Territorial Jurisdiction in Unlawful Data Processing: Commentary on Judgment No. 38511 of 2024

Judgment No. 38511 of September 18, 2024, filed on October 21, 2024, represents a significant step forward in defining territorial jurisdiction for offenses of unlawful personal data processing, particularly when such data is disseminated through social networks. The central issue concerns the impossibility of precisely identifying the place where the offense was consummated, a problem that is increasingly relevant in the digital age.

The Regulatory Context

The case at hand refers to the application of Article 167 of Legislative Decree of June 30, 2003, No. 196, which governs the unlawful processing of personal data. When dealing with data disclosed on the internet, it becomes complex to identify the place of upload and the place where the data becomes accessible. In the absence of a generally applicable rule, the judgment refers to the supplementary criteria outlined in Article 9 of the Code of Criminal Procedure.

Unlawful processing of personal data - Disclosure via "internet" - Impossibility of identifying the place of consummation of the offense - Supplementary criteria of Article 9 of the Code of Criminal Procedure - Applicability. Territorial jurisdiction for the crime of unlawful processing of personal data carried out through "social networks," as per Article 167 of Legislative Decree of June 30, 2003, No. 196, where the general rule of Article 8 of the Code of Criminal Procedure is not applicable due to the impossibility of identifying the place of data upload and the place where it became accessible on the "web," is determined based on the supplementary criteria, considered, in a gradual manner, by Article 9 of the Code of Criminal Procedure, ultimately drawing upon the residual criterion established by paragraph 3, which assigns jurisdiction to the court where the public prosecutor's office that first registered the notice of crime is located.

Practical Implications of the Judgment

This judgment offers food for thought on the issue of jurisdiction in a global and interconnected context. Social networks, in fact, know no geographical boundaries, and data circulation can occur in real-time, complicating the determination of jurisdiction. Among the main practical implications of the judgment, the following can be highlighted:

• The need for greater regulatory clarity regarding territorial jurisdiction for cybercrimes.
• The importance of establishing protocols for the collection and preservation of evidence in cases of data breaches.
• Growing attention from judicial authorities on the use and protection of personal data.

Conclusions

In conclusion, Judgment No. 38511 of 2024 represents a significant step in recognizing and addressing the challenges related to territorial jurisdiction in offenses of unlawful personal data processing. With the continuous development of digital technologies, it will be crucial for legislators and judicial authorities to adapt regulations and procedures to ensure effective protection of personal data and fair justice for victims of these offenses. Only through a synergistic approach between law, technology, and the protection of fundamental rights will it be possible to face the challenges of the future.