Garante per la protezione dei dati personali (Italy) - 10154148
From GDPRhub
| Garante per la protezione dei dati personali - 10154148 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(c) GDPR Article 5(1)(e) GDPR Article 5(1)(a) GDPR Article 6 GDPR Article 9 GDPR Article 13 GDPR Article 88 GDPR Article 113 d. lgs. 196/2003 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 23.08.2021 |
| Decided: | 10.07.2025 |
| Published: | |
| Fine: | 50,000 EUR |
| Parties: | USB Lavoro Privato Puglia Magna PT S.p.a. |
| National Case Number/Name: | 10154148 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | GPDP (in IT) |
| Initial Contributor: | cci |
The DPA fined an automotive company €50,000. The company held "return-to-work" interviews to its employees, resulting in the unlawful collection of sensitive data.
English Summary
Facts
An automotive company (Magna PT S.p.A., the data controller) asked its employees (the data subjects) to undergo “return to work interviews” (“RTWI”) upon returning after leave. Interviews were carried out by the direct superior of the data subjects. The purpose of the interview was to support data subjects in their return to their workplace and gather information on possible shortcomings of the working environment in order to later address them. The questions included, among others, whether the employee's leave was caused by their work, whether their health condition got worse in time, and whether their doctor prescribed specific accomodations or limitations. The controller claimed that participation in the interview was voluntary.
Answers given in the interview were manually transcribed in a form and forwarded to HR. HR would then assess the modules and consider possible action to address any issues, along with the data subjects’ superior or the company doctor.
Forms were stored for a maximum of ten years. In practice, the controller periodically reviewed the forms and destroyed the ones it did not consider relevant anymore. At the time of the investigation, no form had been stored for longer than 1 year.
In 2021 a workers’ union (USB Lavoro Privato Puglia) challenged the lawfulness of this practice by filing a complaint with the DPA. The DPA investigated the complaint two years later.
Holding
The DPA held that the controller violated Articles 5(1)(c)(e), 6, 9, 13 and 88 GDPR as well as Article 113 of the Italian privacy code. The DPA issued a €50,000 fine and ordered the erasure of the subjects’ data.
On lawfulness
The controller stated that the processing relied on the legal basis of consent. In this regard, the controller observed that while consent cannot generally be freely given by employees, EDPB and WP29 Guidelines leave some room for consent when the employee's refusal has no negative consequences for the employee. The controller argued that this was precisely the case of its interviews.
As an alternative to consent, the controller also invoked the legal bases of legal obligation and legitimate interest as its legal bases.
The DPA, however, held that the controller had no legal basis to process the subject’s data, for several reasons.
With regards to consent, the DPA considered that RTW interviews were carried out by a direct superior of the data subject. This, in and of itself, prevented data subject from giving free and valid consent. Furthermore, the DPA found that the sensitive nature of the data prevented the data subjects from freely giving their consent[1].
With regards to the other legal bases invoked by the controller, the DPA clarified that controllers must accurately identify the legal basis before processing personal data. In other words, controllers cannot invoke additional legal bases as a backup when the first legal basis doesn’t hold up to regulatory scrutiny, as the controller did in the case at hand.
On these grounds, the DPA held that the controller violated Articles 5(1)(a), 6 and 9 GDPR.
On transparency
The DPA held that the privacy notice contained in the form, did not provide data subjects with sufficient information. The DPA also noted that even the general company policies, to which the notice referred, did not specifically address the processing of data collected in RTWI forms.
On these grounds, the DPA held that the controller breached its transparency obligation, in violation of Articles 5(1)(a) and 13 GDPR.
The DPA also held that because the controller violated its transparency obligations, the consent of data subjects was not informed (aside from not being freely given, for the reasons explained above).
On data minimization
The DPA held that the data collected in RTWI forms was excessive and unnecessary for the employer to comply with its legal obligation to ensure workers’ health on the workplace//. The DPA also observed that some of the data collected via the module, was already available to HR, which made its repeated collection unnecessary.
For the reasons above, the DPA held that the controller violated the principle of data minimization under Article 5(1)(c) GDPR.
On storage limitation
The DPA held that the maximum storage period of 10 years was excessive. The DPA also acknowledged that the storage periods were much shorter in practice but also considered that the controller failed to both establish clear policies on the “actual” storage times, and to inform the data subjects about those policies.
On these grounds, the DPA held that the controller violated the principle of storage limitation under Article 5(1)(e) GDPR.
On the relevance of the data
Finally, the DPA considered that under Italian employment law[2], employers are only allowed to collect employees’ data when the data are relevant to assessing employees’ capacity for work. The DPA held that RTWI interviews could potentially collect data which were irrelevant to this assessment, in violation of Italian law.
On these grounds, the DPA found that the controller violated Article 88 GDPR and 113 d. lgs. 193/2003.
Comment
On Article 2087 c.c.
Article 2087 of the Italian Civil Code requires employers to adopt all necessary measures to ensure employees' health on the workplace. The controller invoked this provision in two different ways: first, as a legal basis for processing personal data (i.e. a legal obligation under 6(1)(c) GDPR); and second, to argued that it complied with the principle of data minimization.
The DPA did not directly examine the controller’s argument that Article 2087 c.c. constituted a valid basis for processing personal. Rather, it dismissed it on grounds that the controller was not allowed to invoke a legal obligation as a "backup" legal basis after invoking consent first.
That being said, the decision implies that legal obligation would not have constituted a valid legal basis either way. When assessing compliance with the data minimization principle, the DPA held that the collection of personal data exceeded what was necessary to comply with Article 2087 c.c. It logically follows that the collection did not meet the requirement of necessity under Article 6(1)(c) GDPR and that legal obligation was, therefore, not a viable legal basis.
On Article 88 GDPR and Italian law
Article 88 GDPR allows Member States to provide for more specific rules to protect employees' personal data in the employment context.
This provision is specified in the Italian legal system by Article 113 of the Italian Data Protection code. In turn, the Article refers to two provisions of employment law: Article 8 l. 300/1970 and Article 10 d. lgs. 276/2003. Both l. 300/1970 and l. 276/2003 forbid employers from collecting information about employees which is not relevant to the evaluation of employees' working capacity.
In the case at hand, the DPA considered that this prohibition was violated. In the DPA's view, this constituted a breach of both Article 88 GDPR and Article 113 of the Data Protection Code.
Of course, the DPA is not competent to declare a violation of Italian employment law. However, the DPA often uses Article 8 l. 300/1970 and Article 10 d. lgs. 276/2003 as a standard for assessing whether the processing of employees' data complies with data protection law (see for instance Garante per la protezione dei dati personali - Provv. 10143261).
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
SEE ALSO Newsletter of August 1, 2025
[web doc. no. 10154148]
Measure of July 10, 2025
Register of Measures
No. 390 of July 10, 2025
THE ITALIAN DATA PROTECTION AUTHORITY
IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, members, and Dr. Claudio Filippi, Acting Secretary General;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");
HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the "Code");
HAVING SEEN the report submitted pursuant to Article 144 of the Code by O.S. Lavoro Privato Puglia against Magna PT S.p.A.;
HAVING EXAMINED the documentation in the file;
HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Guarantor's Regulation No. 1/2000;
REPORTER: Professor Pasquale Stanzione;
WHEREAS
1. The report against the Company and the preliminary investigation.
On August 23, 2021, O.S. USB Lavoro Privato Puglia has filed a report, pursuant to Article 144 of the Code, against Magna PT S.p.A. (hereinafter, the Company), which complained that workers were being subjected to a "return to work interview" involving the completion of a questionnaire [...] following absences due to illness or hospitalization.
On January 10, 2024, the Company, following a request for information sent pursuant to Article 157 of the Code by the Office, submitted its response and stated that:
- "In 2016, the GETRAG Group was acquired by Magna, one of the largest and most diversified suppliers of components for the automotive sector, present globally with over 160,000 employees and 400 company locations" (see note dated January 10, 2024, p. 1);
- "Regarding the RTWI "Return to Work Interview" form (hereinafter the "Form"), which was the subject of the request for information, Its use is part of standard management practice whereby, upon returning from a period of absence, employees are invited to a meeting (which is conducted as an interview, using the Form) with their manager" (see note cit., p. 1);
- "the interview is part of workplace health and safety practices, responding to the need to ensure the mental and physical health of workers, while respecting the mutual responsibilities between the employer and the competent doctor" (see note cit., p. 2);
- "the purpose of the interview is to identify any difficult situations in the workplace and possibly provide support to the employee and/or facilitate their rapid reintegration into work" (see note cit., p. 2);
- "the Form is filled out manually by the manager of the employee being interviewed" (see note cit., p. 2);
- "the manager then delivers the Form to the Human Resources office, which reviews it and Evaluates, together with the manager and/or the competent physician, any initiatives to be implemented to protect the worker's physical and mental health, such as the possibility of modifying the workstation at the worker's request or managing any requests from the employee to be assigned to an alternative or temporary workstation, or reporting problems in relationships with supervisors and/or collaborators" (see note cited, p. 2);
- with reference to "RTWI Form Update in 2020," "we would like to point out that you have received two forms: - The one in force until May 2020 ([…] sub-annex 1 […]) - The one drawn up in May 2020 ([…] sub-annex 2 […])" (see note cited, p. 2);
- "this second form, attached sub-annex 2, had been streamlined compared to the first version” (see note cited, p. 2);
- with reference to the “second revision of the RTWI Form,” it is specified that “in September 2021, … the form was revised again. In the revision, which resulted in further simplification, … the information was expanded” (see note cited, p. 3);
- “in all versions of the forms, it is always highlighted that the information collected is subject to confidentiality by the relevant company functions. Specifically, the versions of the Form used during the pandemic emergency (Appendixes 1 and 2) specified that the information would be managed in full compliance with the regulations on privacy and personal data processing and that the data collected would be processed exclusively for prevention purposes (see note cited, p. 3);
- "Furthermore, the header of the form used since September 2021 and still in use (Appendix 3) includes the following wording: 'The data collected in the following form is for the sole purpose of prevention for health and safety purposes, and the form is completed after a period of absence from work due to illness, injury, or hospitalization. This form does not process data relating to the worker's health or special data. It is not necessary to indicate any information relating to pathologies or special circumstances in the form. Completion of the form remains optional.' For any further information on how Magna PT SpA processes personal data, please refer to the information provided at the bottom of this form and in the Personal Data Protection Policy available on BIC* and Magnet* ["BIC and Magnet are the company portals that contain company procedures and information, which all Magna PT S.p.A. employees can access."], as well as in the data processing notice available on the payroll portal" (see note cited, p. 3);
- "In any case, even before the 2021 update, the Personal Data Protection Policy and the privacy notice, available on the company's IT portals, already informed employees of the possibility of data processing aimed at fulfilling health and safety obligations in the workplace" (see note cited, p. 3, 4).
On April 11, 2024, the Company, in response to a further request for information made pursuant to art. 157 of the Code, the Department declared on March 13, 2024, that:
- "Regarding the wording included in the form in use since September 2021 [...] 'For any further information on how Magna PT S.p.A. processes personal data, please refer to the information provided at the bottom of this form.'" It is specified that: the bottom of the form contains information on document retention in accordance with the company's "Magna Global Record Retention Schedule" (MGRRS) policy, a common and well-known practice within the company. [...] The text contains several fields indicating: • Validity: indicates the date from which the form is valid, specifically August 25, 2021; • Security Class: indicates the level of confidentiality, in this case strictly confidential; • Storage: indicates the maximum storage time, in this specific case more than 10 years, as well as the storage office, in this specific case HR (indicated with the acronym HRPR03) and the storage location, in this specific case the personnel file (indicated with the acronym P03); • Permanent archiving: indicates the location where the document is stored (in line with what is indicated in the above point using the acronyms), in this case the personal folder at the company headquarters" (see note 11/04/2024, pp. 1, 2);
- "the logic of the classification manual is known and normally used within the company" (see note cited, p. 2);
- "the information in the form header was modified in 2020 (more explicitly specifying the purposes of the form) and then in 2021 (indicating, in particular, more extensively the purposes of the processing and the type of data processed and referring to additional documents and information on the company portal for details)" (see note cited, p. 2).
2. The initiation of the proceeding and the Company's submissions
On August 7, 2024, the Office carried out, pursuant to Article 166, paragraph 5, of the Code, the Notification to the Company of the alleged violations of the Regulations found, with reference to Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, 88 of the Regulations, and 113 of the Code.
On August 7, 2024, the Company filed a request for an extension of the deadline for filing written defenses and a request for a hearing. On August 8, 2024, the Office granted the requested extension.
