Some data is riskier for people, because it can lead to discrimination or serious harm. The GDPR and the Codice protect it more strongly.
Special categories of data (Article 9 GDPR)
This is data revealing:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade-union membership;
and also genetic data, biometric data used to identify a person uniquely (for example a fingerprint or face recognition), data concerning health and sex life or sexual orientation.
Processing is prohibited in principle, unless one of the exceptions in Article 9(2) applies: for example explicit consent, obligations under employment and social-security law, the protection of health, the establishment of a legal claim. The Codice adds conditions and safeguards (Articles 2-sexies and 2-septies).
Health at work
Health data includes, for example, diagnoses, test results, sick notes stating the illness, disability. As a rule the employer needs to know that a person is absent and until when, not what they are suffering from. If you work in an HR office or in a healthcare organisation, handle this data only if it is your task, in places where others cannot see or hear, and do not discuss it with colleagues.
The company doctor (medico competente) belongs to a separate system: their health records remain under their professional secrecy and do not go to the employer, who receives only the opinion on fitness for the job.
The ban on inquiries into opinions
Article 8 of the Statuto dei lavoratori (Workers' Statute, Law 300/1970) forbids the employer, for hiring and during the employment, to make inquiries into the worker's political, religious or trade-union opinions and into facts that are not relevant to assessing professional aptitude. The Codice repeats the ban in Article 113. A selection interview or an internal questionnaire must therefore not ask for this data.
Data on criminal convictions and offences
Data relating to criminal convictions and offences has a rule of its own (Article 10 GDPR). In Italy processing is allowed only if authorised by a provision of law or, in cases provided for by law, of regulation, with suitable safeguards for people (Article 2-octies of the Codice). It is therefore not lawful to ask a candidate or customer for a criminal record certificate or a certificate of pending proceedings just "to be safe": a provision or a situation provided for by law is needed.
The codice fiscale
The codice fiscale (tax code) is not "special" data, but it is a very powerful piece of personal data, because it identifies a person precisely and allows different databases to be linked. Some precautions:
- Ask for it and record it only if it is needed for the purpose (invoices, payroll, paperwork) and not for a simple enquiry at the counter.
- Do not write it in the subject line of an e-mail, in an open chat or on a sheet visible to others.
- Do not publish it in lists, noticeboards or rankings open to anyone, together with other data, unless a rule requires it or there is a real reason.
- The same goes for the health card (tessera sanitaria), the identity document and the IBAN: copies and photographs of documents should be kept only if necessary and must be protected.
To remember
- Data on health, trade-union membership, religion, origin and the like: maximum care, only those who must, only what is necessary.
- At work, no inquiries into opinions and private life (Article 8 of the Statuto).
- For convictions and offences a legal provision is needed (Article 2-octies).
- The codice fiscale is personal data: it should not go everywhere.