With sentence n. 2243 of January 20th 2022, the Italian Supreme Court of Cassation retraced the changes to the types of crimes rendered by art. 167 of the Privacy Code (Legislative Decree 196/2003), clarifying in which cases the unlawful processing of personal data is now considered a criminal offence.
The case concerned the investigation activities commissioned to an agency in 2012. In particular, a man had instructed an agency to monitor and locate his wife for a period of 10 days, to collect evidences to be used in a separation proceeding and to document a possible prejudiced conduct of the minor daughter of the couple.
In the separation lawsuit the man submitted the report of the agency, where the daily movements of his wife were described and accompanied by many photographs. From the examination of the report emerged that the agency had acquired several different information on the sentimental life of the woman, who was followed and photographed for a period of time longer that what agreed with the husband and even while she was not with her daughter but with her new partner.
After the complaint of the woman, the Court had ascertained the unlawfulness of the investigations because they exceeded the mandate conferred by the husband, condemning the head of the agency for the crime of unlawful processing of personal data, provided for by art. 167 of the Privacy Code. This normative, in the formulation in force at the time of the facts, sanctioned the conduct of whoever, in order to profit for themselves or others or to cause damage to others, processed of personal data in violation of specific provision of the Code and “if the fact results in harm”.
With the sentence under exam, the Italian Supreme Court annulled the sentence of conviction, clarifying what has to be intended for “harm” and which unlawful data processing is now – after the entry in force of the EU Regulation 2016/679 (GDPR) – a criminal offence.
First of all, the Court clarified that for the configuration of the crime under exam the “harm” must consist in a “juridically relevant prejudice of any pecuniary or non-pecuniary nature, suffered by the person to whom the protected data and information are referred to”. Nevertheless, it was pointed out that the mere production in civil judgment of documents containing personal data does not constitute in itself the harm necessary to configure the crime, but there must be other factual elements indicating a real harm of the protected interest. This because it concerns pieces of information which are communicated only to the subjects professionally involved in the proceeding and, therefore, obliged to confidentiality.
The Court then recalled that, after the entry in force of the GDPR and the following Legislative Decree 101/2018, the scope of criminal response to the unlawful processing of persona data has been greatly reduced.
For what concerns data related to sexual life, the Court highlighted that it is a particular category of data whose processing is prohibited in absence of consent of the data subject. The only exception is the case in which it is necessary to “ascertain, exercise or defend a right in court” (art. 9, let. F, GDPR). But the violation of this provision is not always criminally relevant: for the purpose of integrating the offense referred to in art. 167 the violation of the prohibition of processing is not enough, there should also be the violation of the specific provisions of the rule for the protection of this category of data, among which it is no longer included the compliance with the deontological rules related to defensive investigations.
As a matter of fact, with the reform of the Privacy Code the violation of deontological rules provided by the Italian Data Protection Authority and related to processing carried out for defensive investigations or to exercise or defend a right in court have been expressly excluded from the new incriminating case.
Therefore, even if the compliance with the rules related to defensive investigations remains an essential condition for the lawfulness and the correctness of the processing, their violation is no longer a crime but an administrative offense (pursuant to article 166, paragraph 2, Legislative Decree no. 196/2003).
Thus, in the case under exam, the Court annulled the sentence of conviction because the offence carried out by the head of the agency does not constitute a criminal offence, even though the woman may still take civil action for the compensation for the damage caused by the unlawful fact.
Ilaria Feriti