By means of Provision No. 363\/2025, the Italian Data Protection Authority (Garante per la protezione dei dati personali) issued an\u00a0unfavourable opinion\u00a0concerning the display of employee absences on company notice boards or within internal communications,\u00a0even where such information is conveyed through acronyms or abbreviations.<\/p>\n
Background of the Case<\/strong> The information in question was disclosed through the use of abbreviated codes (e.g., “MAL” to indicate illness, “104” for leave under Law No. 104\/1992 concerning assistance to disabled persons, “INF” for injury, “SOSP” for disciplinary suspension or sanction, “PS” for trade union leave, “ric.osp.” for hospitalization, and “AVIS” for blood donation). These codes were made accessible to all employees through the posting of shift schedules on company notice boards located at transportation depots used in the operation of the service, as well as through the dissemination of emails to company personnel.<\/p>\n In response to the Authority\u2019s request for clarification, the Company asserted that the use of such abbreviations served to ensure transparency and to prevent disputes among employees required to cover for absent colleagues.<\/p>\n The Company further informed the Authority that it had taken steps to eliminate all abbreviations and codes referenced in the complaint and had opted instead to use solely the letter\u00a0\u201c<\/strong>A\u201d<\/strong>\u00a0to generically denote any type of absence, stating that this change was made \u201cin order to comply with the prescribed requirements and solely to avoid litigation.\u201d<\/p>\n Following its examination of the documentation submitted, the Data Protection Authority held that the abbreviations employed by the Company for the various types of absences were\u00a0capable of revealing personal data, including sensitive data, pertaining to individual employees.<\/p>\n Moreover, the duty rosters were posted on notice boards located at the company depots, which are freely accessible to all company personnel, and were also communicated to employees by email<\/p>\n As a general principle, an employer is permitted to process the personal data of employees \u2014 including data falling within the special categories (such as data concerning health or trade union membership) \u2014 where such processing is necessary for the management of the employment relationship and for the fulfilment of specific obligations or duties imposed by law, European Union legislation, regulations, or collective agreements.<\/p>\n On the other hand, employees\u2019 personal data may not be disclosed to individuals who are not parties to the contractual relationship, nor may it be processed by individuals operating within the company who are not expressly authorized to access such data in light of their assigned duties.<\/p>\n The Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) has determined that the processing of so-called special category data by the Company is unlawful, having been carried out in the absence of a valid legal basis as required under Article 9(2) of the General Data Protection Regulation (Regulation (EU) 2016\/679), and in breach of the data minimisation principle pursuant to Article 5(1)(c) of the same Regulation.<\/p>\n In conclusion, it is strongly recommended that, in the context of any activities concerning the management of the employment relationship, only data that is strictly necessary and not of a sensitive nature concerning the employee\u2019s private life be disclosed or processed.<\/p>\n 18 September 2025\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Lawyer Dr. Angelo Pisciotta<\/p>\n <\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" By means of Provision No. 363\/2025, the Italian Data Protection Authority (Garante per la protezione dei dati personali) issued an\u00a0unfavourable opinion\u00a0concerning the display of employee absences on company notice boards or within internal communications,\u00a0even where such information is conveyed through acronyms or abbreviations. Background of the Case The trade union FAISA Cisal Molise, acting on […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11337","post","type-post","status-publish","format-standard","hentry","category-news"],"acf":[],"yoast_head":"\n
\nThe trade union FAISA Cisal Molise, acting on behalf of certain employees of SATI S.p.A. \u2013 Societ\u00e0 Autocooperative Trasporti Italiani (hereinafter, the “Company”) \u2013 submitted a formal complaint to the Data Protection Authority, alleging the unlawful disclosure by the Company of personal data, including sensitive data, relating to the reasons for employees\u2019 absences from work.<\/p>\n