Investigation into Fictitious Remote Work and Digital Monitoring: Log-ins as Evidence

1. The facts

   The legal debate stems from the hypothesis that a consultancy firm might adopt operating models aimed at unduly benefiting from contribution relief. In this theoretical scenario, a company could formally certify that employees perform their duties remotely from geographic areas that guarantee tax or contribution breaks, whereas they would permanently work at other offices. The core of any potential evidentiary framework would lie in cross-referencing the contribution statements sent to INPS with IT traffic data. The analysis of IP addresses and connection metadata to corporate servers could reveal a systematic discrepancy between declared and actual geographic locations. Other aspects concerning privacy and the right to disconnect are addressed in dedicated articles.

2. 

   The laws at play

   The applicable legal framework rests on three fundamental pillars governing the intersection of corporate management and compliance:

   1. Art. 640-bis of the Italian Criminal Code (Aggravated fraud for obtaining public funds), which punishes anyone who, through deception or artifice, misleads a public body to obtain undue benefits, with penalties of up to seven years' imprisonment.
   2. Art. 4, paragraph 2, of Law no. 300/1970 (Workers' Statute), which provides that restrictions on remote monitoring do not apply to tools used by employees to perform their work, making log-in data theoretically accessible to the employer.
   3. Legislative Decree no. 231/2001, defining the administrative liability of entities, which imposes financial and disqualifying sanctions if fraud is committed in the company's interest or to its benefit without adequate organizational models to prevent it. The evidentiary effectiveness of these rules strictly depends on compliance with the information obligations under the Privacy Code, as the failure to notify employees regarding data usage may invalidate the admissibility of evidence.

3. Case law

   Supreme Court case law has established that data extracted from work tools are fully admissible when aimed at detecting criminal offenses.

   1. Regarding defensive checks, the Supreme Court has clarified that an employer may monitor digital activity to protect corporate assets against criminal conduct, bypassing the procedural constraints of Art. 4 of the Workers' Statute when the check is conducted ex post and targeted at a specific offense.
   2. However, labor case law takes a stricter view: if the check is intended merely to verify compliance with working hours, it remains subject to trade union agreements or authorization from the Labor Inspectorate.
   3. Concerning contribution fraud, the prevailing view holds that falsely stating the workplace location in data submissions sent to INPS constitutes the offense, as it deprives the public body of the ability to verify eligibility for contribution relief. The principle of proportionality remains paramount, requiring IP data analysis to be strictly limited to what is necessary to prove fraudulent conduct, without degenerating into generalized surveillance of private life.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   The analysis yields key operational lessons for managing corporate compliance:

   1. Promptly update the privacy notice, explicitly stating that log-in data may be processed for asset protection and contribution compliance checks.
   2. Enhance organizational models under Legislative Decree no. 231/2001 by establishing cross-checking procedures between declared locations for incentives and technical connection data.
   3. Strictly distinguish between performance monitoring (prohibited if covert) and defensive checks (permitted to detect unlawful conduct), ensuring proper documentation of the grounds justifying an internal investigation.
   4. Carefully assess the evidentiary package: in criminal proceedings, raw IP data alone may require supporting testimonial or documentary evidence regarding the employee's actual physical location.

9. Update and rectification note (17 September 2026)

   The previous version of this article referred to an investigation by the Milan Financial Police, against a consulting company, with the assigned prosecutor named, mentioning notices of conclusion of investigations and preventive seizures. Following an editorial review, it emerged that these statements are not supported by any official documents or primary sources, and the named entity does not appear to exist in these terms. The text has therefore been corrected and anonymized, removing all unfounded attributions and transforming the discussion into a general legal analysis.

References: Art. 640-bis c.p.Art. 4 Legge 300/1970D.Lgs. 231/2001Legge 81/2017

Editorial oversight: Avv. Federico Papa·ICAMUpdated 17 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction