Employee monitoring and Article 4 of the Italian Workers’ Statute: what changes when the work is photographed

What Article 4 of the Workers’ Statute actually says

Article 4 of Law 300/1970 was rewritten by Article 23 of Legislative Decree 151/2015 (d.lgs. 151/2015), one of the Jobs Act decrees. People who quote it from memory recall the 1970 version — “remote monitoring is prohibited” — and miss the point. Today it has three paragraphs (commi), and they have to be read together.

Paragraph 1, the procedure. Audiovisual installations and other tools from which the possibility of remotely monitoring workers’ activity also derives may be used only for organisational and production needs, workplace safety or the protection of company assets, and only after an agreement with the trade union representatives or, failing that, authorisation from the Labour Inspectorate (Ispettorato del lavoro). It isn’t a ban: it’s a process to complete before you switch anything on. And the key word is that “also”: the tool doesn’t need to have been built for monitoring.

Paragraph 2, the exception. The procedure does not apply to tools used by the worker to perform their work, nor to those that record access and attendance. The badge, the company phone, the computer: no agreement, no application.

Paragraph 3, the condition that makes the data usable. The information gathered under paragraphs 1 and 2 may be used for all purposes connected with the employment relationship on condition that the worker is given adequate information on how the tools are used and how checks are carried out, and in compliance with personal data protection law.

Paragraph 3 is the one almost nobody mentions, and in practice it matters most: falling within the paragraph 2 exception is not enough. Without a notice and without GDPR compliance, that data cannot be used — not “at some risk”: it cannot be used. That becomes very real the day you need it for a disciplinary charge, or to defend yourself against one.

Does a tool that photographs finished work count as a “work tool”?

It can, but it isn’t automatic. The argument for is in how it’s used: the worker opens the app to see what needs checking, takes the photo, and reads straight away what to fix — before anyone else comes round. It’s the gauge they finish the job with, like a jig or a calliper. The argument against is in the purpose: if the photos only serve whoever inspects afterwards, and nothing comes back to the worker, the tool looks more like a check than a piece of kit. Where your case falls is for your employment consultant to say, not for whoever sells you the software.

Either way, the exception covers the tool as it is actually built, not what it’s called: it holds as long as the features serve the work. Add features whose only purpose is to keep watch, and the same software falls back under paragraph 1. Typical examples:

• device location: knowing where someone is minute by minute doesn’t help anyone do a job well;
• counting idle time, which measures behaviour, not work;
• individual productivity rankings, which turn a record of work done into a permanent appraisal;
• automatic alerts about a single person — “X is seven minutes late” — which is systematic surveillance of an individual.

The question to ask, feature by feature, is a blunt one: does it help people do the work, or does it watch the people doing it?

Where a photo of the work comes in

Very directly, and it’s worth saying plainly. For every photo, Precisino records:

• which job was photographed, and when: the date and time of the photo;
• under which label: the station’s name or, if the station asks for it, the name typed by the person taking the photo;
• the photograph itself, which shows the work, not the person;
• the verdict, item by item: what looks good, what needs fixing, what can’t be seen;
• whether the person coordinating the work confirmed or disputed that verdict, and the note they left.

It looks like data about a part, a room or an electrical panel. It becomes a worker’s personal data as soon as the label leads to a person — a name, or a station where only one person works that shift — because it describes how their work went. The fact that the sentence is about “the gearbox on line 2” changes nothing: if there’s a name next to it, the data is theirs.

Why it’s recorded matters too, because the stated purposes underpin everything else. There are usually two: getting the job right — the person doing it sees straight away what to fix — and documenting how it was, for the customer, the contracting client or whoever comes to inspect. Neither is “measuring people” — and that’s what lets you tell anyone exactly what the log is for.

Controller and processor: who is which (Article 28 GDPR)

The data controller is the employer. The employer decides why and how the data is processed, and has to give the notice, keep the record of processing activities, respond to workers who exercise their rights and, where needed, follow the paragraph 1 procedure. None of this can be delegated to the software supplier.

The software supplier is the data processor under Article 28 GDPR: it processes that data on the controller’s behalf and only on documented instructions. The relationship has to be put in writing and must state at least the subject matter and duration, the types of data, the security measures, the sub-processors and what happens to the data at the end.

Four questions to ask any supplier before you sign:

1. Do you provide the Article 28 processor appointment, or do I have to draft it myself?
2. Where is the data held, and if it leaves the European Union, under what safeguard?
3. Who are your sub-processors, one by one, and what does each of them do?
4. Can your technicians read my data? In which cases, and is there a record of it?

For Precisino the answers are public, in the privacy policy: infrastructure in a European region, the list of providers appointed as processors and why each one is there, and the rule on end customers’ data — there isn’t even a field for it.

The notice to workers: what it must say

The notice under Article 4 paragraph 3 is not the one handed over at hiring: it must say two very specific extra things — how the tool is used and how checks are carried out. A text that lists purposes and legal bases but doesn’t explain that every photo stays on record with its time and the label of whoever took it, and that the person coordinating the work reads that log, does not meet the obligation.