On October 7, 2024, the Company filed its written defenses, and on that occasion, it emphasized that:
- "The Form is part of a standard and widespread management practice in the market aimed at ensuring proper fulfillment by the employer of its duties to protect the physical and mental well-being of workers pursuant to Article 2087 of the Italian Civil Code." (see note dated 7/10/2024, pp. 2, 3);
- "The employee's manager manually completes the Form and receives adequate training on how to conduct the interview, including instructions not to ask about the employee's health or review medical documents. In fact, under no circumstances did managers request information about the employees' health or review their medical documents. The Form also reminds the employee of the right to request a meeting with the company doctor" (see note cited, p. 3);
- "After completion, the manager checks the contents of the Form with the employee, who can sign it and request a copy, but is not required to sign. Subsequently, the Form is delivered to the Human Resources Office ("HR Office"), which, together with the manager and/or the company doctor, evaluates any actions to protect the employee's health, such as modifying the workstation or managing working relationships."(see note cited, p. 3);
- "The Form is stored in the employee's personal file, in a locked cabinet in the HR Office, accessible only to authorized personnel" (see note cited, p. 4);
- "Specifically, therefore, in 2020, two forms were used: the first, in force until May 2020 ([…] "Form 2020"), and the second, drafted in May 2020" (see note cited, p. 4);
- "The notice in the Form header was modified in 2020 to more clearly outline the purposes of the Form and subsequently in 2021 to expand the description of the purposes of the processing and the types of data processed (see chapter II.C.1), referring to the documents on the company portal for further details" (see note cited, p. 5);
- "The employer's general obligation under Article 2087 of the Italian Civil Code cannot be interpreted restrictively and staticly, limited to the mere fulfillment of express and specific regulatory obligations. It must be understood dynamically, as the employer is required to ensure workplace health and safety over time and continuously, according to best practices (most recently, Supreme Court of Cassation, August 21, 2024, No. 22996)" (see cited note, p. 6);
- "Health in the workplace must be interpreted broadly and dynamically, encompassing not only illness, but also "a state of complete physical, mental, and social well-being, not merely the absence of illness or infirmity" (Article 2, paragraph 1, letter o, Legislative Decree No. 81/2008)" (see cited note, p. 6);
- "The complex assessments and information related to health and well-being in the workplace cannot be left to the mere assessment of the suitability of the competent physician, but requires actual treatment, which must be carried out by the employer through appropriate organizational tools, including, according to Magna, the use of the Form to collect any employee concerns. Moreover, in an increasingly complex and technologically advanced society like today's, defined as a true "risk society," it is more than essential that systems be adopted in the workplace that, if not perfectly capable, at least attempt to detect situations of employee discomfort that a simple fitness-for-duty medical examination would not be able to map" (see note cited, p. 7);
- "In order to fulfill this duty, the employer must be able to detect collective and individual distress and therefore intervene before the workplace becomes the source of problems for workers" (see note cited, p. 7);
- "The creation of a healthy work environment and risk prevention are at the root of Magna's decision to use the Form" (see note cited, p. 8);
- "The Notice of Dispute was served after the deadline for closing the proceedings" (see note cited, p. 8);
- "The notice of initiation of the sanctioning proceeding was notified to the Company on August 7, 2024, after the expiration of the 120-day deadline from the discovery of the alleged violation, as set forth in the Internal Regulation of the Guarantor 2/2019, Table B, Section 2), and therefore in a state of exhaustion of the Authority's administrative power" (see note cited, p. 8);
- "The Authority in fact became aware of the facts at issue in this proceeding on August 23, 2021, when the Unione Sindacale di Base (Puglia regional coordination) reported the existence of the Form [...] requesting the Authority to investigate the legitimacy of the processing carried out" (see note cited, p. 8);
- "On September 1, 2021—at the end of the August holiday break—the 120-day deadline therefore began to run, as it was from that moment that the Authority had the information needed to ascertain any violations or at least to request information and clarification from the Company regarding the processing carried out" (see note cited, p. 9);
- "If such information had been requested before the expiration of the 120-day deadline, the deadline would have been suspended—pursuant to Article 7 of the Internal Regulations […]—for the period between any requests for clarification and the related responses, so as to allow the Authority to benefit from the net 120-day deadline to formulate any objections" (see note cited, p. 9);
- "In this case, the Guarantor sent the first request for information to the Company only on December 4, 2023, two years and four months after receiving the report and almost two years after the expiration of the 120-day deadline starting from September 1, 2021" (see note cited, p. 9);
- "The 120-day deadline is peremptory" (see note cited, p. 9);
- "In this case, the First Request was made by the Authority well after the deadline (i.e., 704 days after the deadline). It follows that the Authority notified the Company of the Notice of Notification in complete absence of any sanctioning power" (see note cited, p. 10);
- with reference to the "alleged lack of adequate information for data subjects," "given that Form 2020 and the Covid Form have long been eliminated, Form 2021 is substantially correct and complies with the principle of transparency. Indeed, the Form must be read within the overall framework of the employer-employee relationship, a relationship that develops over time, including through a continuous exchange of information, and which is not crystallized in the delivery of an informational/contractual document, as is the case, for example, with the seller-consumer relationship" (see note cited, p. 11);
- "the employee has already received the information […] in the information provided upon establishing the employment relationship […] – information that is always available for consultation on the payroll portal and in the Manual – and which is always available in the Data Processing Policy, easily found on company portals" (see note cited, p. 12);
- "the data is not disclosed to third parties or transferred outside the EEA, so all the information required by [Article] 13 GDPR, with the exception of the list of rights, is already available to the employee via the Form" (see footnote cited, p. 12);
- "the Form provides the data subject with the specific and necessary information relating to the processing in an immediate and transparent format […] – i.e., by reporting it directly on the Form – without the need to burden the data subject with additional and repetitive documentation and without referring to other documents already available to the employee for all additional information that does not relate to the specific activity performed in each case" (see footnote cited, p. 12);
- "otherwise, the employer would have to provide lengthy and complex information continuously, which would be counterproductive precisely for raising employee awareness of the processing of personal data" (see footnote cited, p. 13);
- "In any case, if the Authority deems that the information regarding the processing of data collected via the Form should be provided through a specific additional notice, the Company will implement the new document, thus integrating the documentation provided to the interested party during the Interview" (see note cited, p. 13);
- "Regarding the inclusion, among the information to be provided during the Interview, of the information regarding "persons present" [...] it is specified that "persons present" refers exclusively to the employee and the interviewer" (see note cited, p. 13);
- with reference to Form 2021 "the Company: a) does not carry out any health surveillance activity which is entrusted, pursuant to the legislation, to the exclusive competence of the competent doctor; b) does not process any health data through Form 2021 [...] c) limits itself to asking whether the absence is due to illness, hospitalization or injury (information that the employer can and must legitimately process as it is necessary to guarantee the full exercise of the employee's rights by correctly keeping track of the days of absence to which the employee is entitled, also in order to correctly calculate the waiting period) while any - optional - comments relating to particular restrictions, limitations or prescriptions imposed by the competent doctor are processed solely for the profiles connected to the performance of the work activity and not to the state of health of the interested party, other information that the employer not only can legitimately process, given that he receives from the competent doctor assessments of suitability with any prescriptions, but must collect, also through the Form, in order to constantly guarantee health and safety in the workplace, intervening to prevent situations of discomfort. collective or individual” (see note cited, pp. 13, 14);
- “the invitation to submit further comments is made solely for the purpose of providing the interested party with the opportunity to report any needs related to the performance of their duties and/or in any case facilitate a rapid return to work” (see note cited, p. 14);
- “these further comments therefore concern exclusively activities and/or safeguards that must be implemented by the employer and which the employer must and may address during the return interview, as they ensure the best organization of work and prevent difficult situations in which the employee may find himself” (see note cited, p. 15);
- “therefore, in this case, the objective element of the contested conduct is missing” (see note cited, p. 15);
- "Always with regard to the processing of ordinary data, it is reiterated that completing the Form itself – as already specified in the Form itself – is completely optional and left to the will of the interested party, who does not suffer any consequences due to the choice to complete it or not and is in no way pressured into the interview and completion, which take place based on the urging of the employees themselves, who wish to have a discussion with the Company and expose any difficulties and/or problems relating to the organization of their work.This is evidenced by the fact that in cases where employees refused to complete the Form, they were not contacted to encourage them to do so, nor were there any consequences or decisions of any kind taken” (see note cited, p. 15);
- “Despite the asymmetry that characterizes the employment relationship, it is nevertheless sometimes accepted that the employer may rely on consent as a legitimate basis for the processing of personal data. In particular, where the controller is able to demonstrate that consent was actually freely given by the data subjects, and therefore where employees will not suffer any negative repercussions from any refusal to consent, consent must be considered legitimately given (see Article 29 Data Protection Working Party, Guidelines on Consent under Regulation (EU) 2016/679, point 3.1.1.; Article 29 Data Protection Working Party, Opinion 2/2017 on Processing of Data at Work, point 6.2) (see footnote cited, p. 15);
- "the processing of personal data through the Form must therefore be considered legitimate" (see footnote cited, p. 16);
- "even if the Authority deems consent not to be the correct legal basis for the processing carried out by Magna, this would in any case be legitimate based on the legitimate interest of the same pursuant to Article 6(1) GDPR." 1 letter f) of the GDPR to corporate organization and the protection of employees' mental and physical health" (see note cited, p. 16);
- "regarding the alleged violation of the principle of minimization," it is noted that "pursuant to art. 2087 of the Civil Code, the employer is obliged to adopt all necessary measures to ensure employees have a safe and suitable working environment for carrying out their duties. In this context, it is also the employer's responsibility to manage the employee's return, especially in the case of prolonged or recurring absences, identifying any situations of discomfort or difficulty, including environmental ones" (see note cited, p. 19);
- "the information collected through the Form is not superfluous at all, but rather allows the employer to adopt all the organizational and protective measures necessary to ensure adequate work organization, preventing possible situations of discomfort or difficulty for the employee" (see note cited, p. 20);
- "nor can the argument that the information requested through the Form is already in Magna's possession at the time of the Interview be accepted. Indeed, the employer receives only limited and specific information from the attending physician, such as the state of the illness and prognosis, which is insufficient to take the necessary measures pursuant to Article 2087 of the Italian Civil Code. The attending physician may have indicated prescriptions and limitations to the patient without forwarding them to the employer, who receives them exclusively from the competent physician but not necessarily following a single episode of illness” (see note cited, p. 20);
- “Even the assessments of suitability do not provide the employer with the same information requested via the Form. "Fitness assessments, in fact, are issued following medical examinations that take place prior to the start of employment to assess the worker's health and then only annually, to verify continued suitability for the specific job" (see note cited, p. 20);
- "the necessity of the data processed via the Form for Magna's corporate organizational purposes, and for the psychological and physical protection of employees, therefore excludes any violation of the data minimization principle by Magna" (see note cited, p. 21);
- regarding the "alleged violation of the principle of storage limitation," it is noted that "the maximum retention period of 10 years from the date of completion of the Form was established by the Company, identifying a period even shorter than the overall retention period for the worker's file, within which, as indicated at the bottom of the Form, the completed form is inserted. The employee file contains, in fact, all information relating to the worker in the context of the employment relationship, including the activities performed and any periods of absence" (see note cited, p. 21);
- "given the importance of the aforementioned information in the relationship between employer and employee – also in order to ensure that both the employer and the employee have the opportunity to reconstruct their employment status, including to defend their rights against the other contractual party and in court – the information in the personnel file must be retained for 10 years, even after the termination of the employment relationship" (see note cited, p. 21);
- "the prevailing case law holds that the limitation period for the worker's wage claims begins in all cases upon termination of the employment relationship" (see note cited, p. 21);
- "the Company has established a maximum retention period of 10 years from its compilation, as it believes this is an appropriate period to fully manage any organizational needs. that emerged from the interview and therefore respond to requests or complaints from the employee” (see note cited, pp. 21, 22);
- “in daily business operations, however, Magna periodically deletes the Forms, retaining only those Forms that contain relevant information regarding any measures or actions that the Company must implement pursuant to Article 2087 of the Italian Civil Code to ensure adequate internal management of resources and the protection of employees' working lives” (see note cited, p. 22);
- regarding the “alleged processing of data that is not relevant to Article 8 of the Labour Code,” it is noted that “while it is clear and reiterated that the Company does not collect, nor has it ever intended to collect, data on the health of workers, and without prejudice to the above regarding the employer's obligation to prevent and protect health, the rationale of Article 2087 of the Italian Civil Code is based on the principles of the Italian Civil Code.” 8 of the Statute is to prevent the employer from investigating the worker's opinions and personal life, but certainly not to prevent the employer from assessing the health of a working environment" (see note cited, p. 23);
- "Professional aptitude, in fact, must be understood as the set of skills, abilities, and personal qualities that allow an individual to effectively perform a given job, including with respect to the environment in which a worker operates and, therefore, to the worker's suitability for the environment and vice versa: the aptitude to fulfill a work role, in fact, cannot ignore an analysis of the organization in which the worker is called to work. […] The case law in which violations of art. 8 of the Workers' Statute, moreover, concern very different situations, such as psychological aptitude tests, with questions pertaining to workers' intimate, personal, and non-work lives and opinions (e.g., questions about pregnancy, the worker's family, the worker's home)" (see note cited, p. 24);
- "the questions asked in the interview satisfy the employer's specific duties of protection towards workers. Our legal system, in fact, contains numerous rules and numerous principles that require—and in any case legitimize—the employer's right to intervene to identify and prevent potential difficult situations in the workplace. Consider: [art.] 2087 of the Civil Code […]; […] the provisions contained in the Consolidated Law on Safety (Legislative Decree 81/2008) regarding the "preparation and implementation of measures to protect the health and psycho-physical integrity of workers" and the inclusion in the risk assessment document of risks, including "those related to work-related stress," which require the identification of sentinel events that may give rise to a risk that the employer is required to monitor and resolve" (see note cited, p. 24);
- "consider also the employer's duty to inquire about the reason for the absences of employees with disabilities, in order to make reasonable accommodations in the workplace" (see note cited, p. 24);
- "consider the right – consistently recognized by case law – for the employer to unilaterally transfer an employee to a different location in the event of environmental incompatibility, which clearly gives rise to the legitimacy of an assessment of environmental conditions and employee difficulties. colleagues who work in that environment” (see cited note, p. 24);
- “the information requested through the forms in question is, in fact, strictly relevant to the employment relationship, the professional aptitude of the workers, and is necessary, or at least useful, for complying with the requirements for protecting the mental and physical health of the workers involved” (see cited note, p. 25);
- “the application of sanctions, particularly punitive ones, is not subject to any automatic process. Their relevance must be assessed on a case-by-case basis in light of the party's conduct and the purpose of such measures" (see note cited, p. 26);
- "should the Authority deem it necessary to sanction the Company, the sanction should first take into consideration that the 2020 Form and the Covid Form have no longer been used by the Company since September 2021. Therefore, Magna no longer carries out any processing based on these forms, which therefore should not be considered in the final analysis of any sanctioning measures by the Authority" (see note cited, p. 27);
- "Furthermore, relevance must be given to the total absence of damages—or any consequences—to the interested parties, both those who completed the form and those who refused to consent to its completion. As evidence of this, the Company has never received any objection, much less any complaint, from the interested parties, either directly or through the unions" (see note cited, p. 27);
- "furthermore, in this case, the absence of socially reprehensible conduct (i.e., conduct that could potentially cause actual or potential harm to the interested parties or be aimed at obtaining an unfair advantage) makes a monetary fine inappropriate, regardless of its quantification" (see note cited, p. 27);
- "the sanction of publishing a potential fine on the Authority's website would be unjustifiably punitive" (see note cited, p. 27);
- the Company requests "- preliminarily, the dismissal of this proceeding for [...] violation of the procedural time limits; - alternatively, the dismissal of the objection and this proceeding for being unfounded on the merits; - in further subordination, the application of the sanction of a warning only” (see note cited, p. 28).
