Disclosure of official secrets and the liability of the outsider: analysis of Cass. pen., judgment no. 11498/2025

The VI Criminal Section of the Court of Cassation, with judgment no. 11498 filed on March 21, 2025, returns to the delicate relationship between official secrets and the complicity of an outsider (the so-called extraneus) in the crime provided for by art. 326 of the Criminal Code. The case originates from a decision of the Tribunal of Review of Florence, which was annulled without referral, and which had found S. I. liable as a private recipient of confidential information. The Supreme Collegium, recalling established rulings (Sez. U., no. 420/1981) and highlighting an now uniform jurisprudential line, sets precise boundaries that concern both legal operators and public entities, who are increasingly attentive to the protection of information assets.

The regulatory framework: art. 326 c.p. and art. 110 c.p.

Art. 326 of the Criminal Code punishes a public official who discloses official secrets "outside the cases where the law permits it." When can a private individual also be held liable? The answer is found in art. 110 of the Criminal Code (complicity in a crime): the outsider is punishable if they materially or morally participate in the offense. The judgment under review clarifies that mere advantage obtained from receiving information does not in itself constitute any complicity. A quid pluris is necessary: the exhortation or pressure that drives the public official to commit the violation.

In the matter of disclosure of official secrets, the existence of complicity in the crime by an outsider requires that they have not limited themselves to receiving the information, but have instigated or induced the public official to carry out the disclosure, as mere disclosure of information covered by secrecy to third parties is not sufficient to constitute the crime.

The Court therefore explains that the private individual becomes an accomplice only when they play an active role, of impulse or pressure, towards the public official. Without this moral (or material) contribution, the necessary subjective causal link required by art. 110 of the Criminal Code is missing. The principle protects two interests: the confidentiality of administrative action and the certainty of the punitive perimeter, avoiding the criminalization of merely passive conduct.

From theory to concrete cases: how is instigation proven?

The Court of Cassation invites the lower courts to seek symptomatic elements of active behavior by the private individual. Some factual indicators may include:

• previous communications demonstrating pressure or requests for information;
• economic advantages promised or paid to the public official;
• a planned strategy for acquiring confidential information;
• stable and continuous involvement between the parties.

Without these indicators, mere knowledge of the information remains irrelevant for criminal purposes, even if it may constitute other liabilities (e.g., disciplinary or civil).

Case law comparison

The decision follows consistent rulings (Cass. 34928/2018; 47997/2015) and departs from divergent rulings (Cass. 15489/2004) which considered mere disclosure to third parties sufficient. The change is based on the need to safeguard the principle of personal criminal responsibility (art. 27 of the Constitution) and on the reference to European conventional values regarding legality (art. 7 of the ECHR). The Court favors a restrictive interpretation, in line with the case law of Strasbourg which requires the specificity and predictability of the criminal provision.

Conclusions

Judgment no. 11498/2025 provides a useful vademecum for operators: a private individual who receives confidential information from a public official does not automatically commit a crime. It is necessary to demonstrate a causal contribution – instigation or inducement – that led to the breach of secrecy. For the defense, this opens up avenues for investigation into the actual methods of acquiring the information. For public administrations, the ruling recalls the importance of internal protocols aimed at tracking every data request, so as to prevent illicit deviations. Ultimately, the principle affirmed balances the repressive need with the protection of fundamental rights, outlining clear boundaries for the criminal liability of the outsider.