The Italian DPA (garante) registered a complaint from the union UILCOM Sardegna toward the call center operator Concentrix Cvg Italy s.r.l. concerning one of the internal regulations of the responsible party. The call center company imposed a “clean desk policy”, where the employees were prohibited to keep specific items on their desks, including smartphones, for the purpose of maintain confidentiality during the processing of customers’ personal data. The company made an exception in the case of medication that certain employees would need to take. However, the medication had to be placed visibly on the desk, which also meant that the medication was visible to other co-workers, indirectly exposing the data subjects’ health status. While the data controller had obtained the consent of all employees regarding the rules of procedure, it did not inform them about the processing of health data.
the italian dpa garante registered a complaint from the union uilcom sardegna toward the call center operator concentrix cvg italy srl concerning one of the internal regulations of the responsible party the call center company imposed a “clean desk policy” where the employees were prohibited to keep specific items on their desks including smartphones for the purpose of maintain confidentiality during the processing of customers’ personal data the company made an exception in the case of medication that certain employees would need to take however the medication had to be placed visibly on the desk which also meant that the medication was visible to other coworkers indirectly exposing the data subjects’ health status while the data controller had obtained the consent of all employees regarding the rules of procedure it did not inform them about the processing of health data
 italian dpa garante register  complaint   union uilcom sardegna toward  call center operator concentrix cvg italy srl concern one   internal regulations   responsible party  call center company impose  “clean desk policy”   employees  prohibit  keep specific items   desks include smartphones   purpose  maintain confidentiality   process  customers’ personal data  company make  exception   case  medication  certain employees would need  take however  medication    place visibly   desk  also mean   medication  visible   coworkers indirectly expose  data subjects’ health status   data controller  obtain  consent   employees regard  rule  procedure    inform    process  health data