Italy: Closed Consultation on Data Protection Authority inquiry into Metadata Retention Period

On 15 April 2024, the Italian Data Protection Authority (DPA) closed its public consultation on the appropriateness of the retention period for metadata of employees' e-mail service accounts. It refers to compliance with the EU General Data Protection Regulation (GDPR) and the Italian Data Protection Act in the context of processing personal data in the workplace, in particular with regard to the risk of collecting metadata through email management programs. The consultation is open to public and private employers, data protection experts, and all stakeholders. It aims to clarify the forms and methods of use that would require retaining metadata for longer than the initially proposed period of 7 days, which can be extended by 48 hours for proven needs.