Cass.Civ. - 24797/2024

Cass.Civ. - 24797/2024
Court:	Cass.Civ. (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 2(2)(c) GDPR Article 17(3)(e) GDPR Article 21(1) GDPR Art. 36 Cost. Art. 24(f) D.Lgs. 196/2003
Decided:	12.07.2024
Published:	16.09.2024
Parties:
National Case Number/Name:	24797/2024
European Case Law Identifier:
Appeal from:	Trib. Venezia (Italy) 2286/2021
Appeal to:	Not appealed
Original Language(s):	Italian
Original Source:	Corte di cassazione (in Italian)
Initial Contributor:	fb

The Supreme Court held that an employee lawfully recorded a conversation with a manager since that recording was only used as evidence in labour law proceedings against their employer.

English Summary

Facts

The case is part of a broader dispute between a company and some of its employees. During a meeting between the managers of the company and the employees, one of the employees (the controller) recorded the ongoing conversation, without the managers being aware of this.

Some years later, another employee used this recording during a labour trial as evidence.

Therefore, the managers (the data subjects in this case) filed a complaint with the Italian DPA (Garante per la protezione dei dati personali).

The DPA rejected this complaint, arguing that the processing at hand had the only purpose of proving the employee's statements during the trial.

The data subjects appealed the DPA's decision before the Court of Venice (Tribunale di Venezia). Contrary to the DPA, the court upheld the data subjects' claims, ruling that the processing was unlawful and fining the controller €5,000. The court gave the following reasons:

1. when the recording was made, there was no defence needs but only some "organisational problems" in the company;
2. the trial in which the recording was used took place years later;
3. the household exemption provided for by Article 2(2)(c) GDPR does not apply.

The controller appealed this decision before the Italian Supreme Court (Corte di cassazione).

Holding

First, the court pointed out that the recording occurred in 2016, i.e. a time when the GDPR was not yet in force. The court recalled that Article 24(f) of the then-applicable Italian Data Protection Code stated that the data subject's consent was not needed when the processing was necessary "to assert or defend a legal claim, provided that the data are processed exclusively for such purposes and for no longer than is necessary for the pursuit of those purposes".

On this point, the court noted that, according to national case law, this rule applies not only during the trial on itself, but also regarding all the preliminary activities that are necessary to gather evidence for the trial.

Therefore, in the case at hand, it is not relevant that the recording was made by a person that is different from the one that is using it in the labour trial. According to the court, what is relevant is the fact that the purpose for which the recording was used is defending a right during a trial.

Moreover, the court held that, when such a piece of evidence is presented in a trial, it is for the judge of that trial to decide whether to use and how to disclose that recording, after balancing the right to the protection of personal data with the right of defence.

In addition, the court pointed out that the same conclusion can be drawn in a case where the GDPR would apply. Indeed, the court noted that Article 17(3)(e) GDPR sets an exception to the right to erasure "for the establishment, exercise or defence of legal claims", and so does Article 21(1) GDPR.

Therefore, from the wording of the GDPR the court drew the principle that the right to data protection can be balanced with other fundamental rights and the latter can be considered to outweigh the former. In the case at hand, the court underlined that this is especially true since Article 36 of the Italian Constitution (Costituzione della Repubblica italiana) grants a high protection to the rights of employees.

Finally, the court highlighted that also the CJEU considers that, when personal data is used in a trial, it is for the national judge to balance the rights of the parties and decide whether personal data should be used in the trial (see C-268/21, Norra Stockholm Bygg, para. 58).

On these grounds, the court annulled the appealed judgement. Therefore, the decision of the DPA stands and is valid.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

ITALIAN REPUBLIC

IN THE NAME OF THE ITALIAN PEOPLE

THE SUPREME COURT OF CASSATION

FIRST CIVIL SECTION

Composed of the following Magistrates:

Dr. ACIERNO Maria - President

Dr. MELONI Marina - Counselor

Dr. GARRI Guglielmo - Counselor

Dr. RUSSO Rita Elvira Anna - Counselor-Rel.