On October 29, 2024, following the Company's specific request, a hearing was held. On that occasion, the party stated that:
- "The Company believes that the legal basis for data processing during interviews could theoretically be a legal obligation and believes that obtaining employee consent is more attentive to their needs."
- "In any case, the Company is fully committed to further improvements, while maintaining its commitment to improving employee well-being."
- "The Company [...] is committed to gathering feedback from its employees regarding organizational improvements that can be implemented, such as improving workstations."
- "The Company has activated an internal whistleblowing channel as well as a separate channel that can be used completely anonymously (a hotline managed by external personnel). No reports regarding the form and/or meetings have been received through these channels."
- "In relation to the principles of privacy by design and by default, the Company has determined that there are no significant risks for the data subjects";
- "The Company is not structured like an office, being a metalworking company, and therefore it may not be easy to detect situations of concern";
- "The retention period specifies that the maximum period is ten years, which by company policy is the maximum duration allowed for highly confidential documents. However, in practice, the Company normally deletes data even earlier, and currently there are no forms older than one year. The identification of a maximum period is based on the assessment that not all concerns may arise at the same time, so a significant amount of time may pass before other similar reports emerge from the interviews. Within the maximum period of ten years, if the data is deemed no longer relevant, following a case-by-case assessment, it is deleted. Currently, the Company does not retain forms older than 2023."
3. Outcome of the Proceedings
3.1 Established Facts and Observations on Personal Data Protection Legislation
Based on the information acquired during the investigation and subsequent assessments by this Department, it is established that the Company, at least since 2020, has subjected its workers (according to the Company's records, as of December 31, 2024, the Company has approximately 890 employees) to an interview with their manager upon their return from periods of absence. During this interview, the manager completed the "RTWI (Return to Work Interview)" form, using the information provided by the worker.
According to the Company's declaration, this conduct falls within "workplace health and safety practices" and is intended to "identify any difficult situations in the workplace and, if necessary, provide support to the employee and/or facilitate their rapid return to work."
According to the Company's statement, it emerged that this form, once completed by the interviewee's manager, is delivered to the Human Resources office, which, together with the manager and/or the company physician, evaluates "any initiatives to protect the employee's health, such as modifying the workstation or managing working relationships" (see note 7/10/2024, p. 3). Subsequently, "the form is stored in the employee's personal file, in a locked cabinet in the HR office, accessible only to authorized personnel" (see note 7/10/2024, p. 4).
Since 2020, the Company has modified the form used several times; the current model was introduced, based on the Company's specifications, starting in September 2021.
The Company's conduct described above does not comply with data protection regulations for the reasons set forth below.
In this regard, it is emphasized that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false documents or records, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority."
It is recalled, in general terms, that the processing of personal data must be carried out in compliance with the principles set forth in Article 5 of the Regulation, including the principles of lawfulness, fairness, and transparency, as well as the minimization and limitation of storage.
With regard to so-called "c.d." data, In the context of the employment relationship, the employer, as data controller, may process employees' data if the processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the data subject's request, or if the processing is necessary for compliance with a legal obligation (see Article 6, paragraph 1, letters b), c), of the Regulation).
For data belonging to special categories of data, Article 9 of the Regulation establishes a general prohibition on processing unless one of the conditions expressly indicated in Article 9, paragraph 2, of the Regulation applies (see in particular letter b), according to which paragraph Article 1(1) does not apply when "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or by a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject."
Due to their particular nature, such data merit specific protection and the implementation of specific measures when processed: processing may, in fact, result in significant risks to the fundamental rights and freedoms of individuals (see Recital 51 of the Regulation).
With regard to special data relating to workers, responsibilities are divided between the employer and the physician responsible for carrying out health surveillance (see Legislative Decree No. 81 of 2008).
It should also be noted that Article 13 of the Regulation provides for specific protection of personal data and the implementation of specific measures when processing personal data. Article 13 of the Regulation requires the data controller to provide the data subject, prior to processing, with a series of information regarding the processing of their personal data (so-called information notice).
If the processing is carried out in the context of an employment relationship, therefore, the employer, as data controller, is obliged to inform employees of the essential characteristics of the processing it intends to perform.
In the context of the employment relationship, fully informing employees about the processing of their data is also an expression of the general principle of fair processing (see Article 5, paragraph 1, letter a) of the Regulation).
Finally, Article 113 of the Code provides that "the provisions of Article 8 of Law No. 300 of 20 May 1970 and Article 10 of Legislative Decree No. 276 of 10 September 2003 remain unaffected."
3.2 Procedural Objections
First of all, regarding the Company's observations regarding the notification of violations pursuant to Article 166 of the Code "beyond the deadline for closing the proceedings" (see note dated October 7, 2024, pp. 8-10), it is noted that the investigation under this provision was initiated following a report pursuant to Article 144 of the Code.
Therefore, Table B, Section 2), contained in Internal Regulation No. 2 of 2019, cited by the Company in the aforementioned defense briefs of October 7, 2024, specifies that for proceedings opened following the submission of a report pursuant to Article 144 of the Code, a deadline of "18 months from the initiation of the proceedings for the adoption of the corrective measure referred to in Article 12 of the Guarantor's Regulation No. 1/2019" applies.
Article Article 12 of the Garante's Internal Regulation No. 1 of 2019 provides, among other things, that "When the examination of the complaint is not concluded pursuant to Article 11, paragraph 1, the department, service, or other organizational unit shall initiate, by communicating with the data controller and, where applicable, the data processor, the procedure for adopting the measures referred to in Articles 58, paragraph 2, and 83 of the GDPR."
Therefore, the 18-month deadline indicated by the aforementioned internal regulation runs from the date of notification of the violations pursuant to Article 166, paragraph 5 of the Code.
In this case, in particular, the notification of the violations was made on August 7, 2024.
It should also be noted that the 120-day deadline established by Internal Regulation No. 2 of 2019 for the reporting of alleged violations (Article 166, paragraph 5, of the Code) runs from the date of discovery of the violation of personal data protection regulations, which, in this case, occurred only following receipt of the response dated April 11, 2024, and obviously not following the mere receipt of the report in question.
In fact, as clearly supported by case law, the deadline for notifying the details of the violation "does not coincide with the time in which the material fact is acquired by the authority to which the report was transmitted, but must be identified when that authority has acquired and assessed all the data necessary to verify the existence of the reported violation, or when the time elapsed is no longer justified by the need for such acquisition and assessment" (among many, see Court of Cassation, ruling no. 38510/2021).
Given the sensitive nature of the data processed and the number of data subjects involved, in this case, the Authority deemed it necessary to follow up an initial request for information pursuant to Article 157 of the Code with a second request for information, also pursuant to Article 157 of the Code.
Only following the Company's second response did the Authority acquire all the information necessary to charge the Company with violations of personal data protection regulations. It is important to emphasize that, through these two requests for information, the Authority guaranteed the Company the right to be heard and fully exercised its right to defense, starting from the preliminary investigation phase of the proceedings, allowing it to provide all the information necessary to verify the compliance of the processing operations with the applicable regulations.
The preliminary investigation phase, among other things, is, by its very nature, intended to allow the Authority to gather all relevant evidence confirming (or denying) the existence of a violation and to decide how to proceed with the proceedings (see ECJ 30/01/2025, case C-510/23, with reference to the proceedings initiated by the Italian Competition Authority). The duration of the investigation—and this is inherent in its structure and function—therefore also depends on the complexity of the proceedings.
To argue otherwise would lead to the Authority's investigations following complaints of violations of personal data protection legislation being deemed entirely superfluous (not to say useless). The purpose of the investigation, instead, is precisely to verify the presence of evidence sufficient to qualify a violation and to initiate proceedings by notifying the aforementioned violations pursuant to Article 166, paragraph 5, of the Code.
That said, given that the second response was submitted by the Company on April 11, 2024, and the notification of violations was sent on August 7, 2024, it is clear that the Authority certainly complied with the 120-day deadline for reporting the violations found.
Finally, it is worth noting that, as clearly indicated in the notification of violations sent to the Company, the alleged processing was carried out which, despite the succession of three different forms, did not cease, but continued uninterrupted from 2020 and beyond the notification of the violations.
3.3 Lack of Appropriate Information for Data Subjects
The Company's conduct, which consists of the completion of the "RTWI "Return to Work Interview" form by the manager of the employee interviewed following periods of absence, was carried out (and, as far as we know, is still being carried out) in violation of Article 13 of the Regulation, which constitutes a corollary to the principle of transparency set forth in Article 5, paragraph 1, letter a), of the Regulation. This is because data subjects appear not to have been provided with adequate information regarding the specific processing of personal data by the Company.
The few lines at the beginning of the form (both the version in force until May 2020 and the version drafted in May 2020, as well as the version in use since September 2021 and still in use) do not contain exhaustive information regarding the processing in question.
Furthermore, regarding the inclusion of "persons present" among the information required to be provided during the interview, the wording suggests that, contrary to what the Company indicates, individuals other than the interviewee and interviewer may be present at the interview. It is therefore clear that this expression is misleading or, at the very least, unclear.
Not even by including the very limited information contained at the bottom of the form in use since September 2021, has the Company fully complied with the disclosure obligation under Article 13 of the Regulation.
In fact, no information regarding the specific processing in question can be found in the "Employee Notice" produced by the Company, nor in the "Data Protection Manual," nor in the "Personal Data Protection Policy."
The lack of adequate disclosure also means, as will be discussed in more detail below, that the Company lacks the fundamental requirements pursuant to Article 13 of the Regulation. 7 of the Regulation, the consent (if any) given by employees, which, according to the Company's declaration, constitutes the legal basis for the processing.
In this regard, it is emphasized that the purpose of the information notice—which simultaneously constitutes a right of the data subject and an obligation for the data controller—is to inform the data subject of how their data is being processed.
Only if the data subject is fully aware of the processing and its purposes can he or she (provided that the other requirements are met) provide his or her actual informed consent.
3.4 Violation of the principle of lawfulness of processing
By completing the return-to-work interview form following absence, the Company processes workers' data (both so-called general data and so-called special categories of data) without an appropriate basis for lawfulness, thus violating Article 6 of the Regulation and Article 9 of the Regulation (particularly with regard to the processing of health data).
This finding concerns all three forms used by the Company over time. The processing performed by the Company, in fact, does not fall within the scope of health surveillance, an activity which, however, is, by express legal provision, the exclusive responsibility of the competent physician and not the employer (see Article 41 of Legislative Decree No. 81 of 2008).
The formulation of certain specific questions included in the aforementioned questionnaires may result in responses that contain sensitive data, particularly health-related data (aside from the assessment of the processing of data relating to infections related to the Covid-19 epidemic, regarding which no specific objections have been raised, given the regulatory provisions adopted during the health emergency).
With regard to the category of special data, it should be noted, among other things, that, with regard to the model in use until May 2020 and the form drafted in May 2020, the "introduction" already specifies that "the interview is [...] aimed at monitoring the employee's health status after one or more illnesses."
In the form in use until May 2020, the question regarding the description requested if the employee believes the absence (due to illness, hospitalization, or injury) was due to a work-related cause may also result in a response containing special data ("Does the employee consider the absence to be due to a work-related cause? (If so, please describe in the employee's comments section)").
With regard to the form drafted in May 2020, the question "Has any health problem you have worsened in recent years?" clearly requires a response regarding the employee's health status and, as such, falls within Article 13 of Legislative Decree no. 9 of the Regulation (the same question was also included in the form used until May 2020).
In the form currently in use, the invitation to provide additional "comments" from the employee regarding the affirmative response to the question regarding the presence of particular restrictions/limitations/prescriptions imposed by the company doctor may also contain health-related data pursuant to Article 9 of the Regulation.
