TL;DR for the DPO
The Italian DPA (decision no. 342/2026) blocked stress and emotion monitoring in the workplace: data on staff health or psychological path cannot be accessible to the employer, NOT EVEN in aggregate form, because in small contexts aggregation does not prevent re-identification and the surveillance effect remains. In parallel, the AI Act prohibits AI systems inferring emotions at work (Art. 5, a prohibited practice since 2 February 2025).
The three points that matter
- 'Aggregated' does not mean 'safe': in a 10-person office, the department's average stress score identifies people just fine. The DPA is clear: staff psycho-emotional data must not reach the employer in any form.
- Organisational wellbeing has lawful paths: anonymous surveys run by independent third parties, listening desks, the occupational physician. What is not lawful is a continuous flow of emotional data to whoever manages careers and contracts.
- AI Act Art. 5: AI systems inferring emotions in the workplace are a PROHIBITED practice (save for medical or safety reasons). Anyone proposing wearables, tone-analysis software or 'emotion' cameras for employees is proposing something unlawful.
What to do now, in practice
Check with clients: 1) wellbeing platforms and climate surveys - who sees the data and at what granularity? 2) HR tools with individual 'sentiment analysis' or engagement scores - review immediately; 3) any AI project touching workers' emotional state must be classified: it is almost always an Art. 5 prohibited practice, not merely 'high-risk'. The risk-classification template in the generator includes exactly this check.
Why it matters for your clients
The market pushes ever more invasive 'people analytics', often sold as welfare. This decision gives the DPO a clear-cut argument: the line is not 'let's anonymise a bit' - certain data simply must not reach the employer. And with the AI Act the perimeter is even stricter: for emotion recognition at work there is no legal basis to look for, there is a ban.
Official source:Italian Data Protection Authority - decision no. 342/2026Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
