The monitoring of company tools by the employer is a delicate issue.

This article will explore the role of the private investigator in relation to the topic, taking into account the legal and privacy implications that such activity entails.

In the context of law, the employer can monitor the company tools assigned to employees only for "organizational and productive needs, for work safety and for the protection of company assets" (art. 4 Workers' Statute).

"Company work tools" are defined as the devices and, more generally, the tools provided by a company to its employee to enable them to adequately perform the assigned tasks.

Those control activities on the individual employee are considered legitimate when there is a reasonable suspicion regarding possible unlawful behavior, such as unauthorized access to computer systems, possession or download of inappropriate material or disclosure of confidential information, access to child pornography sites, sending emails with intimidating content, any behavior sanctioned by Legislative Decree 231/2001 (administrative liability of the Entity), etc...

There are, however, some limits that must be respected by the employer implementing such controls:

  • the research must be aimed at verifying unlawful behavior by the individual;
  • there must be a well-founded suspicion regarding unlawful behavior and the control must be carried out exclusively ex post, as it cannot be conducted for preventive purposes;
  • the control must have a limited duration and the acquired data must be stored only for the necessary time, without being disseminated in any way;
  • there must be a balance between corporate protection and respect for the dignity and privacy of the worker. It is essential that the employee is informed in advance of the employer's ability to implement control over the provided tools, through the drafting of a regulation, which must be signed and known by the employee from the moment the tools are assigned.

The employer can make use of a private investigator, that is, a suitably trained professional, in full compliance with the law and the employee's privacy so that they can carry out a digital forensics activity, in accordance with international best practices, which includes:

  • the duplication of data through forensic copy;
  • the analysis of data of interest for the search for elements and evidence, related to the offense possibly committed by the employee;
  • the drafting of the investigative report reproducible in court.

The activity of digital forensics requires specific skills and knowledge that allow operating correctly, ensuring the authenticity of what is collected and analyzed, and full compliance with laws and employee privacy.

The AIRO Institute of Private Investigations, utilizing specialists in digital forensics, offers companies its professionalism and expertise in the field of computer investigations.

Contact us