The ongoing technological evolution, coupled with changing approaches to the monitoring and the protection of privacy, is beginning to create new complexities in the management of employment relationships. European and national legislation on Artificial Intelligence – more specifically EU Regulation 2024/1689 (and the Omnibus Package of simplifications) on one hand, and on the other hand Italian Law No. 132/2025 and its internal implementing decrees – introduces technical and organisational adaptation requirements and compliance rules that are necessarily intertwined with the provisions of GDPR (EU Regulation 2016/679) and also with the guidelines and measures issued by the national Italian Data Protection Authority (Garante Privacy).

In this context, whilst this complex regulatory framework has ultimately led the Italian Supreme Court to allow data collection through specific technical tools (such as through workplace access badges - as per the recent Italian Supreme Court ruling No. 7985/2026) - the Italian Data Protection Authority on the flip side appears to increasingly restrict the scope for the legitimate exercise of organisational powers within the companies.

Whilst it appears legitimate to restrict the use of tools designed to create forms of covert surveillance – particularly today when supplemented by applications involving AI technologies (...