Thanks to Tabita Costantino for collaborating on this
article
On December 21, 2023, the Italian Data Protection Authority
(Garante per la protezione dei dati personali, hereinafter
the "Garante") issued the guidelines
titled "Email management computer programs and services in
the work context and metadata processing" published on
February 6, 2024.
On February 27, however, the Garante temporarily suspended the
effectiveness of the guidelines, and launched a public consultation
on the appropriateness of the retention period of employees'
metadata emails, as indicated in the Guidelines.
Previously the Garante conducted inspections regarding the
processing of personal data in the workplace, and that highlighted
the risk that third party cloud email management services could
collect metadata (such as day, timing,
sender, subject, and email size) from
employee email accounts in a preemptive and generalized way.
Additionally, the Garante found that these providers
