Italy experienced one of the longest and most severe lock-downs during the peak of the pandemic. This made it be one of the first countries to launch a national contact tracing App (Immuni) and a national COVID Certificate (green pass) and from October 15, Italy has become the first European country which has made the green pass mandatory to access the workplace.

After an intense period of discussions, on September 21st Decree No. 127/2021 introduced the obligation to hold a valid green pass to access both public and private workplaces across the whole country. This obligation applies to any person who carries out any kind of work activity in the private sector, including training and voluntary work. Therefore the green pas isn’t required only for permanent and contingent workers, but also consultants, self-employed workers, trainees, interns, volunteers, agents, occasional collaborators and also the same categories as above which work for third-party contractors whenever they access the work premises of the company.

The only category of workers which is exempt from the green pass check are those exempted from getting vaccinated for health reasons although in this case it is necessary to show the exemption certificate. The Italian Government is currently working on a QR Code which replaces the paper certification with a digital one (similar to the green pass), in order to ease the checks and reduce the amount of information needed for the checks. Workers in smart working arrangements are of course excluded from the obligation, as long as they don’t physically enter the work premises. The obligation will remain in force until December 31st, although a further extension is certainly not off the table. 

A few weeks after the obligation was issued, we have observed a number of interventions form industry associations and bodies which provided further specifications and guidelines to the law that despite not being considered law, have caused even more uncertainty among Italian companies. 

Companies have rushed over the last weeks in order to ensure adequate checking procedures and necessary documentation are in place. In addition to establishing protocols that rule how to perform the checks at the different entry points of the company, it has been necessary to appoint specific personnel in charge of the green pass checks and managing the cases of individuals without a valid green pass, such as HR or legal department, both from an employment and data privacy perspective.

The Italian data protection authority has played an active role in setting forth limitations to the kind and number of data which companies can collect upon the checks and relevant data retention periods. From a data protection perspective, the check of the green pass by an employer is per se an absolute novelty since the employer could not collect or process employees’ information relating to health before this decree was issued.

During the severe parts of the pandemic, this obstacle had been overcome on the basis of the superior public interest of health leveraging on a specific law, which allowed the employer to perform said processing. In a nutshell, this means that asking employees about their vaccination status is still prohibited. It is possible to ask in advance employees to inform about lack of a valid green pass in order for a company to manage the work shifts, but it’s prohibited to go further and the time when this question is posed has to be determined on a case-by-case basis, with due caution.

Currently, the general available mean for private companies to check their employees’ vaccination status is through reading the bar-code embedded in the green pass using the App VerificaC19, which is an App made available by the Government. Last 12 October the Government has issued another decree which opened up to the possibility to embed the software to check the green pass within the company’s system to check badges through SDK (Software Development Kit), and also to check the validity of green pass through alternative means which do not require the physical presence of the employee/person to be checked.

So what happens if the employee doesn’t have a valid green pass? In that case, the individual is not allowed to access the work premises and from an employment law perspective they will be considered as absent without pay until the worker provides a valid green pass although the employee must in any case be readmitted to work as soon as a valid green pass is shown. There are sanctions for both the employer failing to perform checks, as well as for the employees entering the work premises without a valid green pass. In case the checks are assigned to a third party additional requirements have to be put in place, such as drafting data processing agreements with the vendor to rule the processing of data for the green pass checks performed on behalf of the employer.

Over the last few days, there have been protests across the country against the green pass not only from no-vax supporters but also from advocates of alleged civil freedoms, who see the green pass as a sort of imposition from the Government and a way to control citizens. The Government has stated its firm intention to go forward as the green pass is by no means an attempt to limit citizens’ civil freedoms, but rather an effective tool in the fight against COVID and a positive ally of the economy in terms of ensuring continuity of work and business activities.

There are some outstanding questions that the government will need to solve, such as the validity of green pass issued by other countries which are not recognized in Europe and thus in Italy, how the tools alternative to the VerificaC19 App to check the green pass will work in practice or what measures to limit the impact of suspensions will be implemented by the government.

In summary, companies will need to closely monitor how the situation evolves in the short and medium term but for now it seems that the green pass initiative is here to stay and we will all need to adapt to it. To stay informed on the most recent developments of the new working paradigm across the globe, visit our Future of Work Hub: Future of Work | Expertise | Baker McKenzie.


Francesca Gaudino is the Head of Baker McKenzie’s Information Technology & Communications Group in Milan. She focuses on data protection and security, advising particularly on legal issues that arise in the use of cutting edge technology.