It should also be noted that only in the form currently in use is the employee's right to contact the company doctor communicated ("For prevention purposes, remind the employee that for any type of problem, he or she has the right to request a confidential meeting with the Company Doctor, or to use the EFAP (Magna's completely anonymous employee assistance program), or to use the company's Open Door process"), while the two forms previously used asked the question regarding the need for a meeting with the company doctor ("Do you need a special meeting with the company doctor to explain your health situation?").
It is therefore clear that responding to the aforementioned question, contained in the two forms used previously, may entail the processing of health-related data; informing the worker of the possibility of requesting a visit with the company doctor, on the other hand, does not entail data processing, as it merely communicates an aspect that is already provided for by law (see Article 41, paragraph 2, letter c), Legislative Decree No. 81 of 2008).
Regarding the voluntary nature of the collection of information via the questionnaire (and therefore the presence of consent), which, according to the Company, characterizes the completion of the form in question—in all three versions—it should first be noted that there is no evidence to support this.
Indeed, it should be emphasized that the two forms used previously state that "the interview must take place on the first day of the worker's return to work"; this peremptory expression does not allow the collection to be considered voluntary as claimed by the Company in the procedure. From the literal meaning of the wording, the interview therefore appears to be, at least with respect to the first two models used, imposed upon return from a period of absence due to illness, injury, or hospitalization.
Regarding the voluntary nature of completing the form, it should also be noted (and in any case) that, in the context of the employment relationship, consent (Article 6, paragraph 1, letter a) of the Regulation) cannot generally constitute a suitable condition for the lawfulness of the processing of employee data.
This is due to the structural asymmetry that characterizes the employment relationship and the inevitable impossibility (except in limited cases to be ascertained on a case-by-case basis) of recognizing the worker's consent as having the characteristics of freedom required for it to become a suitable legal basis (see Provision 19/7/2018, no. 427 in www.garanteprivacy.it, web doc. no. 9039945; see arts. 6-7 and recitals 42-43, Regulation (EU) 2016/679; see also, in accordance with this, Article 29 Group, Guidelines on consent, adopted on 28/11/2017 as amended and last adopted on 10/4/2018, esp. par. 3.1.1.; Opinion 2/2017 on data processing in the workplace, WP 249, esp. par. 3.1.1 and 6.2; Opinion 8/2001 on the processing of personal data in the employment context, WP 48, 13/9/2001, pp. 3, 23, and 26; European Commission, Communication of 6 November 2015, COM(2015) 566, pp. 12 and 13; Working Document on a common interpretation of Article 26(1) of Directive 95/46/EC of 24 October 1995, WP 114, 25 November 2005, pp. 11-12.
In this case, precisely given the category of data requested, it must be considered that consent, even if it had actually been given by the data subjects, could not be considered, as required by the provisions, free and unconditional. Furthermore, the organizational measures implemented by the Company, which require the form to be completed in the presence of the direct line manager, do not support the freedom of consent.
It should also be noted that, with regard to so-called special categories of data, Article 9(2) of the Regulation provides that, in the context of the employment relationship, such data may be processed only when "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject."
National law therefore does not provide that, in the context of the employment relationship, data belonging to special categories of data may be processed on the basis of consent or on the basis of legitimate interest.
In this regard, it is also emphasized that Legislative Decree no. 81 of 2008 identifies the specific obligations of employers (Article 18) to protect the physical integrity and moral personality of workers (pursuant to Article 2087 of the Italian Civil Code).
The law establishes the specific obligations that employers must comply with regarding health and safety in the workplace. However, fulfilling these obligations, if it involves the processing of personal data, must comply with the provisions of personal data protection legislation.
Also in accordance with the provisions of Legislative Decree no. 81 of 2008, it is clear that the competent physician is the only person authorized to process, with full autonomy and technical expertise, personal health data essential for the performance of the health and safety protection function in the workplace (see also the document adopted by the Authority, "The role of the competent physician in matters of workplace safety, including in the emergency context," web doc. no. 9585367).
Finally, it is emphasized that, based on the above, the Company believes that the legal basis for this personal data processing can be identified both in compliance with the provisions of Article 2087 of the Italian Civil Code, and in consent or legitimate interest, should the other legal bases not apply.
In this regard, it is emphasized that this interpretation is incompatible with the correct application of data protection regulations; The legal basis constitutes the necessary and essential prerequisite for any processing of personal data and, as such, it is up to the data controller to precisely and specifically identify it in advance, with respect to the processing itself. Furthermore, legitimate interest can never be identified as a condition of lawfulness simply because the other legal bases are not present (see, in this regard, albeit with respect to another specific case, provision no. 137 of 15/04/2021, web doc. 9670738).
3.5 Violation of the Data Minimization Principle
The Company's conduct also violates the data minimization principle (Article 5, paragraph 1, letter c), of the Regulation) because the data collected when completing the form for the return-to-work interview after a period of absence due to illness, injury, or hospitalization is irrelevant to the action the employer should take in the event of the employee's absence, also in light of the provisions of Article 2087 of the Italian Civil Code, and given the assignment of health surveillance to the competent physician, pursuant to Legislative Decree No. 81 of 2008.
It should also be noted that some of the information requested to be included in the questionnaire by the manager during the interview upon return from a period of illness, injury, or hospitalization, for subsequent submission to the Human Resources office, should (correctly) already be known by the Human Resources office itself.
Therefore, the specific reason for having to collect this information again, through the returning employee's manager, is unclear. For example, in the current form, where the request includes the last period of absence, the type of absence with respect to its duration, when the absences are concentrated, the reason for the absence (illness, hospitalization, injury), and any restrictions/limitations/prescriptions issued by the company doctor, it is clear that this information should already be known by the human resources office, regardless of the return-to-work interview and without resorting to the aforementioned legal procedures for submitting the employee to the interview.
The established procedure therefore leads to unnecessary duplication of data collection (compared to that which the personnel office should already legitimately carry out)—among other things, data belonging to special categories—the actual need for which has not been clarified.
The Company's reasoning regarding compliance with the provisions of Article 2087 of the Italian Civil Code cannot be considered valid.
3.6 Violation of the principle of retention limitation
According to the Company's declaration, the forms completed following the return of workers from work due to illness, injury, or hospitalization, which, as stated, constitute data processing without a suitable legal basis, are retained by the Company, based on the model currently in use, for a period of ten years.
The Company also added that "in fact [...] it normally deletes forms even earlier, and currently there are no forms older than one year. The establishment of a maximum period stems from the assessment that not all problems may occur at the same time, so much so that a significant amount of time may pass before other similar reports emerge from the interviews. Within the maximum period of ten years, if the data is deemed no longer relevant, following a case-by-case assessment, it is deleted. Currently, the Company does not retain forms older than 2023" (see hearing minutes of October 29, 2024).
Given that the ten-year period is in itself disproportionate with regard to the data processed using the forms in question, the documents disclose the impossibility—information that the data subject would need—of clearly identifying the retention period and the criteria used to determine that period.
In fact, it is not clear what the specific criteria are for determining the deletion (and after what period) of data—including health data—by the Company.
This therefore violates the principle of storage limitation (Article 5, paragraph 1, letter e), of the Regulation).
3.7 Processing of irrelevant data
Using the aforementioned forms, the Company has also processed (and continues to process, using the third version of the form) employee data that are irrelevant for the purposes of assessing the employee's professional aptitude, thus violating Article 13 of the GDPR. 113 of the Code (this article calls for compliance with Article 8 of Law No. 300 of 20/5/1970 and Article 10 of Legislative Decree No. 276 of 10/9/2003 as a condition for lawful processing; in this regard, the Court of Cassation, Civil, No. 18302 of 19/9/2016, established that "acquiring and retaining data that contain (or may contain) such information already constitutes the prohibited conduct [...] even if the data is not subsequently used. It is not necessary to subject the collected data to any particular processing to constitute an unlawful act, since the mere acquisition and retention of their availability constitutes a violation of the legislative requirement.")
This provision constitutes one of the "most specific provisions of national law to ensure the protection of rights and freedoms with regard to the processing of employees' personal data in the context of employment relationships" identified in Article 88 of the Regulation.
Specifically, in the form used until May 2020, the Company asked: "Does the employee consider the absence to be work-related? (If so, please describe in the employee comments section)"; "Are there any specific issues you would like to discuss, without going into too much detail, and if you feel comfortable?"; "From an analysis of your attendance, it has emerged that you have been absent several times"; "Are there any particular situations of distress within the department you would like to discuss?").
Furthermore, in the form drafted in May 2020, the Company asked: "Does the employee consider the absence to be work-related? (If so, please describe in the employee comments section)"; "Are there any specific issues you would like to discuss, without going into too much detail, and if you feel comfortable?"; "Do you need a special meeting with the company doctor to discuss your health situation?"; "Are there any particular situations of distress within the department you would like to discuss?"
The questions cited could result in answers containing information that was irrelevant to the assessment of professional aptitude: the absence that required completing the form during an interview is, and is, due to illness, injury, or hospitalization.
In the form currently in use, the Company asks: "Do you think the company could adopt measures to improve the working environment (e.g., to eliminate any situations of discomfort of which you are aware? If so, what suggestions?"). In this regard, there appears to be no concrete need to ask this question in an interview upon the employee's return from a period of absence due to illness, injury, or hospitalization (rather than independently of this), nor does it appear that the answer to this question should be specific to a specific worker (rather than anonymous).
It is therefore clear that the formulation of specific questions (listed above) in the forms (used in the past and also in the current one) could result in answers relating to "facts that are not relevant to the assessment of the worker's professional aptitude."
4. Conclusions: Declaration of unlawfulness of processing. Corrective measures pursuant to Article 58, paragraph 2, of the Regulation
For the above reasons, the Authority believes that the declarations, documentation, and reconstructions provided by the data controller in the The investigation does not address the concerns notified by the Office with the initiation of the proceedings and is therefore unsuitable for dismissal of this proceeding. Furthermore, none of the cases provided for in Article 11 of the Italian Data Protection Authority Regulation No. 1/2019 apply.
The Company's processing of personal data, and specifically the requirement that workers return from periods of absence due to illness, injury, or hospitalization to undergo an interview with their supervisor, who will complete a specific form containing health-related data, is in breach of personal data protection regulations and, in particular, violates Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, and 88 of the Regulation and Article 113 of the Code.
The breach, established in accordance with the grounds set out in the statement of reasons, cannot be considered "minor," taking into account the nature and severity of the breach, which affected, among other things, the general principles of processing, processing involving data belonging to special categories of data, and the manner in which the supervisory authority became aware of the breach (see Recital 148 of the Regulation).
The Authority also considered the level of severity of the breach to be medium, taking into account all relevant factors in the specific case, and in particular the nature, severity, and duration of the breach, taking into account the nature, scope, or purpose of the processing in question, as well as the number of data subjects and the level of damage suffered.
The Authority took into account the criteria relating to the intentional or negligent character of the breach and the categories of personal data affected by the breach, as well as the manner in which the supervisory authority became aware of the breach (see Article 82(2) and Recital 148 of the Regulation).
Therefore, given the corrective powers granted by Article 14 of the Regulation, the Authority considered the following: Article 58, paragraph 2, of the Regulation provides for the prohibition of the processing of unlawfully collected data, the deletion of unlawfully collected data, and the imposition of an administrative fine pursuant to Article 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letters f), g), and i) of the Regulation.
5. Adoption of an injunction order for the application of the administrative fine and additional penalties (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code)
Violation of Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, 88 of the Regulation, and 113 of the Code entails the application of the administrative fine pursuant to Article 83, paragraph 5, letter i). a) and d) of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of November 24, 1981).
The Guarantor, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of November 24, 1981), in relation to the processing of personal data carried out by Magna PT S.p.A., which has been determined to be unlawful, in the terms set out above.
Having deemed it necessary to apply Article 58, paragraph 3, letter i) of the Regulation and Article 166 of the Code. Article 83 of the Regulation provides that "where, in relation to the same or linked processing operations, a controller […] intentionally or negligently infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement." The total amount of the fine is calculated so as not to exceed the maximum fine set forth in the same Article 83, paragraph 5.
With reference to the elements listed in Article 83, paragraph 5. 2 of the Regulation, for the purposes of applying the administrative fine and quantifying it, given that the fine must be "effective, proportionate, and dissuasive in each individual case" (Article 83, paragraph 1 of the Regulation), it is noted that, in the case under consideration, the following circumstances were taken into account:
- the significant severity of the violation, which also involved cases punished more severely due to the interests protected by the violated provisions (concerning the principles of lawfulness, fairness, minimization, storage limitation; the right to information; provisions providing greater protection for workers);
- the processing also involved health data following a period of absence due to illness, injury, or hospitalization;
- the duration of the violation, which has continued since at least 2020 and is still ongoing;
- the high number of data subjects involved in the confirmed violations, given that the possibility of being subjected to an interview upon return to work after a period of absence due to illness, injury, or hospitalization applies to all Company employees;
- with regard to the intentional or negligent nature of the violation and the degree of responsibility of the data controller, the objective elements of the Company's conduct and the degree of responsibility of the Company were taken into consideration. The Company breached the legal obligation of diligence and failed to comply with data protection regulations, with respect to a variety of provisions, despite the stated purpose of implementing the provisions of Article 2087 of the Italian Civil Code, thus being able to adopt measures to protect the employee's psychological and physical well-being;
- cooperation with the Supervisory Authority was taken into account.
Furthermore, it is believed that the offender's financial circumstances, determined on the basis of the Company's revenues with reference to the ordinary financial statements for 2023 (the latest available), are relevant in this case, given the aforementioned principles of effectiveness, proportionality, and dissuasiveness, which the Authority must adhere to in determining the amount of the fine (Article 83, paragraph 1, of the Regulation).
