements and solely to avoid litigation.”
Following its examination of the documentation submitted, the Data Protection Authority held that the abbreviations employed by the Company for the various types of absences were capable of revealing personal data, including sensitive data, pertaining to individual employees.
Moreover, the duty rosters were posted on notice boards located at the company depots, which are freely accessible to all company personnel, and were also communicated to employees by email
As a general principle, an employer is permitted to process the personal data of employees — including data falling within the special categories (such as data concerning health or trade union membership) — where such processing is necessary for the management of the employment relationship and for the fulfilment of specific obligations or duties imposed by law, European Union legislation, regulations, or collective agreements.
On the other hand, employees’ personal data may not be disclosed to individuals who are not parties to the contractual relationship, nor may it be processed by individuals operating within the company who are not expressly authorized to access such data in light of their assigned duties.
The Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) has determined that the processing of so-called special category data by the Company is unlawful, having been carried out in the absence of a valid legal basis as required under Article 9(2) of the General Data Protection Regulation (Regulation (EU) 2016/679), and in breach of the data minimisation principle pursuant to Article 5(1)(c) of the same Regulation.
In conclusion, it is strongly recommended that, in the context of any activities concerning the management of the employment relationship, only data that is strictly necessary and not of a sensitive nature concerning the employee’s private life be disclosed or processed.
18 September 2025 Lawyer Dr. Angelo Pisciotta