Cass.Civ. (Italy) - 28358
|Cass.Civ. (Italy) - 28358
|Article 7 GDPR
Article 13 of the Italian Privacy Code
|Garante per la protezione dei dati personali
|National Case Number/Name:
|European Case Law Identifier:
|Supreme Court of Cassation of Italy (in Italian)
The Italian Supreme Court ruled that the data processing carried out by the appellant for reputation rating was lawful as it was correctly based on the consent of the data subjects.
English Summary[edit | edit source]
Facts[edit | edit source]
The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under Article 154(1)(d) of the Italian Privacy Code the mentioned data processing operations due to a breach of Articles 2, 3, 11, 23, 24 and 26 of the Code.
The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of Article 41 of the Civil Code, Article 8(2) of the European Charter for Fundamental Rights, Articles 13, 23, 26 of the Italian Privacy Code, as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative.
Holding[edit | edit source]
The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked.
Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subjects had to give their consent freely for a specific data processing and that information on the data processing had to be provided on the basis of Article 13 of the (now updated) Italian Privacy Code.
Therefore, because the data subjects were able to recognize the algorithm and the data processing, which was described to them by the appellant in an unambiguous and specific way, the Supreme Court repealed the judgment by the Court of Rome. Thus, it also found that it was not necessary to consider the third reason brought by the appellant.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Gene registry number a e 32022 Sectional number 4327/2023 General collection number 28358/2023 Publish date 10/10/2023 C om posadagiIlmiSiggri agisrat: Subject: President Ud.06/10/2023 CC Councilor LOREDANA NAZZICONE Director-Rel. ROSARIO CAIAZZO Councillor EDUARDO CAMPESE Councilor 2 c 3 6 5 9 he uttered the following: L And S T 7 A f L 5 Q 8 O to M on the appeal registered under no. 30123/2022 R.G. proposed by: 0 E 7 A (omitted) elect 8 A and I (omissis) 4 L (omissis) 5 6 U 4 Q (omissis) who represents and defends him 9 M 4 I there -recurring- r A S: against 3 D C or G e GUARANTEE FOR THE PROTECTION OF PERSONAL DATA, . m P E S W IT'S AT TO THE at B S R O (omissis) who represents and defends him : N D T s A and O And S -counterclaimant- I C U A L F I E I E ZOV L N filed on 06/21/2022. P G to to t t to to F F Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 Having read the report carried out in the council chamber on 06/10/2023 1. - With a provision dated 24 November 2016, the Guarantor for the protection of personal data prohibited, pursuant to art. 154, com m a 1, lett.d),d.lgs. n. 196 of 2003, the present treatment o future of personal data by the Association (omissis) (omitted) carried out via the system called (omissis) (omissis) for 2 with contrast with the articles. 2, 3, 11, 23, 24 and 26 of the aforementioned decree f 3 to legislative. The system aimed to constitute a web platform, with 4 and : the reputational issues concerning natural and legal persons, so as to e S T counteract phenomena based on the creation of artefactual profiles o 7 A f L "rating 5 E 8 O to M reputation" of the subjects registered, allowing third parties to verify 0 ER 6 P b AT of real credibility. 6 C b II 2. - According to the association, with sentence of 4 April 2018, n. 7 A 3 U 2 A 5 7 1 5 the Court of Rome partially upheld the appeal, 9 M 4 RE there canceling the measure for everything that did not concern the r A S: processing of personal data for the activity relating to the so-called "profile 3 a C or G s against"concerning third parties not associated with the appellant. . m . AND 3. - Upon appeal by the Guarantor, this Court with order of 25 S R C T P AV May 2 0 2 1 , n . 1 4 3 8 1 canceled with postponement of the A L's decision U S TO THE court, considering it flawed in terms of the conditions of a O D T legitimacy of the processing of personal data of the members of the s NA and O And S system based on consensus, which, pursuant to art. 23 Legislative Decree no. 196 I C U AN L R dated 2003, it must be "validly provided", i.e. "express C E The S freely and specifically» in reference to a treatment THE HONORABLE To E :G: D D t ot m m F Fi Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 "clearly identified", and this is only the case in which the subject is been previously informed in relation to a well treatment defined in its essential elements: while three, in the species, it it is defective due to the lack of transparency of the algorithm used at the specific purpose, nor is it relevant, as actually held by the court, the market response. « And - this Court concluded - it cannot logically state that joining a platform by of the associates also includes the acceptance of a system automated, which uses an algorithm, for the evaluation 2 objective nature of personal data, where the c 3 executive scheme in which the algorithm is expressed and the elements 6 5 9 considered for this purpose". 2 L r 4. - Deciding in the adjournment court, with the ruling of 2 2 S AND so b A d L 6 E of the Association. 2 D 3 MO The contested ruling held that the description of R 0 EP 7 A of the algorithm, contained in the Regulation for the determination 8 A b IC (omissis) 4 L of the rating annexed to the code of rep u ta tio n 6 U 4 Q universal (CRU), does not satisfy the principle of law indicated above: 5 A you was # I this, as the regulation does not explain the methods, or scheme i D and C executive, with which the member's rating is generated, but describes 3 TO C s only in comparative terms the impact of the individual data taken into N and . AND . R consideration; it is not explained how a result is processed, S O AND AT but only how variables are evaluated relative to others, i.e. A L U S R I if there is more or less in it, in a favorable sense or in a N sense D T unfavorable, in the calculation. It would have been necessary, instead, to indicate s NA and O And S the "specific weight" of the components considered by the algorithm in the I E D No To R determination of the result and the ways in which it is achieved C F N S it, including the interaction mechanisms between the various factors; Z V To Hon To E :G: D D t ot 3 of 13 m m F Fi Register number generates e 32022 Sectional number 4327/2023 General collection number 28358/2023 Publish date 10/10/2023 however, states the judge, «the regulation contains a comparative evaluation of the weight each parameter/data has provided by the interested party, taken into consideration by the algorithm for arrive at an evaluation". «[i]n the final analysis the regulation does not explain the execution scheme of the algorithm, but only provides a list of the factors taken into consideration for the rating of the various categories, without specifying how these data are then processed b by the algorithm", and this conclusion remains despite the assistance of the 8 b with a lens, as provided for by the regulation, because it is 6 4 And their intervention is not scheduled at the time of : to manifestation of consensus, but only at the moment of the creation of the and S T . 7 A f L Finally, it considered that there is also a conditioning 5 E 8 O to M to the freedom of members for the authorization to publish 6 P b T deeds and documents acquired through specific clauses in and IC b I contracts between the parties: upon revocation of consent, in accordance with 7 A 3 Q 2 A regulation, the payment of a penalty and the : F compensation for the greater damage, thus undermining the to D it's at S: free expression of consent and conditions autonomy C s negotiations of the members. N e To E . AND Against this ruling the Association has proposed a new S O AND AT A L appeal to cassation, on the basis of three reasons, which the defendant B A resists R O Guarantor with counter-appeal, also filing the brief. : N D T s No REASONS FOR THE DECISION and O And S O E D No To R application of the articles 384 and 394 c.p.c., as the Court did not act C F N S conformed to the principle of law enunciated by the Supreme Court, Z V To O To E :G: D D t ot m m F Fi Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 who had considered the consent given on the basis of it to be lawful knowledge of the executive scheme of the algorithm and the elements of which it is composed". The Regulation (omissis) explains, in fact, to the aspiring member the executive scheme of the algorithm and the elements of which it is composed reputational, specifically reporting the link to the Code of Universal Reputation (referred to in the certification World Ethics Committee,WEC — Worldwide Ethics Committee of 5 February 2016) and directly transcribing the articles. 10-18; 2 specifies that there are 5 parameters for natural persons and 4 for c 3 legal entities, consisting of a negative score in three items 6 5 9 2 L r score goes from A to Z) and a positive score in two items S AND a b A d L 6 E from 0 to 100), of which only the last is missing for legal entities; 2 D 3 MO indicates the detail of the R outline in 25 pages 0 EP 7 A of the algorithm and the elements of which it is composed. 8 A b IC 4 L It includes more than six hundred indicators. 