Italy: Announced Data Protection Authority inquiry into Metadata Retention Period

On 22 February 2024, the Italian Data Protection Authority (DPA) announced its inquiry on the appropriateness of the retention period for metadata of employees' email service accounts. It refers to compliance with the EU General Data Protection Regulation (GDPR) and the Italian Data Protection Act in the context of processing personal data in the workplace, in particular with regard to the risk of collecting metadata through email management programs. The consultation is open to public and private employers, data protection experts, and all stakeholders. It aims to clarify the forms and methods of use that would require retaining metadata for longer than the initially proposed period of 7 days, which can be extended by 48 hours for proven needs.