Commentary on Judgment No. 33972 of 2023: Normative Continuity and Unlawful Processing of Personal Data

Judgment No. 33972 of June 16, 2023, issued by the Court of Cassation, offers important insights into the unlawful processing of personal data, particularly concerning health data. The decision is part of an evolving regulatory landscape, characterized by the continuous need to protect individuals' sensitive data. The Court analyzed the normative continuity between the provisions of Legislative Decree No. 196 of 2003, in its original wording and as subsequently amended by Legislative Decree No. 101 of 2018.

The Regulatory Context

The offense under Article 167, paragraph 2, of Legislative Decree 196/2003 punishes the unlawful processing of personal data. With the entry into force of EU Regulation 2016/679 (GDPR), the Italian legislator had to adapt its legislation, but the Court established that there is no break between the two versions: the substance of the criminal offense remains unchanged. This means that the unlawful processing of personal data continues to be prosecutable, even after the legislative changes.

Relationship between the offense under Article 167, paragraph 2, of Legislative Decree 196 of 2003, as amended by Legislative Decree No. 101 of 2018, and that provided for by the same law in its previous wording - Normative continuity - Existence - Reasons. Regarding the unlawful processing of personal data relating to health, there is normative continuity between the offense under Article 167, paragraph 2, of Legislative Decree of June 30, 2003, No. 196, as amended by Article 15, paragraph 1, letter b), of Legislative Decree of August 10, 2018, No. 101, and that provided for by the same law in its previous wording, continuing to be criminalized the processing of personal data referred to in Articles 9 and 10 of EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, carried out in violation of the provisions of Articles 2-sexies and 2-octies or the guarantee measures under Article 2-septies of Legislative Decree No. 196 of 2003, which causes harm to the data subject and is aimed at obtaining profit for oneself or others or causing such harm.

Implications of the Judgment

The judgment underscores the importance of protecting personal data, especially sensitive data such as health data. The following implications emerge from the decision:

• Normative Continuity: The Court affirmed that the legislative amendments did not alter the substance of the offenses provided for, maintaining a stable legal framework for data protection.
• Criminalization of Unlawful Processing: The processing of sensitive data that violates regulations, causing harm to the data subject, remains punishable.
• Reflections on GDPR: The decision highlights the interconnection between Italian legislation and the GDPR, suggesting that European principles are integrated into the national system.

Conclusions

Judgment No. 33972 of 2023 represents a significant step forward in Italian jurisprudence regarding the processing of personal data. It not only reiterates the normative continuity between different versions of the law but also emphasizes the importance of ensuring the protection of sensitive data in an era where digitalization and personal data management are playing an increasingly central role in daily life. Legal operators and privacy professionals must remain vigilant and updated on these developments to ensure adequate protection of individuals' rights.