The unlawful processing of personal data and the compensability of the resulting damage: the decision of the Court of Cassation

In a recent decision the Italian Court of Cassation declared that the breach of an individual’s right to privacy is a tort that gives rise to liability under article 2043 of the Italian Civil Code. However, the Court stated that such a violation does not lead to automatic compensation for the resulting damages, but that the losses have to be proven by the damaged party according to the ordinary rules (Decision No. 15240 of the Third Civil Chamber of the Court of Cassation, filed on 3 July 2014).

Filing a lawsuit pursuant to article 152 of Legislative Decree No. 196/2003 (hereafter the Data Protection Code), the plaintiff (a correctional officer) had requested the Court of Bologna to ascertain that his health data had been processed unlawfully by the Ministry of Justice. The court of first instance confirmed that the processing did not comply with the relevant Data Protection Code provisions, since the Ministry did not have the necessary authorisation from the Italian Data Protection Authority (Garante della privacy) for processing sensitive data. Having found that the defendant’s conduct was unlawful, the Court, however, rejected the plaintiff’s request for the compensation of damages, since no evidence was provided on the damage itself.

The plaintiff lodged appeal before the Court of Cassation, claiming that, since the processing of personal data had been confirmed to be unlawful, the resulting damages should be considered to have occurred in re ipsa, i.e. without the need to provide any evidence of the same.

The Court of Cassation did not share the plaintiff’s view and dismissed the appeal by referring to its own earlier case law on the same subject. A reference was made, in particular, to decision No. 4366 of 2003, in which the Court declared that, even if the violation constituted a tort under article 2043 of the Civil Code, it did not, however, lead to the automatic compensation of damages; damages have to be proven under ordinary principles on the burden of proof, regardless of the difficulty of providing the relative evidence.

The Court also made it clear that the conclusion would not have been different even if the damage had been of a non-monetary nature or caused by the violation of human rights. In this regard, the Court made a reference to decision No. 26972 of 11 November 2008 of its United Chambers, which, acknowledging the compensability of the breach of such rights, confirmed that “the existence of the damage has to be proven by the damaged party”.

Ultimately, the Court rejected the appeal and condemned the plaintiff to pay the costs of proceedings.