It is also believed that the impact on the Company of the measures prohibiting processing and deletion must be taken into account.
In light of the above elements and the assessments made, it is deemed appropriate, in this case, to impose an administrative fine of €50,000 (fifty thousand/00) against Magna PT S.p.A.
In this context, it is also believed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority no. 1/2019, this chapter containing the injunction order should be published on the Garante's website.
This is in consideration of the specific characteristics of the case under consideration, particularly given that the processing also involved data belonging to special categories of data of workers returning from periods of absence due to illness, injury, or hospitalization, and that the processing continued even after the Authority opened an investigation, as well as the number of data subjects involved.
NOW WITH ALL THE ABOVE MENTIONED, THE GUARANTOR
pursuant to Article 57, paragraph 1, letter f) and Article 83 of the Regulation, finds the processing carried out by Magna PT S.p.A., with registered office in Modugno, Via dei Ciclamini 4, 70026, Tax Code 04886850728, described in the terms set out in the grounds, to be unlawful due to the violation of Articles 5, paragraph 1, letter f) and 83 of the Regulation. 1, letters a), c), e), 6, 9, 13, 88 of the Regulation and 113 of the Code;
ORDERS
to Magna PT S.p.A.:
- pursuant to Art. 58, paragraph 2, letter f), of the Regulation, the prohibition of further processing of the data collected and retained through the forms completed following the return-to-work interview after periods of absence due to illness, injury, or hospitalization, as described in the grounds;
- pursuant to Art. 58, paragraph 2, letter g), of the Regulation, the deletion of the data collected and retained through the forms completed following the return-to-work interview after periods of absence due to illness, injury, or hospitalization, as described in the grounds, within 60 days of notification of this order; Magna PT S.p.A. is requested to: to communicate what steps have been taken to implement the provisions of this provision and to provide adequately documented feedback pursuant to Article 157 of the Code, within 60 days of notification of this provision; any failure to provide such feedback may result in the application of the administrative penalty provided for in Article 83, paragraph 5, letter e), of the Regulation;
- pursuant to Article 58, paragraph 2, letter i), of the Regulation, to pay the sum of €50,000 (fifty thousand/00) as an administrative fine for the violations indicated in this provision.
HEREBY ORDER
Magna PT S.p.A. to pay the aforementioned sum of €50,000 (fifty thousand/00), according to the methods indicated in the attachment, within thirty days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. It is hereby stated that pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half of the fine imposed within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, for filing an appeal as indicated below.
ORDERS
- pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Guarantor Regulation No. 1/2019, the publication of the injunction order on the Guarantor's website;
- pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Guarantor Regulation No. 1/2019, the publication of this provision on the Authority's website;
- pursuant to Article 17 of the Guarantor Regulation No. 1/2019, the recording of violations and measures adopted in accordance with Article 58, paragraph 2 of the Regulation, in the Authority's internal register provided for by Article 57, paragraph 1, letter u) of the Regulation.
Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150/2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad.
Rome, July 10, 2025
THE PRESIDENT
Stanzione
THE REPORTER
Stanzione
THE ACTING SECRETARY GENERAL
Filippi
SEE ALSO Newsletter of August 1, 2025
[web doc. no. 10154148]
Provision of July 10, 2025
Register of Provisions
no. 390 of July 10, 2025
THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, attended by Prof. Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, Members, and Dr. Claudio Filippi, Acting Secretary General;
SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");
SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018, hereinafter, the "Code");
SEEN the report submitted pursuant to Article 144 of the Code by O.S. Lavoro Privato Puglia against Magna PT S.p.A.;
HAVING EXAMINED the documentation in the file;
SEEN the observations made by the Secretary General pursuant to Article 15 of the Guarantor's Regulation No. 1/2000;
REPORTER: Professor Pasquale Stanzione;
WHEREAS
1. The report against the Company and the preliminary investigation.
On August 23, 2021, the O.S. USB Lavoro Privato Puglia filed a report, pursuant to Article 144 of the Code, against Magna PT S.p.A. (hereinafter, the Company), which complained that workers were being subjected to a "return to work interview" involving the completion of a questionnaire [...] following absences due to illness or hospitalization.
On January 10, 2024, the Company, following a request for information sent pursuant to Article 157 of the Code by the Office, submitted its response and stated that:
- "In 2016, the GETRAG Group was acquired by Magna, one of the largest and most diversified suppliers of components for the automotive sector, present globally with over 160,000 employees and 400 company locations" (see note dated January 10, 2024, p. 1);
- "Regarding the RTWI "Return to Work Interview" form (hereinafter the "Form"), which was the subject of the request for information, Its use is part of standard management practice whereby, upon returning from a period of absence, employees are invited to a meeting (which is conducted as an interview, using the Form) with their manager" (see note cit., p. 1);
- "the interview is part of workplace health and safety practices, responding to the need to ensure the mental and physical health of workers, while respecting the mutual responsibilities between the employer and the competent doctor" (see note cit., p. 2);
- "the purpose of the interview is to identify any difficult situations in the workplace and possibly provide support to the employee and/or facilitate their rapid reintegration into work" (see note cit., p. 2);
- "the Form is filled out manually by the manager of the employee being interviewed" (see note cit., p. 2);
- "the manager then delivers the Form to the Human Resources office, which reviews it and Evaluates, together with the manager and/or the competent physician, any initiatives to be implemented to protect the worker's physical and mental health, such as the possibility of modifying the workstation at the worker's request or managing any requests from the employee to be assigned to an alternative or temporary workstation, or reporting problems in relationships with supervisors and/or collaborators" (see note cited, p. 2);
- with reference to "RTWI Form Update in 2020," "we would like to point out that you have received two forms: - The one in force until May 2020 ([…] sub-annex 1 […]) - The one drawn up in May 2020 ([…] sub-annex 2 […])" (see note cited, p. 2);
- "this second form, attached sub-annex 2, had been streamlined compared to the first version” (see note cited, p. 2);
- with reference to the “second revision of the RTWI Form,” it is specified that “in September 2021, … the form was revised again. In the revision, which resulted in further simplification, … the information was expanded” (see note cited, p. 3);
- “in all versions of the forms, it is always highlighted that the information collected is subject to confidentiality by the relevant company functions. Specifically, the versions of the Form used during the pandemic emergency (Appendixes 1 and 2) specified that the information would be managed in full compliance with the regulations on privacy and personal data processing and that the data collected would be processed exclusively for prevention purposes (see note cited, p. 3);
- "Furthermore, the header of the form used since September 2021 and still in use (Appendix 3) includes the following wording: 'The data collected in the following form is for the sole purpose of prevention for health and safety purposes, and the form is completed after a period of absence from work due to illness, injury, or hospitalization. This form does not process data relating to the worker's health or special data. It is not necessary to indicate any information relating to pathologies or special circumstances in the form. Completion of the form remains optional.' For any further information on how Magna PT SpA processes personal data, please refer to the information provided at the bottom of this form and in the Personal Data Protection Policy available on BIC* and Magnet* ["BIC and Magnet are the company portals that contain company procedures and information, which all Magna PT S.p.A. employees can access."], as well as in the data processing notice available on the payroll portal" (see note cited, p. 3);
- "In any case, even before the 2021 update, the Personal Data Protection Policy and the privacy notice, available on the company's IT portals, already informed employees of the possibility of data processing aimed at fulfilling health and safety obligations in the workplace" (see note cited, p. 3, 4).
On April 11, 2024, the Company, in response to a further request for information made pursuant to art. 157 of the Code, the Department declared on March 13, 2024, that:
- "Regarding the wording included in the form in use since September 2021 [...] 'For any further information on how Magna PT S.p.A. processes personal data, please refer to the information provided at the bottom of this form.'" It is specified that: the bottom of the form contains information on document retention in accordance with the company's "Magna Global Record Retention Schedule" (MGRRS) policy, a common and well-known practice within the company. [...] The text contains several fields indicating: • Validity: indicates the date from which the form is valid, specifically August 25, 2021; • Security Class: indicates the level of confidentiality, in this case strictly confidential; • Storage: indicates the maximum storage time, in this specific case more than 10 years, as well as the storage office, in this specific case HR (indicated with the acronym HRPR03) and the storage location, in this specific case the personnel file (indicated with the acronym P03); • Permanent archiving: indicates the location where the document is stored (in line with what is indicated in the above point using the acronyms), in this case the personal folder at the company headquarters" (see note 11/04/2024, pp. 1, 2);
- "the logic of the classification manual is well-known and commonly used within the company" (see note cited, p. 2);
- "the information in the form header was modified in 2020 (more explicitly specifying the purposes of the form) and then in 2021 (specifically, indicating more fully the purposes of the processing and the type of data processed and referring to additional documents and information on the company portal for details)" (see note cited, p. 2).
2. Initiation of the Proceedings and the Company's Submissions
On August 7, 2024, the Office, pursuant to Article 166, paragraph 5, of the Code, notified the Company of the alleged violations of the Regulations found, with reference to Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, 88 of the Regulations, and 113 of the Code.
On August 7, 2024, the Company filed a request for an extension of the deadline for filing written defenses and a request for a hearing. On August 8, 2024, the Office granted the requested extension.
On October 7, 2024, the Company submitted its defense briefs, highlighting the following:
- "The Form is part of a standard and widespread management practice aimed at ensuring the employer's proper fulfillment of its duties to protect the physical and mental well-being of workers pursuant to Article 2087 of the Italian Civil Code." (see note dated October 7, 2024, pp. 2, 3);
- "The employee's manager manually completes the Form and receives adequate training on how to conduct the interview, including instructions not to request information about the employee's health or review medical records. In fact, under no circumstances did managers request information about the employee's health or review their medical records. The Form also reminds the employee of their right to request a meeting with the competent physician." (see note cited above, p. 3);
- "After completion, the manager checks the contents of the Form with the employee, who can sign it and request a copy, but is not required to sign. Subsequently, the Form is delivered to the Human Resources Office ("HR Office"), which, together with the manager and/or the competent physician, evaluates any actions to protect the employee's health, such as modifying the workstation or managing working relationships" (see note cit., p. 3);
- "The Form is stored in the employee's personal file, in a locked cabinet in the HR Office, accessible only to authorized personnel" (see note cit., p. 4);
- "Specifically, therefore, in 2020, two forms were used: the first, valid until May 2020 ([…] "2020 Form"), and the second, drafted in May 2020" (see note cit., p. 4);
- "The information in the Form header was modified in 2020 to more clearly outline the purposes of the Form and subsequently in 2021 to expand the description of the purposes of the processing and the types of data processed (see chapter II.C.1), referring to the documents on the company portal for further details" (see note cited, p. 5);
- "The employer's general obligation pursuant to art. 2087 of the Italian Civil Code cannot be interpreted in a restrictive and static sense, limited to the mere fulfillment of express and specific regulatory obligations. Rather, it must be understood dynamically, as the employer is required to ensure workplace health and safety over time and continuously according to best practices (most recently, Court of Cassation, August 21, 2024, no. 22996)" (see note cited, p. 6);
- "Health in the workplace must be interpreted broadly and dynamically, encompassing not only illness, but also "a state of complete physical, mental, and social well-being, not merely the absence of illness or infirmity" (Article 2, paragraph 1, letter o, Legislative Decree no. 81/2008)" (see note cited, p. 6);
- "The complex assessments and information related to health and well-being in the workplace cannot be left to the mere assessment of the suitability of the competent physician, but requires actual treatment, which must be carried out by the employer through appropriate organizational tools, including, according to Magna, the use of the Form to collect any employee concerns. Moreover, in an increasingly complex and technologically advanced society like today's, defined as a true "risk society," it is more than essential that systems be adopted in the workplace that, if not perfectly capable, at least attempt to detect situations of employee discomfort that a simple fitness-for-duty medical examination would not be able to map" (see note cited, p. 7);
- "In order to fulfill this duty, the employer must be able to detect collective and individual distress and therefore intervene before the workplace becomes the source of problems for workers" (see note cited, p. 7);
- "The creation of a healthy work environment and risk prevention are at the root of Magna's decision to use the Form" (see note cited, p. 8);
- "The Notice of Dispute was served after the deadline for closing the proceedings" (see note cited, p. 8);
- "The notice of initiation of the sanctioning proceeding was notified to the Company on August 7, 2024, after the expiration of the 120-day deadline from the discovery of the alleged violation, as set forth in the Internal Regulation of the Guarantor 2/2019, Table B, Section 2), and therefore in a state of exhaustion of the Authority's administrative power" (see note cited, p. 8);
- "The Authority in fact became aware of the facts at issue in this proceeding on August 23, 2021, when the Unione Sindacale di Base (Puglia regional coordination) reported the existence of the Form [...] requesting the Authority to investigate the legitimacy of the processing carried out" (see note cited, p. 8);
- "On September 1, 2021—at the end of the August holiday break—the 120-day deadline therefore began to run, as it was from that moment that the Authority had the information needed to ascertain any violations or at least to request information and clarification from the Company regarding the processing carried out" (see note cited, p. 9);
- "If such information had been requested before the expiration of the 120-day deadline, the deadline would have been suspended—pursuant to Article 7 of the Internal Regulations […]—for the period between any requests for clarification and the related responses, so as to allow the Authority to benefit from the net 120-day deadline to formulate any objections" (see note cited, p. 9);
- "In this case, the Guarantor sent the first request for information to the Company only on December 4, 2023, two years and four months after receiving the report and almost two years after the expiration of the 120-day deadline starting from September 1, 2021" (see note cited, p. 9);
- "The 120-day deadline is peremptory" (see note cited, p. 9);
- "In this case, the First Request was made by the Authority well after the deadline (i.e., 704 days after the deadline). It follows that the Authority notified the Company of the Notice of Notification in complete absence of any sanctioning power" (see note cited, p. 10);
