Is Using Social Media a Lawful Way to Check Your Employee’s History?

In Italy, the issue is very complex: in fact, we need to find a link between European regulations, national ones, and the provisions that the social partners have included in collective agreements. A possible solution roots back in the 1970s, i.e., in Article 8 of Law 300/1970: the processing of personal data prior to recruitment is legitimate, in so far as it is relevant for assessing the candidate’s professional aptitude.

What are the background checks? What issues can arise, relative to the use of this information?

Background checks are usually made at the pre-recruitment stage and are aimed at identifying elements of the candidate’s personal history that may indicate a risk in relation to the future employment relationship. The checks that HR usually require to be carried out relate to the candidate’s previous work experience, former employers’ references, school or academic certificates, credit exposure, residences and transfers, pending loads, and court records.

Data of this kind can be acquired directly by the candidate (such as data contained in CVs, referred to in interviews, self-declarations), by certifications of the Public Administration, but also by third parties (think of a request made to the previous employer) and, finally, as it is increasingly happening, through the Internet and Social Media.

In general, the answer is yes: you can do background checks on a candidate.

The main issues – in the collection and in the use of these reports – are given by the fact that all the information regarding the candidate, as such, are personal data: consequently, they shall be processed in accordance with and within the limits of the discipline of Regulation (EU) 679/2016, the GDPR.

Moreover, as far as Italy is concerned, the use of this information is further limited by labour law rules, which, since the 1970s, have reduced the possibility of investigating about an employee for the sake of privacy and to avoid discriminatory behaviour by the employer.

So, in essence, is it legitimate to process this personal data? To what extent?

In general, the answer is yes: you can do background checks on a candidate.

However, limits are imposed by both data protection and labour law rules.

First of all, the processing shall comply with the provisions of the GDPR and, most importantly, with its principles, especially the principles of minimization, accuracy and purpose limitation. Except as explained below, background checks are “simple” personal data which, following adequate information, may be lawfully processed on the basis of one of the legal bases set out in Article 6, paragraph 1 of the GDPR.

It is not advisable to process such personal data on the basis of the candidate’s sheer consent, since on the one hand, the consent can be revoked

This means that once the candidate has been informed of the scope of the background check (and, therefore, of what personal data will be processed and from which source they will be obtained), the processing of this data will be lawful to the extent that the employer is able to justify – in accordance with the principle of accountability – what makes the data processing necessary (whether the conclusion of the contract or a legitimate interest).

It is not advisable to process such personal data on the basis of the candidate’s sheer consent, since on the one hand, the consent can be revoked, and, on the other hand, opinion # 2/2017 of WP29 expressed serious concerns about the genuineness of the consent given in the context of the employment relationship (given that the possibility of suffering repercussions would hardly allow the worker to deny his/her consent to the employer).

Having synthesized in essence the data protection-related discipline, as regards pre-hiring investigations it is to be noted that in the Italian labour law system too, there are provisions that closely follow the aforesaid GDPR principles.

In particular, I would mention the provisions of Article 8 of Law # 300/1970 (the so-called Workers’ Statute) and Article 10 of Legislative Decree # 276/2003 (the so-called Biagi Law).

The first rule, which dates back to the early 1970s, prohibits employers from investigating the worker’s religious, trade union and political opinions, as well as circumstances that are not relevant to assessing his/her professional aptitude, both when he/she is hired and during the course of the relationship.

The real difficulty of this operation lies in the selection of the relevant information for every position and in the possibility of justifying this selection, also considering we have seen and still see significant fluctuations in Italian jurisprudence.

The 2003 legislation (which mainly concerns employment agencies) reaffirms and enriches the principle laid down in Article 8 of Law # 300/1970, also specifying that the prohibition may not be overcome even in case the worker provides his/her consent.

In summary, if in the field of privacy the processing shall be limited to the minimum necessary with respect to the purposes legitimately pursued, in the field of employment law the collection of information on the candidate is allowed to the extent that it is relevant in order to proceed with the recruitment: in both cases, therefore, the guiding criterion is that of relevance.

The real difficulty of this operation lies in the selection of the relevant information for every position and in the possibility of justifying this selection, also considering we have seen and still see significant fluctuations in Italian jurisprudence.

The criterion between lawful and unlawful, on the other hand, will still concern the relevance or otherwise of the data processed for the purposes of assessing the worker’s professional aptitude.

What about the personal data published on social media?

While it is relatively easy to comply with the information notice obligation when it comes to personal data relevant to the employment relationship and provided directly by the person concerned (such as those contained in the CV or reported spontaneously in the interview), the discussion becomes more complicated when the source of the information is a third party or, as it increasingly happens, the personal data is already easily available on the Internet or on social media.

Obviously, there is no standard answer and, in practice, it will depend on the type of datum, its position, and of social medium from time to time. However, there is one certainty: the fact that the data is substantially public and easily accessible is not sufficient to exclude the application of the GDPR. On the contrary, this circumstance only strengthens the information notice obligation: in the case of processing of personal data acquired from sources other than the person concerned, the latter shall be provided with complete information about the nature of these data and the source from which they are taken (possibly public) anyway.

For example, WP29 (in its opinion # 2/2017) refers to an employer who, after the employment relationship has ended, monitors the LinkedIn profile of a former employee bound by a non-competition agreement: in this case, the legal basis is the legitimate interest of the employer in verifying the employee’s compliance with this agreement.

