INTRA/MD/MD009Retention of web and network activity records
The retention of a record of the network resources a worker reached, and when.
| Control | Jurisdiction | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|---|
| MD009/ITMandatory | Italy | Provvedimento n. 243Garante per la protezione dei dati personali · read 11 Aug 2026Provvedimento n. 165, ITAS MutuaGarante per la protezione dei dati personali · read 16 Aug 2026 | That ninety days of metadata and browsing logs, kept without the procedural steps, draws a fine, the reasoning turning on the steps and not the purpose. | Browsing logs are an instrument from which remote monitoring may follow, so retaining them engages the article 4 route as metadata does. |
| MD009/NOMandatory | Norway | Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026 | When an employer may look into a work mailbox or a worker’s personal areas on its equipment, that monitoring of internet use is outside what it may do at all, and that the regulation cannot be contracted around. | A record of what the worker reached may be kept where the purpose is administering the network or detecting and resolving a security breach in it, the regulation putting other purposes outside what the employer may do. |
| Recommended | Switzerlandwhere written | Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026 | What counts as a behaviour monitoring system (cameras in work rooms, microphones, continuous positioning, IT tools that monitor computer or phone activity at work or at home, sensors capturing biometric or physiological data, and AI tools for automated analysis of employee-based data), the three conditions of admissibility of a system needed for other reasons (a clearly overriding other interest, proportionality, and the participation of employees in planning, installation, hours of operation, and retention), the written justification produced to the labour inspectorate on request, and the data rules (prior detailed information, shortest predetermined retention, access limited to those authorized to evaluate, no archiving after the control, an internal regulation on rights and duties, monitored areas marked). | Users of IT systems and networks are told in advance in what form business data may be monitored, and internet use is regulated internally. |