Dr. VALENTINO Daniela - Counselor

has issued the following

ORDINANCE

on the appeal registered under no. 5831/2022 R.G. proposed by:

A.A., with domicile elected in ROME V.LE GIUSEPPE MAZZINI, (omitted), at the office of the lawyer XX (omitted) represented and defended by the lawyer XX (omitted)

-appellant-

against

B.B., C.C., D.D., E.E., with domicile elected in ROME VIA (omitted), at the office of the lawyer (omitted) who represents and defends them together with the lawyers (omitted), (omitted)

-counterappellants-

against

F.F., G.G.,

-intimates-

AND

GUARANTEE FOR THE PROTECTION OF PERSONAL DATA with domicile elected in ROME VIA DEI PORTOGHESI 12, at the GENERAL STATE ADVOCATION. (ADS80224030587) representing and defending him

-incidental appellant-

against the JUDGMENT of the COURT OF VENICE no. 2286/2021 filed on 02/12/2021.

Having heard the report presented in the council chamber on 12/07/2024 by Councilor RITA ELVIRA ANNA RUSSO.

B.B., E.E., C.C. and D.D., managers of XX Spa, filed a complaint with the Guarantor for the protection of personal data, pursuant to art. 77
of EU Regulation 2016/679
(GD.P.R.), for the cancellation and/or destruction of an audio file containing the recording of a conversation held by the employee G.G. with these representatives of the company, in the context of a meeting called by the management and held several years earlier. This file had been produced by other employees of the company, A.A. and F.F., during hearings relating to employment proceedings against the company.

The Guarantor rejected the request, noting that the processing operations had been carried out for the sole purpose of contesting charges in the context of the employment relationship.

The managers filed an objection with the Court of Venice, which accepted it, declaring "the illegitimacy of the provision of the Authority for the protection of personal data of 17.6.2019" and "the unlawfulness of the processing" carried out by G.G., F.F. and A.A.; as a result, it ordered the defendants to "delete and/or destroy the audio file" in question and "notify such measures to any other possible recipients thereof, pursuant to art. 58, paragraph 2, letter g), of EU Regulation no. 2016/679
" and finally imposed on A.A. and F.F. the pecuniary sanction referred to in art. 58, paragraph 2, letter i), and 83 of the same GDPR
in the amount of 5,000.00 Euro each.

The Court noted that the audio file contained the recording of a meeting held on 25 November 2016 to resolve "some internal organizational difficulties within the company" carried out without there being any defensive needs at the time for the author of the recording (G.G.); and then noted that it was common ground that the recording had been kept and given to colleagues F.F. and A.A. to be produced years later in their respective labor disputes against the same company; it therefore concluded that, although there was a dispute between employees F.F. and A.A. with the company, the data processing had nevertheless occurred in violation of the principles referred to in art. 5 GDPR.

Against the aforementioned ruling, A.A. filed an appeal for annulment based on four grounds; the managers of the XX company filed a counter-appeal. The Guarantor filed a counter-appeal in adhesion, containing two incidental reasons, considering the Court's ruling to be erroneous and requesting the annulment of the contested ruling.

The managers of the company, counter-appealers to the main appeal, notified on 05/09/2022 a counter-appeal pursuant to art. 370
c.p.c. to the adhesive counter-appeal with incidental appeal of the Guarantor; with a subsequent brief and simultaneous request pursuant to art. 153
c.p.c. they stated that they had obtained the delivery receipt but that they had received a communication from the "PCT telematics group" office regarding the fact that the document could not be processed by the system ("Invalid XML document: Invalid value for 'date'. Invalid XML document: The element 'tpanV8:Notification' must not have child elements and its value must be valid") with an invitation to make a new filing after requesting reinstatement within the terms and declared that they would do so at the same time as filing the brief/application for reinstatement within the terms. The remaining defendants (F.F. and G.G.) did not present defenses; therefore, defense briefs were filed. With an interlocutory order dated 14 September 2023, this Court adjourned the trial to a new role pending the decision of the joint sections on the issue raised with interlocutory order no. 20588 of 2023 on the admissibility of the late incidental appeal even when it takes the form of an adhesive appeal against the party invested with the main appeal. A new chamber meeting was set for the hearing of the case, and the parties filed further briefs.

1.- Preliminarily in the procedure.

On the admissibility of the adhesive incidental appeal proposed by the Guarantor, it is noted that with an interlocutory order of 14 September 2023 this Court acknowledged that it is late, but that it is an adhesive appeal, and that - albeit with reference to processes of a different nature - the question of the admissibility of such appeals had been referred to the joint sections, whose decision could therefore have an impact on the present proceedings. Consequently, the case was adjourned to a new role.

The joint sections of this Court ruled with sentence no. 8486/2024, in continuity with the previous orientation given by the joint sections ruling no. 24627/2007 and in contrast with the more restrictive orientation given by the joint sections ruling no. 23903 of 29/10/2020, stating that the late incidental appeal is admissible even when it takes the form of an adhesive appeal directed against the party to whom the main appeal is addressed, due to the fact that the interest in its filing may arise from the main appeal or from a late incidental appeal.

1.2.- The company's managers argue that this principle, as it relates to the position of jointly and severally liable parties, would not apply in the case at hand, given that the Guarantor is not jointly and severally liable with the sanctioned party and therefore the appeal by the Guarantor would be inadmissible, with the consequent passage into res judicata of the sentence, as rendered inter partes, since these are causes that can be separated into an optional joint litigation.

The argument is not convincing, since it does not take into account either the actual question of doubt as delimited by the previous interlocutory order - that is, whether the late adhesive incidental appeal can be brought only by the party "against" whom the main appeal was brought, or by the party called upon to integrate the adversarial proceedings pursuant to art. 331
Cod. proc. civ., or even when it takes the form of an adhesive appeal directed against the party invested with the main appeal, due to the fact that the interest in its submission arises from the main appeal - nor of the peculiar nature of the opposition proceeding to the provisions of the Guarantor and of the legitimacy of the latter to intervene in it.

2.- The Guarantor for the protection of personal data, whose duties are defined by Regulation (EU) 2016/679
(GD.P.R.) and by the Code on the protection of personal data (Legislative Decree 30 June 2003, n. 196
cd. privacy code), adapted to the provisions of Regulation (EU) 2016/679
through Legislative Decree 10 August 2018, n. 101
, is an administrative body competent to issue preventive, inhibitory or conforming measures, which can suspend, modify or stop the illegitimate processing of data, as well as impose sanctions; it exercises its functions in an "impartial and fair" manner (recital 129 and art. 52
of the GDPR decree
) but is not, however, in a position of third party (Cass. n. 13151 of 25/05/2017
). Its participation in the judgment is provided for by art. 10
of Legislative Decree n. 150/2011
as amended by art. 17
of Legislative Decree 101/2018
, which provides that the appeal in opposition must also be notified to the Guarantor, granting it the right to present observations, with reference to the profiles relating to the protection of personal data, even when it is not a party to the judgment.

In the period under which the Privacy Code was in force, before the GDPR came into force, the jurisprudence of this Court established the assertion that the Guarantor participates in the proceedings to assert the same specific public interest that the law has entrusted to said Authority by preparing, before it, a procedure that, although structurally characterized by the adversarial nature of the subjects involved (the owner, the manager and the interested party) and functionally aimed at protecting the rights of the person, is characterized as administrative and does not place the Guarantor in a third-party position comparable to that of the judge in the proceedings (Cass. n. 7341 of 20/05/2002
; Cass. n. 11864 of 25/06/2004
). This principle can also be confirmed in the current regulatory framework, which assigns to the Guarantor, among others, the task of supervising and ensuring the application of the legislation in force on the processing of personal data (art. 57
GDPR
) and of ensuring, also ex officio, the protection of the fundamental rights and freedoms of individuals by adequately implementing the EU regulation and the personal data protection code (art. 154
of Legislative Decree 196/2003
).

The attribution of unofficial powers makes it clear that the Guarantor represents public interests and - consequently - it is also granted the legitimacy to take legal action against the data controller or data processor in the event of violation of the provisions on the protection of personal data, pursuant to art. 154 ter
of Legislative Decree 196/2003
. Moreover, that the Guarantor assumes the quality of party before the judge is also provided for by art. 78
of the GDPR
, which traces the lines of the judicial appeal, to which every natural or legal person is always entitled, as an appeal "against" the decision - or inertia - of the supervisory authority, but also specifying that the appeal is proposed "against" the supervisory authority and in the State where this authority is established.

2.1.- In the regulation of the processing of personal data, public and private interests are intertwined, highlighting not only the fundamental rights of the person but also the need for the community in which we live, highly technological and also founded on the exchange of personal data between public and private actors, natural persons, associations and companies, to maintain its connotation of an area of freedom, security and justice. And in fact, in recital 6 of the GDPR it is noted that technology has transformed the economy and social relations and should further facilitate the free circulation of personal data within the Union and their transfer to third countries and international organizations, while ensuring a high level of protection of personal data.

In this context, the procedural legitimacy of the Guarantor is not connected to the available rights of private parties, such as that of opposing a sanction imposed pursuant to art. 58
of the GDPR
(in this case by the Court, following the judgment of opposition to the Guarantor's provision), but to the public interests that are relevant in the case in question.

2.2.- The case in question is certainly different from that of the jointly and severally liable party referred to by the counter-appellant, but nevertheless, in general terms, the principle established by the Joint Sections with sentence no. 8486/2024 can be applied, stating that it is an adhesive incidental appeal, proposed by a person other than the party to whom the main appeal is addressed and directed against the latter.

The Guarantor is immune from the negative patrimonial consequences of the imposition of a sanction, but intervenes to protect public interests, if and to the extent that they are put into play by the private party's procedural initiative; consequently, in order to assess the admissibility of its late appeal, since it is adhesive, it must be verified whether there is an interest of the Guarantor's own and whether it can be considered to have arisen as a result of the main appeal. On this point, it must be noted that A.A.'s appeal, as will be seen in more detail below, is essentially based on the assertion that her behavior is legitimate and has in no way violated the legislation in force on the processing of personal data. The appeal, if accepted, would entail a change in the structure of the legal situations as outlined by the Court's ruling, not only with regard to the question of whether or not the appellant must pay a fine, but first and foremost on the basis of such a fine, that is, whether or not she has carried out unlawful processing of personal data. The party obliged to pay the fine calls into question the interpretation of the legislation on the processing of personal data given by the Court's ruling and therefore, inevitably, the interest of the Guarantor arises in intervening on the point, also with its own reasons for criticism, given that its function - as stated above - is also to ensure the correct application of the legislation in force on the matter.

The appeal filed by the State Attorney's Office in the interest of the Guarantor is therefore to be considered admissible.

2.3.- As for the counter-appeal filed by the managers of the XX company to respond to the adhesive incidental appeal of the Guarantor, it must be noted that the notification is perfected at the moment in which the receipt of delivery is generated and that, after the error was reported that prevented the processing of the counter-appeal filed by the system, the party proceeded with a new successful filing together with the request for restitution within the terms, already positively assessed in the interlocutory order of 14 September 2023 which considered the managers of the company resistant to both appeals.

Therefore, the adversarial proceedings must be considered validly established also on the appeal of the State Attorney's Office.

3.- On the merits, with the first ground of the appeal the appellant party complains pursuant to art. 360
n. 3 c.p.c. the violation of art. art. 2
of EU Reg. 679/2016
(GD.P.R.).

