Disclosure of official secrets and the liability of the outsider: analysis of Cass. pen., judgment no. 11498/2025

The Sixth Criminal Section of the Court of Cassation, with judgment no. 11498 filed on March 21, 2025, returns to the delicate relationship between official secrets and the complicity of an outsider (the so-called extraneus) in the crime provided for by art. 326 of the Italian Criminal Code. The case originates from a decision of the Tribunal of Review of Florence, which was annulled without referral, and which had found S. I. liable as a private recipient of confidential information. The Supreme College, recalling established rulings (Sez. U., no. 420/1981) and highlighting an now uniform case law, sets precise boundaries that concern both legal professionals and public entities, who are increasingly attentive to the protection of information assets.

The regulatory framework: art. 326 c.p. and art. 110 c.p.

Art. 326 of the Italian Criminal Code punishes a public official who discloses official secrets "outside the cases where the law permits it." When can a private individual also be held liable? The answer is found in art. 110 of the Italian Criminal Code (complicity in a crime): the outsider is punishable if they materially or morally participate in the offense. The judgment under review clarifies that mere advantage gained from receiving information does not in itself constitute any complicity. A quid pluris is necessary: the exhortation or pressure that drives the public official to the violation.

In the matter of disclosure of official secrets, the existence of complicity in the crime by the outsider requires that they have not limited themselves to receiving the information, but have instigated or induced the public official to carry out the disclosure, as mere disclosure of information covered by secrecy to third parties is not sufficient to constitute the crime.

The Court therefore explains that the private individual becomes an accomplice only when they play an active role, of impulse or pressure, towards the public official. Without such moral (or material) contribution, the necessary subjective causal link required by art. 110 of the Italian Criminal Code is missing. The principle protects two interests: the confidentiality of administrative action and the certainty of the punitive perimeter, avoiding the criminalization of merely passive conduct.

From theory to concrete cases: how is instigation proven?

The Court of Cassation invites the lower courts to seek symptomatic elements of active behavior by the private individual. Some factual indicators may include:

• previous communications demonstrating pressure or requests for information;
• economic advantages promised or paid to the public official;
• a planned strategy for acquiring confidential information;
• stable and continuous involvement between the parties.

Without these indicators, the mere knowledge of the information remains irrelevant for criminal purposes, even if it may constitute other liabilities (e.g., disciplinary or civil).

Case law comparison

The decision follows consistent rulings (Cass. 34928/2018; 47997/2015) and distances itself from divergent rulings (Cass. 15489/2004) that considered mere disclosure to third parties sufficient. The change is based on the need to safeguard the principle of personal criminal responsibility (art. 27 of the Italian Constitution) and on the reference to European conventional values regarding legality (art. 7 of the ECHR). The Court favors a restrictive interpretation, in line with the case law of Strasbourg, which requires specificity and predictability of the criminalizing norm.

Conclusions

Judgment no. 11498/2025 provides a useful vademecum for legal professionals: a private individual who receives confidential information from a public official does not automatically commit a crime. It is necessary to demonstrate a causal contribution – instigation or inducement – that led to the breach of secrecy. For the defense, this opens avenues for investigation into the actual methods of acquiring the information. For public administrations, the ruling recalls the importance of internal protocols aimed at tracking every data request, so as to prevent illicit deviations. Ultimately, the principle affirmed balances the repressive need with the protection of fundamental rights, outlining clear boundaries for the criminal liability of the outsider.