Banca Widiba S.P.A. – Court Ruling (Italy, 2023)

The judgement of the Court of Appeal of Milan was appealed following its confirmation of the ruling of the Court of First Instance, which had established the illegitimacy of the dismissal of a manager (the defendant) by Banca Widiba Spa (the applicant) on 8 May 2018. The defendant was fired due to conduct of insubordination and breach of the duties of diligence and loyalty as well as of the general principles of fairness and good faith for having relations with competing businesses and for having avoided a preventive technical assessment, causing doubts over the genuineness of the illness underlying his many absences. The Court of Appeal, agreeing with the Court of First Instance, ruled the illegitimacy of the first two disciplinary charges as they were the result of investigative monitoring of company e-mails and tailing, which did not ensure the proportionality and procedural guarantees against arbitrariness of the employer and lacked justification for such invasive monitoring, violating the right of the worker’s right to respect for his correspondence. The applicant filed for an appeal against the decision to the Supreme Court of Cassation (Supreme Court). The Supreme Court established an infringement of [https://www.cgil.unimi.it/wp-content/uploads/2014/01/l_300_70.pdf Article 2 of the Italian Worker’s Statute], [https://www.cgil.unimi.it/wp-content/uploads/2014/01/l_300_70.pdf Article 3 of the Italian Worker’s Statute] and [https://www.cgil.unimi.it/wp-content/uploads/2014/01/l_300_70.pdf Article 4 of the Italian Worker’s Statute] and [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 113 of the Italian Privacy Code], [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 114 of the Italian Privacy Code] and [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 160 of the Italian Privacy Code] in connection with the protection of the confidentiality of the employee, [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8 ECHR], and based on the set of principles expressed in the Privacy Code and the GDPR, specifically those of data minimisation, proportionality, purpose limitation, transparency and fairness. The Supreme Court stated that it is necessary to ensure a proper balance between the requirements of the protection of corporate interests and assets related to the freedom of economic initiative and the protection of the dignity and privacy of the worker, depending on the circumstances of the claim. In this case, the Supreme Court ruled that the monitoring of all the communications on the defendant’s company laptop was unjustified as it was indiscriminate, unbounded and because the applicant did not inform the defendant of the possible monitoring of his company laptop’s communications or the nature and extent of the monitoring.