The appellant notes first of all that in the criminal proceedings against G.G., A.A. and F.F. pursuant to Article 615 bis et seq., the GIP excluded the existence of any harm to the company. It observes that A.A. and F.F. never disclosed the aforementioned recording outside of the civil cases that concerned them; it invokes the application of Article 5
of Legislative Decree 196/2003
noting that under the validity of this legislation and therefore until September 2018, a uniform case law had been formed according to which the person who processes personal data is not subject to the application of these regulatory provisions if they are not intended for systematic communication and dissemination, since these are activities of an exclusively personal nature; it notes that the general discipline on the subject of the processing of personal data is subject to derogations and exceptions when it comes to asserting in court the defense of primary rights. With the same reason for the adhesive incidental appeal, the State Attorney's Office notes that the work meeting during which G.G. recorded the conversation later used in court by F.F. and A.A. was held on 25 November 2016, when Legislative Decree 196/2003 was in force
since the European regulation became applicable only from 25 May 2018. It is noted that this recording is legitimate as the data were not intended for systematic communication or dissemination since the professional nature that excludes processing for personal purposes must refer to the purpose of the data processing and not to the circumstances of place and time in which it is carried out.

3.1.- With the second reason for the appeal, the violation of articles is complained of pursuant to art. 360 no. 3 c.p.c. 5,6,9,21 EU regulation (GDPR) 679/2016 directly applicable in the State and in any case implemented by Legislative Decree 101/2018
in particular by art. 2 paragraph 1 letter. d". The appellant observes that the Court's judgment is erroneous because the recording of a conversation between people present is legitimate, just as the delivery to third parties is legitimate, because in this case a legitimate interest was being pursued in the protection of a fundamental right of the interested party, namely judicial defense. Similarly, the State Attorney's Office, in the second ground of its adhesive appeal, observes that the orientation of the case law of legitimacy is constant according to which the use for defensive purposes of recordings of conversations between employees and colleagues in the workplace does not require the consent of those present.

3.2.- With the third ground of the appeal, the false and erroneous interpretation and application of art. 115
c.p.c. is complained of pursuant to art. 360
n. 5 c.p.c. for having omitted to examine the full recording and transcription of the conversation that took place in the meeting of 25 November 2016 at the offices of the company XX and in particular the expressions uttered by Dr. B.B., as well as for failure to examine and evaluate the documents produced in the first instance by the company's employees. The appellant complains that the judge did not fully listen to the recording contained in the computer support and transcribed in the report signed by the consultant; from this recording it appears that there were already some ongoing cases between the company and the employees and that is, a dispute already in progress and that the organizational measures were related to the presence of this dispute. She claims that she demonstrated in court and that this was not taken into account that at the time the meeting was held there was already a dispute initiated by both F.F. and A.A. 3.3. - The fourth ground of appeal complains of the violation of art. 360 co 1 n. 3 c.p.c. for false and erroneous application of art. 91
and 97
co 1 c.p.c and of the Ministerial Decree 37/2018
which modified the previous ministerial decrees on the subject of forensic parameters for having jointly condemned the A.A. who remained absent in the first instance and for having ruled beyond the limits of the parameters without motivation.

4.- The first three reasons are founded in the terms set out below.

The Court held that the audio recording in question, peacefully performed by G.G. during a meeting with the managers of XX on 25 November 2016, constitutes data processing to which EU Regulation 679/2016 applies
excluding that the hypothesis envisaged by art. 2
letter C) of the GDPR occurs
according to which the regulation does not apply to the processing of personal data "carried out by a natural person for the exercise of activities of an exclusively personal or domestic nature" as this would only indicate activities pertaining to the strictly private and family sphere.