- with reference to the "alleged lack of adequate information for data subjects," "given that Form 2020 and the Covid Form have long been eliminated, Form 2021 is substantially correct and complies with the principle of transparency. Indeed, the Form must be read within the overall framework of the employer-employee relationship, a relationship that develops over time, including through a continuous exchange of information, and which is not crystallized in the delivery of an informational/contractual document, as is the case, for example, with the seller-consumer relationship" (see note cited, p. 11);
- "the employee has already received the information […] in the information provided upon establishing the employment relationship […] – information that is always available for consultation on the payroll portal and in the Manual – and which is always available in the Data Processing Policy, easily found on company portals" (see note cited, p. 12);
- "the data is not disclosed to third parties or transferred outside the EEA, so all the information required by [Article] 13 GDPR, with the exception of the list of rights, is already available to the employee via the Form" (see footnote cited, p. 12);
- "the Form provides the data subject with the specific and necessary information relating to the processing in an immediate and transparent format […] – i.e., by reporting it directly on the Form – without the need to burden the data subject with additional and repetitive documentation and without referring to other documents already available to the employee for all additional information that does not relate to the specific activity performed in each case" (see footnote cited, p. 12);
- "otherwise, the employer would have to provide lengthy and complex information continuously, which would be counterproductive precisely for raising employee awareness of the processing of personal data" (see footnote cited, p. 13);
- "In any case, if the Authority deems that the information regarding the processing of data collected via the Form should be provided through a specific additional notice, the Company will implement the new document, thus integrating the documentation provided to the interested party during the Interview" (see note cited, p. 13);
- "Regarding the inclusion, among the information to be provided during the Interview, of the information regarding "persons present" [...] it is specified that "persons present" refers exclusively to the employee and the interviewer" (see note cited, p. 13);
- with reference to Form 2021 "the Company: a) does not carry out any health surveillance activity which is entrusted, pursuant to the legislation, to the exclusive competence of the competent doctor; b) does not process any health data through Form 2021 [...] c) limits itself to asking whether the absence is due to illness, hospitalization or injury (information that the employer can and must legitimately process as it is necessary to guarantee the full exercise of the employee's rights by correctly keeping track of the days of absence to which the employee is entitled, also in order to correctly calculate the waiting period) while any - optional - comments relating to particular restrictions, limitations or prescriptions imposed by the competent doctor are processed solely for the profiles connected to the performance of the work activity and not to the state of health of the interested party, other information that the employer not only can legitimately process, given that he receives from the competent doctor assessments of suitability with any prescriptions, but must collect, also through the Form, in order to constantly guarantee health and safety in the workplace, intervening to prevent situations of discomfort. collective or individual” (see(see note cited, pp. 13, 14);
- "the invitation to submit further comments is made solely for the purpose of providing the interested party with the opportunity to report any needs related to the performance of their duties and/or, in any case, facilitate a rapid return to work" (see note cited, p. 14);
- "these further comments therefore concern exclusively activities and/or safeguards that must be implemented by the employer and which the employer must and may address during the re-entry interview, as they ensure the best organization of work and prevent difficult situations in which the employee may find himself" (see note cited, p. 15);
- "therefore, in this case, the objective element of the contested conduct is missing" (see note cited, p. 15);
- "Always with regard to the processing of ordinary data, it is reiterated that completing the Form itself—as already specified in the Form itself—is completely optional and at the discretion of the interested party. They will not suffer any consequences as a result of their choice to complete it or not. They will not be pressured in any way into the interview and completion of the Form. These are conducted at the request of the employees themselves, who wish to discuss with the Company any difficulties and/or issues related to work organization. This is demonstrated by the fact that in cases where employees refused to complete the Form, they were not contacted to pressure them to complete it, nor were there any consequences or decisions of any kind made." (see note cited, p. 15);
- "Despite the asymmetry that characterizes the employment relationship, it is nevertheless sometimes accepted that the employer may rely on consent as a legitimate basis for the processing of personal data. In particular, where the controller is able to demonstrate that consent was actually freely given by the data subjects, and therefore where employees do not suffer any negative repercussions from any refusal to consent, consent must be considered legitimately given (see Article 29 Data Protection Working Party, Guidelines on consent under Regulation (EU) 2016/679, point 3.1.1.; Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, point 6.2)" (see footnote cited, p. 15);
- "the processing of personal data through the Form must therefore be considered legitimate" (see footnote cited, p. 16);
- "Even if the Authority deems consent not to be the correct legal basis for the processing carried out by Magna, this would in any case be legitimate based on the legitimate interest of the latter pursuant to Article 6, paragraph 1, letter f) of the GDPR in the corporate organization and the protection of the mental and physical health of its employees" (see note cited, p. 16);
- "Regarding the alleged violation of the principle of minimization," it is noted that "pursuant to Article 2087 of the Italian Civil Code, the employer is obliged to adopt all necessary measures to ensure employees have a safe and suitable working environment for the performance of their duties. In this context, it is also the employer's responsibility to manage the employee's return to work, especially in the case of prolonged or recurring absences, identifying any situations of discomfort or difficulty, including environmental ones" (see note cited, p. 19);
- "The information collected through the Form is not superfluous at all, but rather allows the employer to adopt all the organizational and protective measures necessary to ensure adequate work organization, preventing potential situations of discomfort or difficulty for the employee" (see note cited, p. 20);
- "Nor can the argument that the information requested through the Form is already in Magna's possession at the time of the Interview be accepted. Indeed, the employer receives only limited and specific information from the attending physician, such as the state of the patient's illness and prognosis, which is insufficient to take the necessary measures pursuant to Article 2087 of the Italian Civil Code. The attending physician may have prescribed prescriptions and limitations to the patient without forwarding them to the employer, who receives them exclusively from the competent physician, but not necessarily following a single episode of illness" (see note cited, p. 20);
- "Even the suitability assessments do not provide the employer with the same information requested via the Form. Suitability assessments, in fact, are issued following medical examinations that take place prior to the start of employment to assess the worker's health and then only annually, to verify continued suitability for the specific job" (see note cited, p. 20);
- "The necessity of the data processed via the Form for Magna's corporate organizational purposes, and for the psychological and physical protection of employees, therefore excludes any violation of the principle of data minimization by Magna" (see note cited, p. 21);
- regarding the "alleged violation of the principle of retention limitation," it is noted that "the Company has established a maximum retention period of 10 years from the date of completion of the Form, setting a period even shorter than the overall retention period for the employee's file, into which, as indicated at the bottom of the Form, the completed form is inserted. The employee's file contains all information relating to the employee in the context of the employment relationship, including the activities performed and any periods of absence" (see note cited, p. 21);
- "given the importance of the aforementioned information in the relationship between employer and employee—and also to ensure that both the employer and the employee have the opportunity to reconstruct the employment situation, including to defend their rights against the other contractual party and in court—the information in the personnel file must be retained for 10 years, even after the termination of the employment relationship" (see note cited, p. 21);
- "the prevailing case law holds that the statute of limitations for employee compensation rights begins in all cases upon termination of the employment relationship" (see note cited, p. 21);
- "the Company has established a maximum retention period of 10 years from its completion because it believes this is an adequate period to fully manage any organizational needs that emerge from the interview and thus respond to any requests or complaints from the employee" (see note cited, pp. 21, 22);
- "in daily business operations, however, Magna periodically deletes the Forms, retaining only those Forms that contain relevant information regarding any measures or actions that the Company must implement pursuant to Article 2087 of the Italian Civil Code to ensure adequate internal management of resources and the protection of employees' working lives" (see note cited, p. 22);
- regarding the "alleged processing of data that is not relevant to Article 8 of the Labour Code," it is noted that "while it is clear and reiterated that the Company does not collect, nor has it ever intended to collect, data on the worker's health, and without prejudice to the above regarding the employer's obligation to prevent and protect workers, the purpose of Article 8 of the Statute is to prevent the employer from investigating the worker's opinions and personal life, and certainly not to prevent the employer from assessing the health status of a workplace" (see note cited, p. 23);
- "Professional aptitude, in fact, should be understood as the set of skills, abilities, and personal qualities that allow an individual to effectively perform a given job, including with respect to the environment in which a worker operates and, therefore, the worker's suitability for the environment and vice versa: the aptitude to fulfill a work role, in fact, cannot ignore an analysis of the organization in which the worker is called to work. […] The case law in which violations of Article 8 of the Workers' Statute have been established, moreover, concern very different situations, such as psychological aptitude tests, with questions pertaining to the intimate, personal, and non-work life and opinions of workers (e.g., questions about pregnancy, the worker's family, the worker's home)" (see note cited, p. 24);
- "The questions asked in the interview fulfill the employer's specific duties of protection towards workers. Our legal system, in fact, contains numerous rules and principles that require—and in any case legitimize—the employer's intervention to identify and prevent potential difficult situations in the workplace. Consider: [art.] 2087 of the Italian Civil Code […]; […] the provisions contained in the Consolidated Law on Safety (Legislative Decree 81/2008) regarding the "preparation and implementation of measures to protect the health and psycho-physical integrity of workers" and the inclusion, in the risk assessment document, of "risks including those related to work-related stress," which require the identification of sentinel events that may give rise to a risk that the employer is required to monitor and resolve" (see note cited, p. 24);
- "consider also the employer's duty to inquire about the reasons for the absences of employees with disabilities, in order to make reasonable accommodations in the workplace" (see note cited, p. 24);
- "consider the right—clearly recognized by case law—for the employer to unilaterally transfer an employee to a different location in the event of environmental incompatibility, which clearly gives rise to the legitimacy of an investigation into environmental conditions and the difficulties of colleagues working in that environment" (see(see note cited, p. 24);
- "the information requested through the forms in question is, in fact, strictly related to the employment relationship, the professional aptitude of the workers, and is necessary, or at least useful, for fulfilling the requirements for protecting the mental and physical health of the workers involved" (see note cited, p. 25);
- "the application of sanctions, particularly punitive ones, is not automatic. Their relevance must be assessed on a case-by-case basis in light of the party's conduct and the purpose of such measures" (see note cited, p. 26);
- "should the Authority deem it necessary to sanction the Company, the sanction should first take into consideration that the 2020 Form and the Covid Form have no longer been used by the Company since September 2021. Therefore, Magna no longer carries out any processing based on these forms, which therefore should not be considered in the final analysis of any sanctioning measures by the Authority" (see note cited, p. 27);
- "Furthermore, relevance must be given to the complete absence of damages—or any consequences—to the interested parties, both those who completed the form and those who refused to provide their consent. Demonstrating this, the Company has never received any objections, much less any complaints, from the interested parties, either directly or through the unions" (see note cited, p. 27);
- "Furthermore, in this case, the absence of socially reprehensible conduct (i.e., conduct that could potentially cause actual or potential harm to the interested parties or be aimed at obtaining an unfair advantage) makes a monetary sanction inappropriate, regardless of its quantification" (see note cited, p. 27);
- "The sanction of publishing a potential sanction on the Authority's website would be unjustifiably punitive" (see note cited, p. 27);
- the Company requests "- preliminarily, the dismissal of this proceeding due to [...] violation of the procedural time limits; - alternatively, the dismissal of the complaint and this proceeding due to lack of merit; - further alternatively, the application of the sanction of a warning only" (see note cited, p. 28).
On October 29, 2024, following the Company's specific request, a hearing was held. On that occasion, the party stated that:
- "The Company believes that the legal basis for data processing during interviews could theoretically be a legal obligation and believes that obtaining employee consent is more attentive to their needs."
- "In any case, the Company is fully committed to further improvements, while maintaining its commitment to improving employee well-being."
- "The Company [...] is committed to gathering feedback from its employees regarding organizational improvements that can be implemented, such as improving workstations."
- "The Company has activated an internal whistleblowing channel as well as a separate channel that can be used completely anonymously (a hotline managed by external personnel). No reports regarding the form and/or meetings have been received through these channels."
- "In relation to the principles of privacy by design and by default, the Company has determined that there are no significant risks for the data subjects";
- "The Company is not structured like an office, being a metalworking company, and therefore it may not be easy to detect situations of concern";
- "The retention period specifies that the maximum period is ten years, which by company policy is the maximum duration allowed for highly confidential documents. However, in practice, the Company normally deletes data even earlier, and currently there are no forms older than one year. The identification of a maximum period is based on the assessment that not all concerns may arise at the same time, so a significant amount of time may pass before other similar reports emerge from the interviews. Within the maximum period of ten years, if the data is deemed no longer relevant, following a case-by-case assessment, it is deleted. Currently, the Company does not retain forms older than 2023."
3. Outcome of the Proceedings
3.1 Established Facts and Observations on Personal Data Protection Legislation
Based on the information acquired during the investigation and subsequent assessments by this Department, it is established that the Company, at least since 2020, has subjected its workers (according to the Company's records, as of December 31, 2024, the Company has approximately 890 employees) to an interview with their manager upon their return from periods of absence. During this interview, the manager completed the "RTWI (Return to Work Interview)" form, using the information provided by the worker.
