Online reputation assessment: the Italian Supreme Court overturns the decision of the Court of Rome

The Italian Supreme Court recently overturned the well-known decision taken by the Court of Rome concerning the online reputation assessment system 'Mevaluate'.

The dispute, which arose following the adoption of an injunction by the Data Protection Commissioner in 2016 (and previously commented on by us: see https://www.martinimanna.it/blog/rating-reputazionale-online-per-la-cassazione-e-legittimo-se-viene-reso-noto-il-meccanismo-di-funzionamento-dellalgoritmo), concerned a web platform capable of calculating, in an allegedly impartial and reliable way, the reputation of the subjects surveyed. This is achieved through the collection of personal data contained in documents (certificates of criminal and tax records, diplomas, lawsuits and court orders, etc.) uploaded by the users themselves and also with reference to data outside the platform. These data are then processed by an algorithm, which is capable of deriving so-called reputational ratings, relating to the moral, professional and relative image of the persons surveyed. This information is available, for a fee, to all the users of the platform.

The original decision by the Data Protection Commissioner, prohibited the processing of personal data by Mevaluate, and was challenged before the Court of Rome, which partially upheld its appeal. The Court held, in fact, that the prohibition imposed by the Data Protection Commissioner was too far-reaching and annulled the decision, specifically where it concerned the processing of the personal data of persons associated with Mevaluate, but affirmed its validity where relating to persons unconnected to the association.

The Data Protection Commissioner appealed against this decision to the Italian Supreme Court, which in 2021 set aside the judgment and referred the case back to the judge of the merits, considering it flawed from the point of view of the assessment of the validity of the members' consent to the processing of personal data. In particular, the Supreme Court established the principle of law according to which, in the case of a web platform designed to process reputational profiles, the requirement of awareness cannot be considered satisfied where the algorithm, and the elements of which it is composed, remain unknown or unknowable by the interested parties.

The Court of Rome, called upon to rule once again on the dispute on the basis of the principle of law expressed by the Supreme Court, had rejected Mevaluate's appeal in its entirety, holding that the description of the algorithm contained in the Regulation for the determination of the rating did not comply with the requirements set forth therein, in particular in terms of the lack of explanation of the manner in which the result was processed.

Mevaluate brought a new appeal against the decision of the Court of Rome.

As its first ground of appeal, the appellant complained that the Court of Rome had not complied with the principle of law laid down by the Italian Supreme Court, according to which consent given on the basis of the knowability of the algorithm's execution scheme and the elements of which it is composed is lawful. This algorithm is based on 5 parameters for natural persons and 4 for legal persons, which are specifically illustrated, as is the executive scheme underlying the result.

As a second ground of appeal, the appellant complained of the failure to examine documents which could be material in determining the decision: the Court of Rome, according to the appellant, had not considered the European patent application in which the mathematical scheme of the algorithm is represented.

By its third ground of appeal, the appellant pointed out that the court had erred in holding that the authorisation to process personal data given by the members had been conditioned by the way the contractual clauses relating to the authorisation to publish deeds and documents were provided for, in breach of the principle of negotiating autonomy.