6 U 4 Q For the crime category, there are subcategories of crimes, 5 A you was # I stated in a progressively less serious manner, as for penalties; the D and C for the tax and contribution category, 5 classes are identified, a 3 a TO C s depending on the amounts; for the civil category of natural persons, N e . AND . R equally important are the subcategories of disputes, in order of S O AND AT d ecreasing severity (family, work, ot hers in fulfilments U S R I contractual, non-contractual damages and inheritance), each with a N D T "weight" proportional to the disvalue defined by the C R U and for it by the s NA and O And S World Ethics Committee, and to each of the 5 amount classes it is I E D No To R attributed a specific "weight" to gravity C F N S Z V To Hon To E :G: D D t ot 5 of 13 m m F Fi Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 As for the classes "studies and training category" and "category i study (from primary school diploma to research doctorate, second with numerous further partitions Special parameters are then used for legal entities private. Since the European patent has been requested, the document is published by the European Patent Office b 3 on "open sources" and easily knowable by anyone, and it 8 b und erstanding the "mathematical oper ation diagram 6 5 9 2 L r According to the appellant, it is necessary to understand the concept of S AND "executive scheme of the algorithm", whose scope definition b A d L 6 litres the general era is as follows: «The steps that make up the 5D scheme 3 MO d R they must be "elementary", i.e. not further decomposable 0 EP 7 A (atomicity); the steps that make up the scheme must be 8 A and IC b L interpretable in a direct and univocal way by the performer, be it 7 A 4 Q 5 A human or artificial (unambiguous); the algorithm must be finite, and RM : F i.e. composed of a defined number of steps linked to a to D it's at S: defined quantity of input data (finiteness); the execution of A D C s scheme must occur within a finite time (termination); G e . m P E the execution of the algorithmic scheme must lead to a unique S R C T P AV result (effectiveness)". B A U S And the documentation produced in the referral proceedings reveals the A I to the W or N satisfaction of all the above conditions: the specific cases s A m CO And S subject to reputational assessment are codified and have I C U AN typical and mandatory character and are easy to interpret; at every L RF I E I E in this case a specific value determined on the basis of Z V is attributed THE HONORABLE P GE to to: D D to at 6 of 13 r mr F Fi Genl register number 30123/2022 Sectional number 4327/2023 General contract number 28358/2023 Publication date 10/10/2023 ethical assessments that guarantee the coherence of the results; the various steps for the preparation of the rating, which is received always with a single result, they are specifi cally indicated and guided. what was held by the referring judge does not pertain to the need to transparency and knowability of the algorithm, as it presupposes al on the contrary highly specialized knowledge, which is placed beyond outside the cultural baggage possessed by the generality of users and b 3 of the members of the association, thus having the judge of 8 b an abnormal performance, which is not recognisable, is worth mentioning, 6 5 9 2 L r currently used on the web for profiling purposes (for example, S AND b A d L 6 litres Furthermore, unlike what was stated in the contested 5 D 3 m d R sentence, the simulation of the reputational rating envisaged by the 0 P 7 A Regulation (omitted) occurs before the performance of 8 A and I b L consent, allowing full and preventive understanding 7 A 4 Q 5 A of the functioning of the algorithm tested in practice, such as and R : F the Tribunal also misrepresented the logical and temporal consecutio to D it's at S: of the assistance of the "reputational lens" to the interested party, A D C or provided for in the regulation. G e . m P E 2 . - With the sec ond m o tiv e, d u c e the violation or false S R C T P V application of the art. 115 c.p.c. and the nullity of the sentence for B A U S omitted and considered a fact that is critical to the decision of the IA to the W or N with controversy, pursuant to art. 360, paragraph 1, n n. 3 and 5, c.p.c., s A m C And S because - even if one wanted to deem explanation necessary I C U A of the more specifically scientific-mathematical algorithm - L F I E I E however, the examination of documents crucial to the Z V would have been missing L N P G to to D D to to r r F F Genl register number 30123/2022 Sectional number 4327/2023 General contract number 28358/2023 Publication date 10/10/2023 purposes of the decision: in fact, the Court did not consider the at all c o s t a n c e o f t h e European patent request, in which it is the mathematical scheme of the algorithm is represented. Instead, the mathematical operation scheme of the algorithm (A system and a m ethod for calculating param eters for the determination of the reputational rating of natural and alloy/ persons) is published by the European Patent Office on "sources open" and easily knowable by anyone from February 12th 2 0 1 5, consisting of 1 3 1 pages, which include 7 3 figures b 3 illus tra tiv e of the m a tic o f functi on s chem 8 b of the algorithm. 