Italy: Technology, authorities, workplace… permanent state of revolution

Italian data authority restricts email metadata retention to 21 days, highlighting regulatory challenges with workplace technology under GDPR principles

The Key Points: The Italian Data Protection Authority has restricted email metadata retention to 21 days, arguing that information like sender details, subject lines, and timestamps constitute personal data subject to GDPR minimisation requirements. This represents part of a broader regulatory shift where European lawmakers have moved from giving technical directions to placing accountability on individual companies and employers to regulate their own systems appropriately. The ruling affects standard business practices like maintaining company email accounts, tracking correspondence, and backing up company data that most employers conduct without realising they may breach privacy requirements. 

Why This Matters: This decision exemplifies the growing disconnect between regulatory expectations and realistic day-to-day workplace operations across Europe. Since GDPR, multiple pieces of legislation including the Data Act, AI Act, and transparent working conditions rules have created complex compliance environments that directly engage with workplace technology. The email metadata ruling demonstrates how routine business activities can suddenly become compliance issues, with potential implications for litigation, industrial relations, and workplace negotiations. 

What Might Happen Next: Similar regulatory interpretations could emerge across other EU jurisdictions as data protection authorities apply GDPR principles to common workplace technologies. The gap between regulation and reality is likely to widen across areas like AI use, transnational data transfers, and matrix organisations operating across different jurisdictions. Companies may face increased scrutiny of their technology practices and data retention policies. 

This issue will be discussed at our meeting in Milan on November 20th 

It is kindly hosted by Toffoletto De Luca at their offices on Via Rovello. We anticipate some lively discussions, the other item on that agenda is: Lost in the dismissal maze: How three reforms, two decisions and a great confusion are testing Italian unfair dismissal law   --     Book Now