The Court of Cassation, with Judgment No. 28365/2025, has established that the employer's monitoring of the company PC used by the employee is legitimate when there are concrete needs for protection of company assets. The measure arises from a case concerning unauthorized access to IT systems and external disclosure of confidential data.

The Court of Cassation confirmed the validity of the evidence collected by the company and the legitimacy of the dismissal for just cause.

The key principle of the ruling: protection of corporate assets

The Court emphasizes that the employer has the right and duty to:
• protect company assets
• prevent cyber crimes and disclosure of sensitive data
• take disciplinary measures in case of fraudulent conduct

When the control is aimed at the protection of assets and not at monitoring work performance, it can be carried out even without a union agreement, provided that privacy regulations are respected.

Internal policy and preventive information: decisive elements

In the case decided by the Supreme Court, the company had adopted:
• a clear policy on the use of IT tools
• information to employees about the possibility of checks in case of anomalies

The Supreme Court believes that this transparency constitutes a correct balance between defensive control and the right to privacy: the worker cannot claim an expectation of absolute privacy on tools assigned for productive purposes.

Article 4 of the Workers' Statute states

The ruling refers to art. 4 L. 300/1970, which allows technological controls when:
• they are not aimed at remote monitoring of the worker
• they meet organizational, production, or company security needs
• they comply with the regulations on personal data processing

Unauthorized access, confidential data, and breach of trust

The employee had extracted and transmitted confidential company information externally.
The Supreme Court qualifies it as:
• abuse of the company device
• serious breach of the fiduciary bond
• conduct capable of damaging the company

This results in the full legitimacy of dismissal for just cause.

What checks are lawful according to the ruling

Controls are allowed:
• aimed at ascertaining unlawful behavior
• limited in time and proportionate to the risk
• oriented towards the protection of the informational and material assets

Instead, the following checks are prohibited:
• indiscriminate or permanent
• aimed at monitoring the daily operations of the worker
• invasive beyond what is necessary for the defensive purpose

Practical implications for businesses and professionals

For companies:
• define and communicate a policy on the use of company tools
• plan targeted audits in case of founded suspicions
• document the purpose

For private investigators:

• operate in support of the company only on a formal mandate
• adopt tools proportionate to the purpose
• draft reports suitable to support the disciplinary and judicial process

Why this ruling is important

The Supreme Court no. 28365/2025 reinforces the principle that:
• the protection of corporate assets is a primary and concrete interest
• the privacy of the worker must be respected, but cannot be a tool for impunity
• companies can effectively respond to data theft and internal fraud

Conclusions

Defensive monitoring on the company PC is legitimate if based on real risks and regulated by transparent policies.
Judgment No. 28365/2025 serves as a fundamental guide for businesses, HR consultants, and investigators in defining security measures that comply with the law and are truly effective against corporate crimes.