According to the Company's declaration, this conduct falls within "workplace health and safety practices" and is intended to "identify any difficult situations in the workplace and, if necessary, provide support to the employee and/or facilitate their rapid return to work."
According to the Company's statement, it emerged that this form, once completed by the interviewee's manager, is delivered to the Human Resources office, which, together with the manager and/or the company physician, evaluates "any initiatives to protect the employee's health, such as modifying the workstation or managing working relationships" (see note 7/10/2024, p. 3). Subsequently, "the form is stored in the employee's personal file, in a locked cabinet in the HR office, accessible only to authorized personnel" (see note 7/10/2024, p. 4).
Since 2020, the Company has modified the form used several times; the current model was introduced, based on the Company's specifications, starting in September 2021.
The Company's conduct described above does not comply with data protection regulations for the reasons set forth below.
In this regard, it is emphasized that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false documents or records, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority."
It is recalled, in general terms, that the processing of personal data must be carried out in compliance with the principles set forth in Article 5 of the Regulation, including the principles of lawfulness, fairness, and transparency, as well as the minimization and limitation of storage.
With regard to so-called "c.d." data, In the context of the employment relationship, the employer, as data controller, may process employees' data if the processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the data subject's request, or if the processing is necessary for compliance with a legal obligation (see Article 6, paragraph 1, letters b), c), of the Regulation).
For data belonging to special categories of data, Article 9 of the Regulation establishes a general prohibition on processing unless one of the conditions expressly indicated in Article 9, paragraph 2, of the Regulation applies (see in particular letter b), according to which paragraph Article 1(1) does not apply when "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or by a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject."
Due to their particular nature, such data merit specific protection and the implementation of specific measures when processed: processing may, in fact, result in significant risks to the fundamental rights and freedoms of individuals (see Recital 51 of the Regulation).
With regard to special data relating to workers, responsibilities are divided between the employer and the physician responsible for carrying out health surveillance (see Legislative Decree No. 81 of 2008).
It should also be noted that Article 13 of the Regulation provides for specific protection of personal data and the implementation of specific measures when processing personal data. Article 13 of the Regulation requires the data controller to provide the data subject, prior to processing, with a series of information regarding the processing of their personal data (so-called information notice).
If the processing is carried out in the context of an employment relationship, therefore, the employer, as data controller, is obliged to inform employees of the essential characteristics of the processing it intends to perform.
In the context of the employment relationship, fully informing employees about the processing of their data is also an expression of the general principle of fair processing (see Article 5, paragraph 1, letter a) of the Regulation).
Finally, Article 113 of the Code provides that "the provisions of Article 8 of Law No. 300 of 20 May 1970 and Article 10 of Legislative Decree No. 276 of 10 September 2003 remain unaffected."
3.2 Procedural Objections
First of all, regarding the Company's observations regarding the notification of violations pursuant to Article 166 of the Code "beyond the deadline for closing the proceedings" (see note dated October 7, 2024, pp. 8-10), it is noted that the investigation under this order was initiated following a report pursuant to Article 144 of the Code.
Therefore, precisely in Table B, Section 2), contained in Internal Regulation No. 2 of 2019, cited by the Company in the aforementioned defense briefs of October 7, 2024, it is specified that for proceedings opened following the submission of a report pursuant to Article 144 of the Code, a deadline of "18 months from the initiation of the procedure for the adoption of the corrective measure referred to in Article 12 of the Guarantor's Regulation No. 1/2019" applies.
Article 12 of the Guarantor's Internal Regulation No. 1 of 2019 provides, among other things, that "When the examination of the complaint is not concluded pursuant to Article 11, paragraph 1, the department, service, or other organizational unit shall initiate, by communicating with the data controller and, where applicable, the data processor, the procedure for the adoption of the measures referred to in Articles 58, paragraph 2, and 83 of the GDPR."
Therefore, the 18-month deadline indicated in the aforementioned internal regulation runs from the notification of the violations pursuant to Article 166, paragraph 5, of the Code.
In this case, the notification of the violations was made on August 7, 2024.
It should also be noted that the 120-day deadline established by Internal Regulation No. 2 of 2019 for the notification of alleged violations (Article 166, paragraph 5, of the Code) runs from the date of the discovery of the violation of personal data protection regulations, which, in this case, occurred only following receipt of the response on April 11, 2024, and obviously not following the mere receipt of the report in question.
Indeed, as clearly supported by case law, the deadline for notifying the details of the violation "does not coincide with the time when the actual fact is acquired by the authority to which the report was sent, but must be identified when that authority has acquired and assessed all the data necessary to verify the existence of the reported violation, or when the time elapsed is no longer justified by the need for such acquisition and assessment" (among many, see Court of Cassation, ruling no. 38510/2021).
Given the sensitive nature of the data processed and the number of data subjects involved, in this case, the Authority deemed it necessary to follow up an initial request for information pursuant to Article 157 of the Code with a second request for information, also sent pursuant to Article 157 of the Code.
Only after the Company's second response did the Authority acquire all the necessary information to be able to charge the Company with violations of personal data protection regulations. It is worth noting that, through these two requests for information, the Authority guaranteed the Company the right to be heard and fully exercised its right to defense, starting from the preliminary investigation phase of the proceedings, allowing it to provide all the information needed to verify compliance with the regulations of the processing performed.
The preliminary investigation phase, among other things, is, by its very nature, intended to allow the Authority to gather all relevant evidence confirming (or not) the existence of a violation and to decide how to proceed with the proceedings (see ECJ 30/01/2025, case C-510/23, with reference to the proceedings initiated by the Italian Competition Authority). The duration of the investigation—and this is inherent in its structure and function—therefore also depends on the complexity of the proceedings.
To argue otherwise would lead to the Authority's investigation into complaints alleging violations of personal data protection regulations being entirely superfluous (if not useless). The purpose of the investigation is, instead, to verify the presence of sufficient evidence to establish a violation and initiate proceedings by notifying the aforementioned violations pursuant to Article 166, paragraph 5, of the Code.
That said, given that the second response was submitted by the Company on April 11, 2024, and the notification of the violations was sent on August 7, 2024, it is clear that the Authority certainly complied with the 120-day deadline for reporting the violations found.
Finally, it is useful to note that, as clearly indicated in the notification of violations sent to the Company, the Company is accused of processing data that, despite the use of three different forms, has not ceased, but has continued uninterrupted since 2020 and beyond the notification of violations.
3.3 Lack of Appropriate Information for Data Subjects
The Company's conduct, consisting of the completion of the "RTWI "Return to Work Interview" form by the manager of the employee interviewed following periods of absence, was carried out (and, as far as we know, is still being carried out) in violation of Article 13 of the Regulation, which constitutes a corollary of the principle of transparency set forth in Article 5, paragraph 1, letter a), of the Regulation. This is because data subjects do not appear to have been provided with adequate information regarding the specific processing of personal data by the Company.
The few lines at the beginning of the form (both for the version in force until May 2020 and the version drafted in May 2020, as well as the one in use since September 2021 and still in use) do not contain exhaustive information regarding the processing in question.
Moreover, regarding the inclusion of "persons present" among the information to be provided during the interview, the way it is worded suggests that, contrary to what the Company indicates, individuals other than the interviewee and interviewer may be present at the interview. It is therefore clear that this expression is misleading or, at the very least, unclear.
Not even by including the very limited information at the bottom of the form in use since September 2021 has the Company fully fulfilled its disclosure obligation under Article 13 of the Regulation.
Indeed, no information regarding the specific processing in question can be found in the "Employee Notice" produced by the Company, nor in the "Data Protection Manual," nor in the "Personal Data Protection Policy."
The lack of adequate notice also means, as will be discussed in more detail below, that any consent given by employees, which, according to the Company, constitutes the legal basis for the processing, lacks the fundamental requirements pursuant to Article 7 of the Regulation.
In this regard, it is emphasized that the purpose of the notice—which simultaneously constitutes a right of the data subject and an obligation for the data controller—is to inform the data subject of how their data is being processed.
Only when there is full awareness of the processing and its purposes can the data subject (provided the other requirements are met) provide their actual informed consent.
3.4 Violation of the principle of lawfulness of processing
By completing the return-to-work interview form following absence, the Company processes workers' data (both so-called general data and so-called special data) without appropriate lawfulness, thus violating Article 6 of the Regulation and Article 9 of the Regulation (particularly regarding the processing of health-related data).
This finding concerns all three forms used by the Company over time. The processing carried out by the Company, in fact, does not fall within the scope of health surveillance, an activity which, by express legal provision, is the exclusive responsibility of the company physician and not the employer (see Article 41 of Legislative Decree No. 81 of 2008).
Indeed, the wording of certain specific questions included in the aforementioned questionnaires may result in responses containing sensitive data, particularly health-related data (aside from the assessment of the processing of data relating to infections related to the Covid-19 epidemic, regarding which no specific objections have been raised, given the regulatory provisions adopted during the health emergency).
With regard to the sensitive data category, it should be noted, among other things, that, with regard to the model in use until May 2020 and the form drafted in May 2020, the "introduction" already specifies that "the interview is [...] aimed at monitoring the state of health after one or more illnesses."
In the form used until May 2020, the question regarding the description requested if the employee believes the absence (due to illness, hospitalization, or injury) was due to a work-related cause may also require a response containing specific information ("Does the employee consider the absence to be due to a work-related cause? (If so, please describe in the employee's comments section)").
Regarding the form drawn up in May 2020, the question "Has any health problem you have worsened in recent years?" clearly requires a response regarding the interested party's state of health and, as such, falls under Article 9 of the Regulation (the same question was also included in the form used until May 2020).
In the form currently in use, the request for additional "comments" from the employee regarding the affirmative response to the question regarding the presence of specific restrictions/limitations/prescriptions imposed by the company doctor may also contain health-related data pursuant to Article 9 of the Regulation.
Furthermore, it should be noted that only the form currently in use informs the employee of the option to contact the company doctor ("For prevention purposes, remind the employee that for any type of problem, he or she has the right to request a confidential meeting with the Company Doctor, or to use the EFAP (Magna's completely anonymous employee assistance program), or to use the company's Open Door process"), whereas the two forms previously used asked the employee whether a meeting with the company doctor was necessary ("Do you need a specific meeting with the company doctor to explain your health situation?").
It is therefore clear that the response to the aforementioned question, contained in the two forms previously used, may entail the processing of health-related data; Informing the employee of the possibility of requesting a visit with the company doctor, on the other hand, does not constitute data processing, as it merely communicates an aspect that is already provided for by law (see Article 41, paragraph 2, letter c), Legislative Decree No. 81 of 2008).
Regarding the voluntary nature of the collection of information via the questionnaire (and therefore the presence of consent), which, according to the Company, characterizes the completion of the form in question—in all three versions—it should first be noted that there are no elements that would support this view of the aforementioned form.
Indeed, it should be emphasized that the two previously used forms state that "the interview must take place on the first day of the employee's return to work." This peremptory expression does not allow the collection of information to be considered voluntary, as claimed by the Company in the procedure. From the literal wording of the form, the interview appears to be required, at least for the first two forms used, upon return from a period of absence due to illness, injury, or hospitalization.
Regarding the voluntary nature of completing the form, it should also be noted (and in any case) that, in the context of the employment relationship, consent (Article 6, paragraph 1, letter a) of the Regulation) cannot generally constitute a suitable condition for the lawfulness of the processing of workers' data.
This is due to the structural asymmetry that characterizes the employment relationship and the inevitable impossibility (except in limited cases to be ascertained on a case-by-case basis) of recognizing the worker's consent as having the characteristics of freedom required for it to become a suitable legal basis (see Provision 19/7/2018, no. 427 in www.garanteprivacy.it, web doc. no. 9039945; see arts. 6-7 and recitals 42-43, Regulation (EU) 2016/679; see also, in accordance with this, Article 29 Group, Guidelines on consent, adopted on 28/11/2017 as amended and last adopted on 10/4/2018, esp. par. 3.1.1.; Opinion 2/2017 on data processing in the workplace, WP 249, esp. par. 3.1.1 and 6.2; Opinion 8/2001 on the processing of personal data in the employment context, WP 48, 13/9/2001, pp. 3, 23, and 26; European Commission, Communication of 6 November 2015, COM(2015) 566, pp. 12 and 13; Working Document on a common interpretation of Article 26(1) of Directive 95/46/EC of 24 October 1995, WP 114, 25 November 2005, pp. 11-12.
In this case, precisely given the category of data requested, it must be considered that consent, even if it had actually been given by the data subjects, could not be considered, as required by the provisions, free and unconditional. Furthermore, the organizational measures implemented by the Company, which require the form to be completed in the presence of the direct line manager, do not support the freedom of consent.
It should also be noted that, with regard to so-called special categories of data, Article 9(2) of the Regulation provides that, in the context of the employment relationship, such data may be processed only when "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject."
National law therefore does not provide that, in the context of the employment relationship, data belonging to special categories of data may be processed on the basis of consent or on the basis of legitimate interest.
In this regard, it is also emphasized that Legislative Decree no. 81 of 2008 identifies the specific obligations of employers (Article 18) to protect the physical integrity and moral personality of workers (pursuant to Article 2087 of the Italian Civil Code).
The law establishes the specific obligations that employers must comply with regarding health and safety in the workplace. However, fulfilling these obligations, if it involves the processing of personal data, must comply with the provisions of personal data protection legislation.