An adequate notice covers:

• who the controller is, and who to write to in order to exercise your rights;
• which data is recorded and where it comes from — not “data relating to work activity”, but the list: the photo, the time it was taken, the label of whoever took it, the verdict item by item, and whether the coordinator confirmed or disputed it;
• which data is NOT recorded: location, private communications, browsing outside the app, photographs of people. It’s the part people really want to know about;
• the purpose and the legal basis of each;
• who sees what, ideally in a table;
• how and when checks are made, and that there is no real-time monitoring of any single person;
• how long individual data is kept, and the rights under Articles 15–22 GDPR, including the right to complain to the Garante, the Italian Data Protection Authority.

Two points that head off the most common mistakes. The notice is not consent: the processing rests on performance of the contract, not on the worker’s consent, which in an unequal relationship would not be freely given. What you collect is a dated acknowledgement of receipt, and nobody who refuses to sign loses the tool they need to do their job. And it’s handed over before you switch on: data gathered in the weeks before remains unusable.

The notice is written by your employment consultant, about your company: there is no template that fits everyone. What Precisino can give you is the part we know — the exact list of what the service records and what it doesn’t, item by item, with where each piece of data comes from. It’s a serious starting point, not a document to photocopy. Anyone who hands you a text saying “all done, just sign it” would be doing you harm.

How the product is built not to be a tracking wristband

Safeguards that rely on goodwill last as long as the goodwill does: only the ones built into the product hold. Here’s the actual list, no adjectives:

• No geolocation. Precisino never asks the worker’s phone for its location — not continuously, and not when the photo is taken. The place in the log is the job that was photographed — the line, the room, the installation: data about the assignment, not about the person.
• No rankings of people. There is no screen that sorts workers by output, speed or number of failed checks. It isn’t a setting: that view doesn’t exist.
• No timings and no piecework. A photo is recorded with its time, not with how long the job took: there is no stopwatch, and nowhere to set pay by the piece.
• No personal data about end customers. There is no field to enter it: whatever is sent along with the photo is up to whoever calls the service, and it stays theirs.
• Photos of work, places and equipment, never of people. An assembled part, a room, a panel: photographing people is not part of the service, and workers are asked not to.
• A name only if you decide so. A station can sign its photos with its own name — “Line 2” — or ask whoever takes the photo for theirs: you choose when you create it.
• Tight scopes. An API key only sees the jobs that carry its tags, and the verdicts on those. Anything out of scope doesn’t even appear to exist.

None of this is a boast: it’s the minimum for an operations tool to stay an operations tool. But it needs saying, because the question people ask themselves on day one — “are they watching me now?” — deserves an answer they can check, not reassurance.

Can the data be used for disciplinary purposes?

In principle, yes: paragraph 3 says “for all purposes connected with the employment relationship”. But “in principle” carries weight, and the conditions are cumulative — every one of them must be met.

• The notice must have been handed over beforehand, and must also say how checks are carried out.
• Minimisation and proportionality apply: you look at what the case requires, you don’t comb through a person’s whole history.
• The guarantees of Article 7 of the Statute (the disciplinary procedure) and those of the collective agreement still apply. A figure in a table is not a disciplinary procedure.
• Systematic and continuous surveillance of a single person is not allowed.

And one point that isn’t legal, and is perhaps the most useful: this data says less than it seems to. A “needs fixing” on a photo could mean carelessness, or a part that arrived already defective, or a badly taken photo, or a photo check that got it wrong. The verdict can’t tell you which, and anyone who treats it as proof on its own is leaving themselves exposed.

The employer’s checklist, in the right order

Order matters: almost every mistake comes from switching the tool on before the first five steps are done.

1. Write down what you need it for, two lines per purpose: everything else rests on those lines.
2. Classify the tool with your employment consultant: paragraph 2 or paragraph 1? If there are surveillance features, switch them off.
3. If paragraph 1 applies, do it first: an agreement with the company’s trade union representatives, or an application to the competent local office of the Labour Inspectorate.
4. Update the record of processing activities (Article 30) and ask your privacy adviser whether an impact assessment is needed (Article 35).
5. Sign the processor appointment, with the list of sub-processors and where the data is stored.
6. Write and hand over the notice, with a dated acknowledgement of receipt. If the team speaks more than one language, hand it over in those languages.
7. Set it up to match: tight scopes — every API key and every station sees only the jobs it needs. What the notice says has to match how the tool is actually configured.
8. Set retention periods for the individual detail: “for ever” is not a retention period.
9. Talk to the team before you switch on: ten minutes do more than any document.
10. Review it when the features change: every new feature reopens the question in step 2.

Information, not advice: what to ask your consultant

To repeat what we said at the top, because it’s the most important thing on this page: this text is not a legal opinion and does not replace your employment consultant. How a tool is classified under Article 4 depends on the way you work, on the collective agreement, on whether there are trade union representatives and on the features you switch on. Things we don’t know.

If you take just one page to your consultant, make it these four questions:

1. With the features I use, do I fall under paragraph 2, or do I need an agreement or an authorisation?
2. Does my notice say enough about how the tool is used and how checks are made?
3. How long may I keep the individual detail of each photo?
4. On what conditions may I use this data in a disciplinary procedure?

One last thing, from people who make this kind of software. The workplaces where these tools work aren’t the ones that hid the monitoring best: they’re the ones where people understood that the log is there for them too — to show that the part was right when it left their station, that the room was in order when they left it, that the defect came later. An honest log protects both sides, and that’s the only way it lasts. A good example is the safety officer’s photo log, where the temptation to put people in the frame is at its strongest and the rule says the opposite.