The outbreak of Novel Coronavirus (COVID-19) has resulted in a worldwide pandemic. In Italy, where the outbreak of COVID-19 has been extremely severe, the Government implemented a number of emergency measures, including the closure of schools, universities, gyms, museums and clubs, in addition to more severe restrictions on business, commercial and leisure activities in the Italian territory.
Understandably, this may create great concern and unrest for you and amongst your workforce. Below we answer some key questions in order to clarify employers' legal obligations and also to support you in protecting your business and people.
From 23 February 2020 until now, almost 20 Prime Minister’s Decrees and almost 30 Law Decrees have been enacted on COVID-19 related matters. In addition, further decrees have been enacted by the Governors of each Italian Regions. As a consequence, COVID-19 legislation is extremely confused and misleading.
People living in Italy are subject to the obligation to wear face masks everywhere (including outside) and a curfew has been introduced from 10pm until 5am. Exceptions to such rule must be grounded (and self-certified under potential personal criminal liability) in business needs, matters of urgency, or health reasons.
In addition to the above, Italian territory is currently divided into 3 categories of risk:
Anyone who is infected by COVID-19 must stay isolated at home in the so-called "fiduciary quarantine". Violating such quarantine is deemed a crime under Italian Criminal law.
The Protocol on health and safety in the workplace enacted on 14 March 2020 (the "H&S Protocol") was slightly amended by the Cabinet and the Trade Unions on 24 April 2020 and is still applicable. Among other things, the new version of the protocol provides that companies in breach of health and safety regulations may be subject to an immediate suspension of their commercial licence.
As pointed out above, many Laws and Law Decrees have been enacted to impose restrictions on citizens but also to support companies forced to temporarily shut down operations. Amongst other provisions, the following have been extended/confirmed:
As mentioned above, the H&S Protocol provides that companies in breach of health and safety regulations may be subject to an immediate suspension of their commercial licence. As such, it is important the companies are aware of and take appropriate action in respect of their obligations arising from the COVID-19 pandemic.
In addition to the above, all employers have health and safety obligations to keep employees informed of the health risks that may arise in carrying out their duties and to ensure that working practices do not create undue risks to employees.
As such, employers should carry out risk assessments on an ongoing basis and consider any factors that may make employees particularly susceptible to infection. Employers should also consider circulating up-to-date information on good hygiene practices and provide any necessary equipment to facilitate this, such as hand sanitisers. For example, we recommend issuing a reminder on action employees can take to help stop viruses like coronavirus spreading. Such advice may include:
• Cover your mouth and nose with a tissue or your sleeve (not your hands) when you cough or sneeze;
• Put used tissues in the bin immediately;
• Wash your hands with soap and water often – use hand sanitiser gel if soap and water are not available; and
• Try to avoid close contact with people who are unwell.
We further recommend notifying employees where they can access more information if they are concerned.
Finally, from a health and safety perspective, employers should assess the existence of a specific biological risk related to COVID-19 (in coordination with the company physician and the Head of the Prevention and Protection Service (RSPP)). If such a risk exists, a Risk Assessment Document (DVR) must be updated and a specific prevention and protection plan must be implemented with the aim of eliminating (or at least reducing) the occurrence of dangerous situations, and possibly providing for individual protection measures.
It should also be noted that, pursuant to Art. 26 paragraph 3-bis of Legislative Decree No. 81/2008, in the case of service contracts involving contact between the provider and the principal's employees, a DUVRI (Interferential Risk Assessment Document) must be drafted. This applies even if the services are of an intellectual nature only, if there are risks arising from the presence of biological agents (such as infection from COVID-19).
The question of whether an employee can be asked to sign a declaration about where they have been, their exposure to the virus, or be required to provide information to an employer in order for the employer to provide confirmation to a customer sits firmly in the crossover between data privacy and employment.
Italian employers are under a duty to provide a safe and secure working environment under Legislative Decree No. 81/2008. The collection of such data may be necessary to protect the health, safety and welfare of other employees. Italian employees are subject to a more general obligation to comply with reasonable instructions or requests issued by their employer, and an employer may take further action (including disciplinary action) where an employee fails to do so. In principle, employers may therefore require an employee to confirm and specify where he/she has spent the past 15 days in order to assess the level of risk to the workforce. Employers may not, however, ask employees to confirm that they are not infected or request a medical certificate to the same effect.
In response to a request for clarification concerning the possibility of collecting data concerning employees' flu symptoms or recent travels, the Italian Data Protection Authority (DPA) issued an announcement on 2 March 2020 stating that employers "must refrain from collecting, a priori and in a systematic and generalized way, also through specific requests to employees or unauthorized investigations, information on the presence of any flu symptoms of the employee and his closest contacts or in any case falling within the non-working sphere". The Italian DPA clarified that such investigations are reserved for the competent authorities.
However, according to the Protocol on health and safety enacted on 14 March 2020, companies must inform employees and third parties entering the corporate premises of the rules provided by the Public Authorities by delivering and/or posting a specific COVID-19 notice at the entrance of the premises. In particular, this notice must contain the following information:
Employees can also be subject to a temperature check before entering the premises (as noted above, this is a legal obligation for employers in the Lombardy Region). In view of the last note enacted by the Italian DPA mentioned above, body temperature can be measured subject to the following restrictions:
In addition, if an employee is denied access to the premises, their right to privacy and dignity must be ensured.
If an employee’s temperature is higher than 37.5 C° access to the workplace must be denied. In such cases, the employee’s right to privacy and dignity must be ensured. A person with flu symptoms must promptly contact his/her physician and stick to the relevant prescriptions.
Employers may also face situations where a customer/client requires travel or health information relating to their employees when visiting the customer/client's site.
In these circumstances, the customer/client may collect such information autonomously (i.e. without involving the employer) from the employees visiting his site in compliance with its GDPR obligations. Customers/clients are therefore required to provide a privacy policy providing information on the features of processing and the lawful basis for such processing (e.g. consent, or other basis under section 9 GDPR). This information should not be communicated between the employer and the customer/client, as such communications would not be considered proportionate.
Further to the above, the position regarding European data privacy rules and how they impact information relating to COVID-19 is developing. A number of EU governments have issued further guidance (including Italy, as set out above) and more still are considering whether emergency legislation may be required, particularly if the situation escalates. The position will need to be kept under review as the situation evolves and further guidance becomes available.
Infected employees
If an employee is infected with COVID-19, the employer must contact the competent Health Authority (Authority). Each Italian Region has a dedicated hotline. There is currently no specific requirement for employees to inform staff representatives, the whole workforce or customers. However, it is recommended that the premises be cleaned and sanitised according to the Authorities instructions. It is also recommended that employers inform clients or third parties who have been in contact with infected employees. The Authorities will provide more information on this where relevant.
Infected employees will be indemnified under regular sick leave provisions (which will be paid by the employer but offset by the National Social Security Agency).
Potentially Infected employees
Employers should immediately inform the public authorities about the identity of possible exposed or infected employees. The Authorities will then take relevant measures.
Quarantined employees
If an employee is in quarantine without symptoms (but with a medical certificate confirming the risk of infection) they must be considered to be on sick leave.
Last reviewed: 22 January 2021