Transparency and automation are among the hottest regulatory trends in 2023. You can see them as the fil-rouge underlying the various European legislative proposals on AI (for more on this, see our articles in English here, here and here). In the context of employment, strengthening transparency and predictability of working conditions is the aim pursued by the European legislator with Directive (EU) no. 2019/1152 (Directive).

In Italy, the Directive was implemented with Legislative Decree no. 104 of June 27, 2022 (Transparency Decree), which entered into force on August 13, 2022. From an employment point of view, the Transparency Decree has immediately raised important interpretative doubts and managerial problems (to learn more about this, see our articles in Italian here and here). However, the labor legal framework is not the only one affected: Among the prescriptions introduced, Art. 4(1)(b) of the Transparency Decree (which introduced the new Art. 1 bis to Legislative Decree no. 152 of 1997) touches closely also the world of privacy, introducing certain information obligations when employers utilize automated decision-making or monitoring systems.

In this article, we provide a brief overview of the main privacy implications of Art. 4(1)(b) of the Transparency Decree, also taking into account the recent clarifications (in Italian) provided by the Italian Data Protection Authority (Garante). To read more about data protection in the employment context, see also our article here.

What is an automated system and does their use fall under Art. 22 GDPR?

According to the Italian Ministry of Labor’s clarifications on the Transparency Decree (in Italian), automated systems are “tools that, through the collection and processing of data carried out by an algorithm, artificial intelligence, etc., are able to generate automated decisions.”

In particular, the automated systems that fall within the scope of the Transparency Decree (Automated Systems) have the following characteristics:

• They are designed to implement a decision-making process capable of affecting the employment relationship, both during recruitment or duties assignment (e.g. the use of chatbots during interviews, automated profiling of candidates, screening of resumes, emotional recognition software, psycho-aptitude tests) and in employment management or terminations (such as the automated assignment or revocation of tasks or the determination of working hours or promotions, through e.g., statistical analysis, data analytics, machine learning tools, neural networks or deep-learning);
• They impact the monitoring, evaluation, performance and fulfillment of the contractual obligations of workers (though, e.g., the use of tablets, digital devices and wearables, GPS and geolocators, facial recognition systems, rating and ranking systems).

But do Automated Systems (also) fall under Art. 22 GDPR on automated individual decision-making processes?

Art. 22 GDPR provides for a general prohibition on making decisions based solely on automated processing that produce legal effects or similarly significantly effects on data subjects (such as discrimination). Such decisions are allowed only under certain conditions, i.e. either when they are necessary for the performance of a contract between the data subject and the data controller, they are authorized by the law or they are based on the data subject’s explicit consent. In those cases, data controllers must (among other things) integrate the information notice provided to data subjects under Articles 13 and 14 GDPR, by indicating the existence of automated decision-making and providing data subjects with meaningful information on the system’s logic as well as on the significance and envisaged consequences for them as a result of the processing.

That said, the Garante did not provide further clarifications, other than indicating that employers should assess whether Art. 22 GDPR might apply. According to some commentators, this seems quite unavoidable, also in cases of limited human participation in the decision-making process. In this regard:

• As clarified by the European Data Protection Board in its Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, Art. 22, GDPR also applies if there is human involvement that has no actual influence on the result process.
• Similarly, the Italian Ministry of Labor indicated in the abovementioned clarifications that the information obligations set forth by Art. 4(1)(b) of the Transparency Decree must also be fulfilled in the event of human intervention that is merely incidental (which may be interpreted as an intervention that is irrelevant to the decision-making process).

But are the privacy requirements introduced by the Transparency Decree actually new?

The Transparency Decree mentions specific privacy requirements that mainly specify and repeat those already provided for in the GDPR, with some limited additions. In particular, under the Transparency Decree, if Automated Systems are being used, employers are obliged to:

1. Inform the data subjects about the Automated Systems used.

This means specifying what aspects of the employment relationship are affected; the purposes and aims of the Automated Systems; their logic and operation; the categories of data and main parameters used to program or train them, including performance evaluation mechanisms; the control measures taken, correction processes and the quality management system manager; the level of accuracy, robustness and cybersecurity and metrics used to measure these parameters and the potentially discriminatory impacts.

On this regard, as clarified by the Garante, the above information must be included in the privacy policy given to employees in accordance with Articles 13 and 14 GDPR and retained five years after termination of the employment relationship.

2. Supplement the information notice with the instructions to the employees on data security.

This requirement remains quite unclear, as the Garante has not provided additional clarifications. Indeed, in principle an information notice does not include instructions (which are rather contained in the appointment as “authorized person” under Art. 29 GDPR and possibly in the company’s policy on the use of IT tools).

3. Update the record of processing activity.

Unlike the Transparency Decree, Art. 30 GDPR does not mandate all data controllers to keep and update the record of processing activity (as it happens for companies with less than 250 employees, unless, for example, the processing may present a risk to the rights and freedoms of the data subjects). From a practical perspective, this should not be an issue: even though a case-by-case assessment is advisable, given that Automated Systems may put the rights and freedoms of workers under risk, a record is likely required. Moreover, the Garante clarified that data controllers are not required to inform data subjects when this record is updated.

4. Conduct a Data Protection Impact Assessment (DPIA) and consult with the Garante (if necessary).

This is also in line with Art. 35 GDPR, which requires a DPIA be carried out when the processing presents a high risk to the rights and freedoms of the data subjects. Indeed, the DPIA is mandatory e.g., in case of a systematic evaluation of personal aspects based on automated processing (including profiling) and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person. This also is consistent with the Garante’s list of processing activities which require a DPIA (in Italian), mentioning e.g. the processing of vulnerable individuals’ data (such as employees); the automated processing for decisions affecting data subjects, or the use of technological systems in the employment context.

5. Ensure the rights to access the data and to request additional information concerning the systems.

When such request is received, employers must respond in writing within 30 days. This obligation, including the timing for replying, clearly mirrors Art. 12 GDPR on data subject access requests.

Finally, the Garante clarified, among other things, that all other applicable GDPR provisions must be fulfilled. For example, first of all, employers must verify the existence of a proper legal basis before they can process personal data, such as the compliance with Law no. 300 of May 20, 1970 (Italian Workers Statute). Also, employers must comply with the general principles of personal data processing, including those of privacy by design and by default (e.g., by carrying out a risk analysis and disabling the systems’ functions that are not compatible with the purposes of the processing).

To sum up, what should employers do if they use Automated Systems?

While waiting for the Garante to issue further clarifications, employers should ensure their privacy organization is in line with current legislation by taking the following steps:

• Conduct a mapping of the Automated Systems used, to verify whether they fall under the Transparency Decree.
• If they do, integrate the privacy policy provided to employees and update the instructions to persons authorized to process personal data (as required by the Transparency Decree);
• In any case, verify the applicability of Article 22 GDPR and fulfill all other applicable obligations (as required by the GDPR and the Transparency Decree, if applicable), to be identified on a case-by-case basis.

Obviously, employers should due consider the other applicable laws, including labor laws (e.g., the Italian Workers’ Statute).

If you want to know more about this topic, see our Digital Breakfast @Dentons’ video on “The Transparency Decree between technology, privacy and labor law” (in Italian).

If you have any question, contact our team, and don’t forget to follow our Dentons’ TMT Bites!