On 10 March 2007, the Garante, Italy’s data protection authority, issued a guidance paper which attempts to

assist employers to overcome some of the hurdles and to allow monitoring in a way that satisfies the requirements of the EU[1] Directive[2] as implemented in Italy[3]. The paper contains a legally binding interpretation of the statutory requirements for monitoring in the workplace. Unfortunately, however, the paper resolves only some of the problems that global organisations are facing. It fails to address the question of whether fulfilling an extra-territorial legal obligation, such as responding to a discovery request under US rules, may legitimise monitoring.

The main provisions of the paper are highlighted below and show how employers can mitigate the risks.