LEGAL NEWS IN THE SPOTLIGHT | Italian DPA issues guidelines on the processing of corporate email metadata

On 6 June 2024, the Italian Data Protection Authority (DPA) adopted the final version of the position paper on email management programs and services in the workplace and on the processing of the associated metadata (the “Position Paper”). The Position Paper targets IT service providers and employers, with the aim of setting guidelines for the management of email metadata processing. The initial draft of the Position Paper underwent public consultation due to significant stakeholder inquiries (see our contribution here). In response, the DPA has clarified several ambiguities from the first version. Notably, the DPA clarified the scope of the document and the definition of “metadata”, limiting it to logs essential for transmitting electronic communications. Additionally, the DPA extended the recommended retention period for storing logs to 21 days, emphasising that the storage and processing of metadata should only be performed to ensure the functionality of the email client systems.

Newsletter n. 97 – June 2024