Definition and Limits of Personal Data Processing

The Civil Cassation Court, Section I, of 21 February 2024 Order No. 4648, held that a vehicle registration number constitutes personal data under data protection legislation. The case concerned photographs of a Highway Code violation published on the Municipality of Cittadella’s website. They displayed the number plate of a vehicle belonging to a person not involved in the offence. The Data Protection Authority had deemed the processing unlawful and imposed a fine, while the Court of Padua annulled the payment notice, holding that the number plate alone did not constitute personal data. The Supreme Court quashed this decision, clarifying that a number plate can still identify the vehicle owner. Accordingly, its disclosure, particularly when accompanied by details of the place, time, and circumstances, constitutes processing of personal data subject to the principles of necessity, relevance, and proportionality.

The Civil Cassation Court, Section I, Judgment of 13 May 2024 No. 12967, addressed the use of digital surveillance systems in remote university exams. The case concerned Bocconi University’s software, which recorded video and screenshots of students during exams and automatically flagged suspicious behaviour using image analysis. Following a student complaint, the Data Protection Authority sanctioned the university, considering the system as processing biometric data, generally prohibited under Article 9 of Regulation (EU) 2016/679. The Court of Milan had reduced the sanction, treating the system as a simple video recording for lecturer review. The Court of Cassation quashed this decision, noting that photographs and video recordings can qualify as biometric data when processed in a way that enables the unambiguous identification of individuals. Such processing occurs, in particular, in automated systems that analyse images to detect anomalous behaviour.

Lawfulness of Processing and Balancing Against Other Rights

The Civil Cassation Court, Section I, Order of 19 March 2024, No. 7289, clarified the limits of private video surveillance. The case involved a property owner who installed cameras pointing toward a private road subject to a neighbour’s right of way. The Court of Appeal had found the processing unlawful due to a lack of consent and ordered the removal of cameras and payment of damages. The Court of Cassation quashed the decision, stating that private video surveillance may be lawful even without consent if it is justified by the need to protect persons or property and complies with the principles of necessity, proportionality, and non-excess. It must also be limited to areas that require protection, and the case was remanded to the trial court to verify compliance in practice.

The Civil Cassation Court, Section I, Judgment of 16 September 2024, No. 24797, addressed the use of audio recordings without consent in legal proceedings. The case involved an employee who recorded a meeting with superiors, shared it with colleagues, and used it in a lawsuit against the employer. The Data Protection Authority had deemed the processing lawful for purposes of legal defence, while the Court of Venice had ordered deletion and imposed a fine. The Court of Cassation quashed this decision, confirming that processing of personal data is lawful without consent when necessary to assert or defend a right in court. It also recognised the Data Protection Authority’s standing to intervene in proceedings concerning data protection.

A Minor’s Right to Privacy and the Right to Report News

The Civil Cassation Court, Section III, Order of 1 February 2024, No. 2978, dismissed an appeal concerning the broadcast of a minor’s image in a news report on the arrest of a fugitive. The Court held that rules on the right to one’s image (Art. 10 Civil Code; Arts. 96–97 Law 633/1941) must be read alongside data protection law. In balancing privacy against public interest, particular protection is required for minors. Even when publication without consent is otherwise permitted, dissemination may be prohibited if the image was intentionally taken to make the child identifiable. In this case, however, the image was incidental within a crowd during a public event, and the Court upheld the publication as lawful.

Satire, Political Criticism, and Limits of Defamation

The Civil Cassation Court, Section III, Order of 14 March 2024, No. 6960, quashed and remanded the Rome Court of Appeal’s decision deeming defamatory the publication in L’Espresso of a photograph with a caption referring to a female judge in a satirical article on former Prime Minister Silvio Berlusconi. The Court confirmed that satire, as a form of political criticism, may distort reality and is not bound by factual accuracy. Reputation protection must be balanced against freedom of criticism, taking into account moderation, the purpose of criticism, the prominence of the subjects, and the public interest. The Court found that the trial judge had failed to consider the socio-cultural context and public reaction, which are essential to assessing the satirical scope.

Case law further confirms that political criticism is protected under Article 21 of the Constitution and, in criminal law, may include negative judgments on public officials when based on true facts, in the public interest, and not amounting to personal attacks (Criminal Cassation, Section V, 23 April 2024, No. 17042). In civil law, political criticism is a subjective value judgment and may rely on publicly known facts when relevant to assessing suitability for public office (Civil Cassation, Section III, 6 May 2024, No. 12231). Defamation assessments require a concrete analysis of context and perceived meaning, without automatically linking harshness of tone to liability (Criminal Cassation, Section V, judgments 28 March 2024, No. 13017 and 25 June 2024, No. 25026).

Right to Be Forgotten, Digital Archives, and Defamation

The Civil Cassation Court, Section III, Order of 27 June 2024, No. 17738, upheld the removal of defamatory reports concerning a politician’s personal use of an official car. The Court clarified that the right to be forgotten prevails only if the original publication was unlawful or defamatory. Lawful news retention in digital archives serves the function of documenting information. In this case, since the reports were defamatory, their deletion was confirmed, reiterating that the balance between reputation and freedom of information depends on the lawfulness of the original publication.

Personal Data in Court Reports

The Civil Cassation Court, Section III, Order of 23 July 2024, No. 20337, addressed the publication of identifying details of individuals under investigation. An ASL employee under investigation for fraud challenged the publication of his full name. In turn, the Florence Court of Appeal had awarded compensation, deeming the data non-essential. The Court of Cassation confirmed that publishing personal details for journalistic purposes is lawful without consent only if essential to matters of public interest. Assessment of essentiality is for the trial judge, who must provide detailed reasoning per case, in accordance with the Journalists’ Code of Ethics (Art. 139 Legislative Decree 196/2003) and Art. 137 of the same decree. Article 329 of the Code of Criminal Procedure, on investigative secrecy, is not relevant. The Court quashed the decision and remanded for further reasoning on the damages.