Also in accordance with the provisions of Legislative Decree no. 81 of 2008, it is clear that the competent physician is the only person authorized to process, with full autonomy and technical expertise, personal health data essential for the performance of the health and safety protection function in the workplace (see also the document adopted by the Authority, "The role of the competent physician in matters of workplace safety, including in the emergency context," web doc. no. 9585367).
Finally, it is emphasized that, based on the above, the Company believes that the legal basis for this personal data processing can be identified both in compliance with the provisions of Article 2087 of the Italian Civil Code, and in consent or legitimate interest, should the other legal bases not apply.
In this regard, it is emphasized that this interpretation is incompatible with the correct application of data protection regulations; The legal basis constitutes the necessary and essential prerequisite for any processing of personal data and, as such, it is up to the data controller to precisely and specifically identify it in advance, with respect to the processing itself. Furthermore, legitimate interest can never be identified as a condition of lawfulness simply because the other legal bases are not present (see, in this regard, albeit with respect to another specific case, provision no. 137 of 15/04/2021, web doc. 9670738).
3.5 Violation of the Data Minimization Principle
The Company's conduct also violates the data minimization principle (Article 5, paragraph 1, letter c), of the Regulation) because the data collected when completing the form for the return-to-work interview after a period of absence due to illness, injury, or hospitalization is irrelevant to the action the employer should take in the event of the employee's absence, also in light of the provisions of Article 2087 of the Italian Civil Code, and given the assignment of health surveillance to the competent physician, pursuant to Legislative Decree No. 81 of 2008.
It should also be noted that some of the information requested to be included in the questionnaire by the manager during the interview upon return from a period of illness, injury, or hospitalization, for subsequent submission to the Human Resources office, should (correctly) already be known by the Human Resources office itself.
Therefore, the specific reason for having to collect this information again, through the returning employee's manager, is unclear. For example, in the current form, where the request includes the last period of absence, the type of absence with respect to its duration, when the absences are concentrated, the reason for the absence (illness, hospitalization, injury), and any restrictions/limitations/prescriptions issued by the company doctor, it is clear that this information should already be known by the human resources office, regardless of the return-to-work interview and without resorting to the aforementioned legal procedures for submitting the employee to the interview.
The established procedure therefore leads to unnecessary duplication of data collection (compared to that which the personnel office should already legitimately carry out)—among other things, data belonging to special categories—the actual need for which has not been clarified.
The Company's reasoning regarding compliance with the provisions of Article 2087 of the Italian Civil Code cannot be considered valid.
3.6 Violation of the principle of retention limitation
According to the Company's declaration, the forms completed following the return of employees from work due to illness, injury, or hospitalization, which, as stated, constitute data processing without an appropriate legal basis, are retained by the Company, based on the model currently in use, for a period of ten years.
The Company also added that "in fact [...] it normally deletes forms even earlier, and currently there are no forms older than one year. The establishment of a maximum period is based on the assessment that not all problems may occur at the same time, so a significant amount of time may pass before other similar reports emerge from the interviews. Within the maximum period of ten years, if the data is deemed no longer relevant, following a case-by-case assessment, it is deleted. Currently, the Company does not retain forms older than 2023" (see hearing minutes of October 29, 2024).
Given that the ten-year deadline is in itself disproportionate with regard to the data processed using the forms in question, the documents disclose the impossibility—information that the data subject would need—of clearly identifying the retention period and the criteria used to determine that period.
In fact, it is not clear what the specific criteria are for determining the deletion (and after what period) of data—including health data—by the Company.
This therefore violates the principle of storage limitation (Article 5, paragraph 1, letter e), of the Regulation).
3.7 Processing of irrelevant data
Using the aforementioned forms, the Company has also processed (and continues to process, using the third version of the form) employee data that are irrelevant for the purposes of assessing the employee's professional aptitude, thus violating Article 11 of the GDPR. 113 of the Code (this article calls for compliance with Article 8 of Law No. 300 of 20/5/1970 and Article 10 of Legislative Decree No. 276 of 10/9/2003 as a condition for lawful processing; in this regard, the Court of Cassation, Civil, No. 18302 of 19/9/2016, established that "acquiring and retaining data that contain (or may contain) such information already constitutes the prohibited conduct [...] even if the data is not subsequently used. It is not necessary to subject the collected data to any particular processing for the unlawful conduct to occur, since the mere acquisition and retention of their availability constitutes a violation of the legislative requirement.")
This provision constitutes one of the "most specific provisions of national law to ensure the protection of rights and freedoms with regard to the processing of employees' personal data in the context of employment relationships" identified in Article 88 of the Regulation.
Specifically, the Company, in the form used until May 2020, asked: "Does the employee consider the absence to be work-related? (If so, please describe in the employee comments section)", "Are there any specific issues you would like to discuss, without going into too much detail, and if you feel comfortable?", "From an analysis of your attendance, it has emerged that you have been absent several times", "Are there any specific situations of distress within the department you would like to discuss?").
Furthermore, in the form drafted in May 2020, the Company asked: "Does the employee consider the absence to be work-related? (If so, please describe in the employee comments section)", "Are there any specific issues you would like to discuss, without going into too much detail, and if you feel comfortable?", "Do you need a special meeting with the company doctor to discuss your health situation?", "Are there any specific situations of distress within the department you would like to discuss?"
The questions cited could result in answers containing information that was irrelevant to the assessment of professional aptitude: the absence that required completing the form during an interview is, and is, due to illness, injury, or hospitalization.
In the form currently in use, the Company asks: "Do you think the company could adopt measures to improve the working environment (e.g., to eliminate any situations of discomfort of which you are aware? If so, what suggestions?"). In this regard, there appears to be no concrete need to ask this question in an interview upon the employee's return from a period of absence due to illness, injury, or hospitalization (rather than independently of this), nor does it appear that the answer to this question should be specific to a specific worker (rather than anonymous).
It is therefore clear that the formulation of specific questions (listed above) in the forms (used in the past and also in the current one) could result in answers relating to "facts that are not relevant to the assessment of the worker's professional aptitude."
4. Conclusions: Declaration of unlawfulness of processing. Corrective measures pursuant to Article 58, paragraph 2, of the Regulation
For the above reasons, the Authority believes that the declarations, documentation, and reconstructions provided by the data controller in the The investigation does not address the concerns notified by the Office with the initiation of the proceedings and is therefore unsuitable for dismissal of this proceeding. Furthermore, none of the cases provided for in Article 11 of the Italian Data Protection Authority Regulation No. 1/2019 apply.
The Company's processing of personal data, and specifically the requirement that workers return from periods of absence due to illness, injury, or hospitalization to undergo an interview with their supervisor, who will complete a specific form containing health-related data, is in breach of personal data protection regulations and, in particular, violates Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, and 88 of the Regulation and Article 113 of the Code.
The breach, established in accordance with the grounds set out in the statement of reasons, cannot be considered "minor," taking into account the nature and severity of the breach, which affected, among other things, the general principles of processing, processing involving data belonging to special categories of data, and the manner in which the supervisory authority became aware of the breach (see Recital 148 of the Regulation).
The Authority also considered the level of severity of the breach to be medium, taking into account all relevant factors in the specific case, and in particular the nature, severity, and duration of the breach, taking into account the nature, scope, or purpose of the processing in question, as well as the number of data subjects and the level of damage suffered.
The Authority took into account the criteria relating to the intentional or negligent character of the breach and the categories of personal data affected by the breach, as well as the manner in which the supervisory authority became aware of the breach (see Article 82(2) and Recital 148 of the Regulation).
Therefore, given the corrective powers granted by Article 14 of the Regulation, the Authority considered the following: Article 58, paragraph 2, of the Regulation provides for the prohibition of the processing of unlawfully collected data, the deletion of unlawfully collected data, and the imposition of an administrative fine pursuant to Article 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letters f), g), and i) of the Regulation.
5. Adoption of an injunction order for the application of the administrative fine and additional penalties (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code)
Violation of Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, 88 of the Regulation, and 113 of the Code entails the application of the administrative fine pursuant to Article 83, paragraph 5, letter i). a) and d) of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of November 24, 1981).
The Guarantor, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of November 24, 1981), in relation to the processing of personal data carried out by Magna PT S.p.A., which has been determined to be unlawful, in the terms set out above.
Having deemed it necessary to apply Article 58, paragraph 3, letter i) of the Regulation and Article 166 of the Code. Article 83 of the Regulation provides that "where, in relation to the same or linked processing operations, a controller […] intentionally or negligently infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement." The total amount of the fine is calculated so as not to exceed the maximum fine set forth in the same Article 83, paragraph 5.
With reference to the elements listed in Article 83, paragraph 5. 2 of the Regulation, for the purposes of applying the administrative fine and quantifying it, given that the fine must be "effective, proportionate, and dissuasive in each individual case" (Article 83, paragraph 1 of the Regulation), it is noted that, in the case under consideration, the following circumstances were taken into account:
- the significant severity of the violation, which also involved cases punished more severely due to the interests protected by the violated provisions (concerning the principles of lawfulness, fairness, minimization, storage limitation; the right to information; provisions providing greater protection for workers);
- the processing also involved health data following a period of absence due to illness, injury, or hospitalization;
- the duration of the violation, which has continued since at least 2020 and is still ongoing;
- the high number of data subjects involved in the confirmed violations, given that the possibility of being subjected to an interview upon return to work after a period of absence due to illness, injury, or hospitalization applies to all Company employees;
- with regard to the intentional or negligent nature of the violation and the degree of responsibility of the data controller, the objective elements of the Company's conduct and the degree of responsibility of the Company were taken into consideration. The Company breached its legal duty of diligence and failed to comply with data protection regulations, with respect to a variety of provisions, despite the stated purpose of implementing the provisions of Article 2087 of the Italian Civil Code, thus being able to adopt measures to protect the employee's physical and mental well-being;
- cooperation with the Supervisory Authority was taken into account.
Furthermore, it is believed that the offender's financial circumstances, determined based on the Company's revenues with reference to the ordinary financial statements for 2023 (the latest available), are relevant in this case, given the aforementioned principles of effectiveness, proportionality, and dissuasiveness, which the Authority must adhere to in determining the amount of the fine (Article 83, paragraph 1, of the Regulation).
It is also believed that the impact on the Company of the measures prohibiting processing and deletion must be taken into account.
In light of the above elements and the assessments made, it is deemed appropriate, in this case, to impose an administrative fine of €50,000 (fifty thousand/00) against Magna PT S.p.A.
In this context, it is also believed that, pursuant to Article 166, paragraph 7, of the Code and Article 166, paragraph 7, of the Italian Civil Code, the Company is entitled to a fine of €50,000 (fifty thousand/00). 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/2019, this chapter containing the injunction order must be published on the Italian Data Protection Authority's website.
This is in light of the specific characteristics of the case under consideration, particularly given that the processing also involved data belonging to special categories of data of workers returning from periods of absence due to illness, injury, or hospitalization, and that the processing continued even after the Authority opened an investigation, as well as the number of data subjects involved.
NOW, CONSIDERING ALL THE ABOVE, THE ITALIAN DATA PROTECTION AUTHORITY
pursuant to Article 57, paragraph 1, letter f) and Article 83 of the Regulation, finds the processing carried out by Magna PT S.p.A., with registered office in Modugno, Via dei Ciclamini 4, 70026, Tax Code and VAT No. 001900000001, unlawful. 04886850728, described in the terms set out in the grounds, for violation of Articles 5, paragraph 1, letters a), c), e), 6, 9, 13, and 88 of the Regulations and Article 113 of the Code;
ORDERS
Magna PT S.p.A.:
- pursuant to Article 58, paragraph 2, letter f), of the Regulations, the prohibition of further processing of the data collected and retained through the forms completed following the return-to-work interview after periods of absence due to illness, injury, or hospitalization, as described in the grounds;
- pursuant to Article 58, paragraph 2, letter g), of the Regulations, the deletion of the data collected and retained through the forms completed following the return-to-work interview after periods of absence due to illness, injury, or hospitalization, as described in the grounds, within 60 days of notification of this order; Magna PT S.p.A. is requested to communicate what steps it has taken to implement the provisions of this order and to provide adequately documented feedback pursuant to Article 157 of the Code within 60 days of notification of this order. Failure to provide such feedback may result in the application of the administrative penalty provided for in Article 83, paragraph 5, letter e), of the Regulation;
- pursuant to Article 58, paragraph 2, letter i), of the Regulation, to pay the sum of €50,000 (fifty thousand/00) as an administrative fine for the violations indicated in this order.
HEREBY ORDER
Magna PT S.p.A. to pay the aforementioned sum of €50,000 (fifty thousand/00), according to the methods indicated in the attachment, within thirty days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. It is hereby stated that pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half of the fine imposed within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, for filing an appeal as indicated below.
ORDERS
- pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Guarantor No. 1/2019, the publication of the injunction order on the Authority's website;
- pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Authority's Regulation No. 1/2019, the publication of this provision on the Authority's website;
- pursuant to Article 17 of the Authority's Regulation No. 1/2019, the recording of violations and measures adopted pursuant to Article 58, paragraph 2, of the Regulation, in the Authority's internal register provided for by Article 57, paragraph 1, letter u) of the Regulation.
Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150/2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad.
Rome, July 10, 2025
THE PRESIDENT
Stanzione
THE REPORTER
Stanzione
THE ACTING SECRETARY GENERAL
Filippi
- ↑ The DPA's reasoning is not clearly explained here. However, the motivation seems to imply that the sensitive nature of the data was one of several factors which the DPA took into account when assessing whether consent was freely given.
- ↑ See the comments for more detail on the relevant laws and their role in the DPA's findings.