That being said, the Court held that the canons of lawfulness of the processing of personal data provided for by the GDPR were not respected, excluding that in this case there were any needs for protection since it was a work meeting for the resolution of organizational difficulties within the company; the Court noted that the recording was made by G.G. who could not claim defensive or pre-defensive needs against the employer; it was given by G.G. to other colleagues not present at the meeting, including A.A. who produced it two years later in their respective labor cases against the company. According to the Court, the conduct of the workers is outside the perimeter of lawfulness pursuant to the EU regulation both with regard to the lack of a defensive need and with reference to the "lack of relevance in terms of time of data retention to what is strictly necessary for the defense".

5.- The ruling, largely based on perplexed and unclear statements, as well as the mere transcription of parts of the appeal by the company's managers, provides an erroneous reading of the legislation applicable to the case in question.

It is established that the recording took place in November 2016; less clear is when exactly it was used in court (according to the contested ruling two years later, without further specifications); it is however clear that it was used by A.A. and F.F. in a labor dispute, which they deduce was already pending on the date of the meeting.

On the date the recording took place, the GDPR, in force since May 25, 2018, and the consequent Legislative Decree no. 101/2018, which came into force on September 19, 2018, had not yet come into force; recordings of the type performed by G.G. on 25 November 2016 were permitted, integrating the case under art. 24
, letter f) of Legislative Decree 196/2003
, which excluded the need for the interested party's consent, if the recordings were used for the purpose of "asserting or defending a right in court, provided that the data are processed exclusively for such purposes and for the period strictly necessary for their pursuit, in compliance with the current legislation on business and industrial secrecy".

In terms, the case law of this Court, which has specified that the right of defense in court allows, pursuant to art. 24
, letter f), of Legislative Decree no. 196 of 2003
, to disregard the consent of the interested party, provided that the data are processed exclusively for this purpose and for the period strictly necessary for its pursuit, and is not limited to the mere procedural venue, but extends to all those activities aimed at acquiring evidence that can be used therein, even before the dispute has been formally established (Cass. no. 33809 of 12/11/2021
). What is relevant therefore is not how and by whom the recording was made, nor whether there were defensive needs of its material author, but for what purposes the recorded conversation and the information contained therein were used and in particular for what purpose the appellant today used them. It is then evident that in order to be able to use data in court, a prior research and collection activity of the same is necessary, the lawfulness of which is assessed, precisely, on the basis of the use made of them. Generally speaking, the use of data even without the consent of the interested party is considered lawful when it is a question of defending a fundamental right and furthermore, when the data have been used in court, as in this case, it is the judge of that judgment who must balance the interests at stake and admit or not the evidence that involves the processing of third-party data, given that the ownership of the processing in this case belongs to the judicial authority and in this context the different needs must be reconciled, respectively, of protection of confidentiality and correct execution of the process (Cass. n. 9314 of 04/04/2023
)

5.1.- Nor do we reach different conclusions when considering the regulatory framework provided by the GDPR.

It is necessary to bear in mind, in particular, what is stated in recital 4 of the EU Regulation, where it is stated that "The processing of personal data should be at the service of man. The right to the protection of personal data is not an absolute prerogative, but must be considered in the light of its function in society and must be balanced with other fundamental rights, in accordance with the principle of proportionality".

Again, recital 47 specifies that "the legitimate interests of a controller, including those of a controller to whom the personal data may be disclosed, or of a third party may constitute a legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject do not prevail, taking into account the reasonable expectations of the data subject based on his or her relationship with the controller".

It is also necessary to take into account recital 20 which states: "It is not appropriate for the processing of personal data carried out by judicial authorities in the performance of their judicial functions to fall within the competence of the supervisory authorities, in order to safeguard the independence of the judiciary in the performance of its judicial tasks, including the decision-making process".