The criterion between lawful and unlawful, on the other hand, will still concern the relevance or otherwise of the data processed for the purposes of assessing the worker’s professional aptitude.

Employers are obliged to comply with the provisions of Article 8 of Law # 300/19

What if the background check is about the candidate’s criminal record or judicial background? Are there any national regulations coming to the forefront?

The background checks that trigger the greatest risk exposure are certainly those related to the criminal data of the employee or candidate that is, his/her criminal record and his/her certificate of pending charges.

We know that the GDPR foresees that the processing of personal data relating to criminal conviction and offences has to fulfil a double condition of lawfulness, that is, on the one hand, the operation of one of the legal bases under Article 6 of the GDPR (consent, legitimate interest, execution of the contract…) and, on the other, the presence of an internal or European law provision which grant appropriate guarantees for the rights and freedoms of the data subjects.

With regard to internal regulations, the legislative decree that updated the Privacy Code (Legislative Decree no. 196/2003) introduced art. 2 octies, containing “principles governing the processing of data relating to criminal convictions and offences”. Here, the Legislator has identified a series of hypotheses for the processing of judicial data that are abstractly possible, among which the employment-related case: however, it was also specified that, in order to define the appropriate instruments to ensure appropriate guarantees for the rights and freedoms of the data subjects, a special ministerial decree will be issued. At present, almost 10 months after the introduction of art. 2 octies, this decree has not been published yet.

It should not be forgotten that article 8 is a provision contained in the Workers’ Statute, a regulation that next year will be exactly 50 years old and still fundamental in the Italian legal system.

In the absence of a specific provision to this effect, many authors had initially thought to remedy this considering that the processing of judicial data could be legitimate in cases where it was provided for by a rule of the collective agreement applicable in the relevant industry (also in relation to article 88 of the GDPR and recital 155): for example, rules with this content are laid down in NCLAs for workers in the Industrial Engineering, Credit, Postal Services and Railway Mobility sectors.

However, by measure no. 314 of 22nd May 2018, the Authority for the Protection of Personal Data excluded this possibility: in particular, it censured the conduct of a company that processed this type of data in application of the specific provision of the CCNL Metalmeccanici (National Collective Labour Agreement for Metalworkers), since the provision was deemed too general and in any case lacking those security measures required by article 10 of the GDPR.

It’s an impasse situation with no way out, then.

One way out of the impasse is to consider the already mentioned Articles 8 of Law # 300/1970 and 10 of Legislative Decree # 276/2003 in terms of a “Member State law providing for appropriate safeguards for the rights and freedoms of data subject“.

In this almost half-century of validity, the rule has remained unchanged only on paper: the jurisprudence has gradually clarified, enriched and contextualized the sheer wording of the law

Employers are obliged to comply with the provisions of Article 8 of Law # 300/19: conduct; contrary to this rule, on the one hand, it represents a type of offence that can be punished by a penalty ranging from € 155 to € 1549 or arrest from 15 days to one year and, on the other hand, may constitute the basis for claims for compensation at Court by the worker.

It should not be forgotten that article 8 is a provision contained in the Workers’ Statute, a regulation that next year will be exactly 50 years old and still fundamental in the Italian legal system.

In this almost half-century of validity, the rule has remained unchanged only on paper: the jurisprudence has gradually clarified, enriched and contextualized the sheer wording of the law, so much so that, to date, article 8 – as interpreted by living law – is absolutely appropriate to legitimize the processing of data under Article 10 – and even Article 9 – of the GDPR.

The Court of Cassation, moreover, has repeatedly acknowledged the importance that judicial data have for the assessment of the candidate’s or worker’s working aptitude, thus admitting the existence of a legitimate interest of the employer or even stating the need for it for the purposes of carrying out the employment relationship.

Furthermore, the jurisprudence of the Court has practically combined Article 8 of Law # 300/1970 with the provisions of the National Collective Labour Agreements in the context of the delivery of the criminal record at the time of recruitment, identifying the hypotheses envisaged by the social partners as cases of express relevance of the candidate’s judicial data for the purpose of assessing his professional aptitude.

It should be noted, however, that with regard to the delivery of the certificate of criminal records – that is to say, a document which does not give evidence of final convictions but only of pending proceedings – some judgments have stated this requirement illegitimate because it is contrary to the constitutional principles of the presumption of innocence and the right to employment.

What are the consequences in the event of unlawful use of relevant information pursuant to Article 8 of Law # 300/1970?

On this aspect, it is necessary to make a premise: even if the Judge was to ascertain that the failure to establish the relationship was due to information acquired contrary to Article 8 of Law # 300/1970, the employment contract could not be executed ipso iure, since it implies a so-called infungibile facere (a discipline similar to the French astrainte introduced in 2015 in art. 614 bis of the Code of Civil Procedure is inapplicable to employment relationships). Therefore, the consequence of such conduct is, as a rule, damage compensation.

A famous case in Italy of this rule was dealt with by the Court of Turin in relation to the failure to hire a worker for discriminatory reasons (evidence of this circumstance had been provided – as allowed by national law – through the use of statistical tools and, in particular, the absolute disproportion between the number of foreign people employed in the company compared to national standards, etc.). The Judges, having established that the failure to recruit was due to racial reasons, in fact, used as a parameter of compensation the indemnity referred to in Article 18 of Law # 300/1970, that is to say, the indemnity guaranteed to the worker unlawfully dismissed.

Luca Daffra and Marco Marzano

Ichino Brugnatelli e Associati