Italian Data Protection Authority: if the employee is undeclared, personal data disclosed to the undeclared employee are automatically processed unlawfully.

An important measure by the Italian Data Protection Authority, which in its order-injunction 243/2024 affirmed a principle with a significant practical impact: the irregularity of the employment relationship corresponds to the violation of privacy. In fact, if a worker is irregular, he is not part of the organisational structure of the data controller and is not entitled to process personal data as an authorised processor. The irregular worker is even a third party to whom the data are unduly communicated.

Thus, in addition to labour sanctions, undeclared work is also likely to result in sanctions for violation of data protection law.