5.2.- It must therefore be noted that defending oneself in court, especially where the dispute concerns personal rights closely connected to human dignity - and therefore workers' rights, as provided for by art. 36
Const. - is a fundamental right and that in the relationship between the employer and the employees legitimate expectations are created and among these that of mutual loyalty and respect for the rights of the employee. Articles 17
and 21
of the GDPR
make it clear that in the balancing of the interests at stake the right to defend oneself in court can be considered to prevail over the rights of the data subject to the processing of personal data. In particular, art. 17, paragraph 3, letter e) of the regulation provides that paragraphs 1 and 2 (right to erasure) do not apply to the extent that processing is necessary for the establishment, exercise or defense of legal claims and art. 21 (right to object) allows the data controller to demonstrate "the existence of compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims".

More specifically, the Court of Justice of the European Union, with its ruling of 2 March 2023 (C-268/21 - Norra Stockholm Bygg AB against Per Nycander AB), clarified that when personal data of third parties are used in a trial, it is the national judge who must weigh, with full knowledge of the facts and in compliance with the principle of proportionality, the interests at stake and that "this assessment may, if necessary, lead him to authorize the full or partial disclosure to the other party of the personal data thus communicated to him, if he considers that such disclosure does not exceed what is necessary in order to guarantee the effective enjoyment of the rights that the subjects of the legal system derive from Article 47 of the Charter" (paragraph 58).

In terms, national case law is also consolidated in considering that the use of personal data is not subject to the obligation to inform and to the prior acquisition of the consent of the owner when the data themselves are collected and managed in the context of a process; in it, in fact, the ownership of the processing belongs to the judicial authority and in this context the different needs must be composed, respectively, of protection of confidentiality and correct execution of the process, therefore, if they do not coincide, it is the code of procedure that regulates the methods of carrying out the right of defense in court (Cass. n. 9314 of 04/04/2023
; Cass. s.u. n. 3034 of 08/02/2011
) It has thus been stated that the processing of personal data in a judicial context, even in the force of the discipline referred to in Legislative Decree n. 196 of 2003
, is not subject to the obligation to provide information and to the prior acquisition of consent provided that the data are inherent to the field of business and judicial disputes that justify their collection, are not used for purposes other than those of justice for which they were acquired and there is an authorization provision (Cass. no. 1263 of 17/01/2022
; see Cass. no. 39531 of 13/12/2021
).

Furthermore, this Court has held that even in the validity of the GPR, the consolidated principles regarding the legitimacy of the processing of personal data without the consent of the interested party must be confirmed, provided that it is carried out in compliance with the criterion of "minimization" where it is essential for the protection of the vital interests of the person who discloses them or of his family (Cass. no. 9922 of 28/03/2022
).

6.- The Court therefore erred, once it had ascertained that the recording had been used in a trial, in considering that such conduct violated the legislation on the processing of personal data, thus unduly superimposing its own assessment on that of the judge of the trial where these data had been used; moreover, by referring to irrelevant parameters such as the circumstance that the recording had been carried out by a person other than those who had used it, without taking into account that at the time the recording was carried out, a different legislation was in force than that referred to in the contested judgment and that the subsequent use had occurred for defensive purposes, moreover in a labor dispute, which is generally aimed at removing economic and social obstacles to the judicial protection of the subordinate worker.

It follows, in accepting the first three grounds of the appeal, absorbed the fourth, the annulment of the contested judgment and since no further factual investigations are necessary, a decision can be made on the merits by rejecting the original appeal of B.B., E.E., C.C. and D.D., in accordance with the provision taken by the Guarantor.

In consideration of the overall procedural development and certain new aspects of the issues raised in today's proceedings, there are just reasons to compensate all the parties for the costs of the entire trial.

P.Q.M.

accepts the first three grounds of the appeal, absorbed the fourth; annuls the contested judgment and decides on the merits by rejecting the original appeal of B.B. E.E., C.C. and D.D., in accordance with the provision taken by the Guarantor.

Compensates all the parties for the costs of the entire trial. In the event of dissemination of this provision, omit the personal details and other identifying titles pursuant to art. 52 Legislative Decree 196/2003

Thus decided in Rome, on 12 July 2024.