Every day you handle information about people: customers, colleagues, patients, suppliers, candidates. This lesson explains what personal data is, who has which duties and why you receive instructions on how to handle it.
What personal data is
Personal data is any information relating to an identified or identifiable natural person (Article 4(1) of Regulation (EU) 2016/679, the GDPR). It is enough that a person can be traced, even indirectly.
Examples: first and last name, address, telephone, e-mail, codice fiscale (the Italian tax code), vehicle registration number, photo, voice, staff number, IP address, payslips, assessments of a team member.
Truly anonymous information and information about businesses as such are not personal data. The name of an employee that appears in a company's records, however, is personal data.
What processing is
Processing is any operation on data: collecting, recording, consulting, changing, copying, sending, storing, deleting. Even just looking at a record on a screen is processing. That is why the rules apply to practically every office, shop, care or service job.
Who is who
- Data subject: the person the data relates to. You are one too, for the data your employer processes about you.
- Controller: whoever decides why and how data is processed. Usually this is the company, body or practice you work for, not the individual employee. The controller is answerable for compliance with the rules.
- Processor: an outside party that processes data on the controller's behalf, for example the employment consultant, the supplier of the management software or the payroll service. It works under a contract or other legal act (Article 28 GDPR).
- Authorised / designated persons: people who, like you, process data under the controller's authority and on its instructions.
- Data protection officer (DPO; in Italian RPD): an expert who monitors and advises, appointed in the cases set out in Articles 37–39 GDPR. Not every company has to have one.
- Garante per la protezione dei dati personali: the independent Italian authority that supervises the application of the rules.
The rules to know
In Italy two sources apply together:
- the GDPR, directly applicable throughout the European Union;
- the Codice in materia di protezione dei dati personali (Legislative Decree 196/2003, the Italian Personal Data Protection Code, or Codice privacy), amended by Legislative Decree 101/2018 to bring it into line with the GDPR.
The Codice contains Italian rules on matters such as the age of consent for minors (Article 2-quinquies), data on convictions and offences (Article 2-octies), employment and remote monitoring (Articles 111-bis–115) and offences (Articles 167 and following).
Why you receive instructions
Article 29 GDPR says that anyone with access to personal data under the controller's authority may not process it unless instructed to do so by the controller. Article 2-quaterdecies of the Codice allows the controller to assign tasks and functions to expressly designated people and to choose the most suitable way of authorising them to process data.
In practice this means your employer must tell you, preferably in writing, which data you may use, for which tasks and with which precautions. This course does not replace those instructions: it explains the general rules, but the procedures of your office are for your employer to set out.
What to remember
- Personal data is any information about an identifiable person.
- Processing also includes consulting and storing.
- The controller is the organisation, not you; you follow the instructions you are given.
- If you do not know how to act, ask your manager or the privacy contact before doing anything.