• via Alberto da Giussano, 26, 20145 Milano
  • +39 02 4003 1253
  • info@studiolegalebianucci.it
  • Criminal Lawyer, Family Lawyer, Divorce Lawyer

Commentary on Judgment No. 33972 of 2023: Legal Continuity and Unlawful Processing of Personal Data

Judgment No. 33972 of June 16, 2023, issued by the Court of Cassation, offers important insights into the unlawful processing of personal data, particularly regarding health-related data. The decision is set against a backdrop of evolving legislation, characterized by the ongoing need to protect individuals' sensitive data. The Court analyzed the legal continuity between the provisions of Legislative Decree No. 196 of 2003, in its original formulation and that subsequently modified by Legislative Decree No. 101 of 2018.

The Legal Framework

The crime referred to in Article 167, paragraph 2, of Legislative Decree 196/2003 punishes the unlawful processing of personal data. With the entry into force of EU Regulation 2016/679 (GDPR), the Italian legislator had to adapt its regulations, but the Court established that there is no break between the two formulations: the substance of the offense remains unchanged. This means that the unlawful processing of personal data, even after legislative changes, continues to be prosecutable.

Relationships between the crime referred to in Article 167, paragraph 2, of Legislative Decree 196 of 2003 in the version amended by Legislative Decree No. 101 of 2018 and that provided for by the same norm in the previous formulation - Legal continuity - Existence - Reasons. In terms of unlawful processing of personal data related to health, there is legal continuity between the crime referred to in Article 167, paragraph 2, of Legislative Decree June 30, 2003, No. 196, in the formulation following the amendment made by Article 15, paragraph 1, letter b), Legislative Decree August 10, 2018, No. 101, and that provided for by the same norm in the previous formulation, with the processing of personal data referred to in Articles 9 and 10 of EU Regulation 2016/679 of the European Parliament and of the Council, of April 27, 2016, being punishable, if it occurs in violation of the provisions of Articles 2-sexies and 2-octies or of the safeguards provided for in Article 2-septies, Legislative Decree No. 196 of 2003, which causes harm to the data subject and is aimed at deriving profit for oneself or others or causing such harm.

Implications of the Judgment

The judgment emphasizes the importance of protecting personal data, especially sensitive data, such as that related to health. The following implications emerge from the decision:

  • Legal continuity: The Court stated that the regulatory changes did not alter the substance of the offenses provided for, maintaining a stable legal framework for data protection.
  • Punishment for unlawful processing: The processing of sensitive data that violates regulations, causing harm to the data subject, remains punishable.
  • Reflections on the GDPR: The decision highlights the interconnection between Italian legislation and the GDPR, suggesting that European principles are integrated into the national system.

Conclusions

Judgment No. 33972 of 2023 represents an important step forward in Italian jurisprudence regarding the processing of personal data. It not only reaffirms the legal continuity between the different formulations of the law but also the importance of ensuring the protection of sensitive data, at a time when digitalization and the management of personal data are assuming an increasingly central role in daily life. Legal professionals and privacy practitioners must remain vigilant and updated regarding these developments to ensure adequate protection of individuals' rights.