6 5 9 But the Court ruled by showing that it disregarded the 2 ll r attached to the factual circumstances and, above all, from the examination of the S AND document containing the mathematical scheme of the algorithm, b A d L 6 litres pri ving the m o tiv atio nal d isc e r of the n ecessary unit 5 D 3 m d R argumentative that undermines its entire logical sustainability. 0 P 7 A 3. - With the third reason, he deduces the false application of the articles. 8 A and I b L 41 C ost. 1321 and 1322 of the Civil Code, 8, paragraph 2, of the Fundamental Charter 7A 4 Q 5 A of the European Union, 1 3 , 2 3 and 2 6 Legislative Decree s. n. 1 9 6 of 2 0 0 3 and 7 .4 and R : F G DPR, regarding the protection of the principle of freedom of autonomy to D it's at S: negotiation, with regard to: C s contractual clauses relating to the publication of documents and G and . m P E documents; C T P V of the authorization to publish data relating to non-compliance B A U S contractual. A I to the W or N The trial judge erred in deeming that it was m C And S the freedom of his associates is restricted in the authorization of the IC U A publication of documents and documents, acquired through the aforementioned L F I E I E Z V L N P G to to D D to to 8 of 13 r r F F Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 clauses in the contracts between the parties, or at the time of revocation of consent. For the clausesub a),in fact, neither the statute nor the regulation of the association impose on the members the obligation to adoption of the contractual clause in relations with counterparties, lim itandos (omissis) to suggest its adoption: essentially, the provision of the clause in question and goes beyond the scope of the restriction associative, rather referring to a possible negotiating relationship implemented between certain members; it is not, therefore, a b 3 clause that pertains to the associative relationship, nor does it place a constraint on 8 b burden of the members. 6 5 9 For the clausesub b),the clause occurs only where the subject 2 L r interested party revokes the authorization for the service manager, S AND «which identifies the Customer's failure to fulfill the obligations arising a b A d L 6 litres his burden" (above all, the obligation to provide truthful data), can 5 D 3 MO d R publish on the platform 7 A dispute (with any documented replies)», as well as «an 8 A and IC b L reputational profile of the same Customer, of which the same 7 A 4 Q 5 A On the basis of the aforementioned associative constraint, the Customer declares : F know the characteristics". to D it's at S: In essence, the clause in question, far from affecting the A D C or freedom of consent to the processing of data, determined in a G e . m P E P ro p o r ti o n d of f a l e r e c t a r e n t s o S R C T P AV deceived by interested parties. Since then B A U S conduct pertains to the relationship with the "reputation consultant", a A I to the W or NT due to the member's false declarations, the clause compensates the s A m CO And S I C U AN taken on with the subject found in compliance. The only clause is L RF I E I E functional to the correct execution of the relationship between the two, both Z V THE HONORABLE P GE to to: D D to at 9 of 13 r mr F Fi Genl register number 30123/2022 Sectional number 4327/2023 General contract number 28358/2023 Publication date 10/10/2023 (omitted) associated with but does not affect the associative relationship and on the effective freedom of consent to data processing. 4. - The first two reasons, to be treated jointly since intimately connected, are founded, within the limits set out below. 4.1. - The trial judge was asked to verify, on the basis of the rules of the initiativefrom here,if the treatment carried out with information means it would be equally transparent with regarding the algorithm for calculating the so-called reputational rating, fulcrum of the entire system designed in this regard. 2 According to the harsh opinion, in fact, the necessary 3 to factual assessment - in order to assess the validity of the legislative decree 4 and consent due to the existence of effective knowledge: the aware of the objectives and methods of carrying them out S T treatm ent - re garding the transpar ency and obscenity of the 7 A's f L functional characteristics of the algorithm. 5 E 8 O to M What is required, that is, is not that the associate must be 0 E 6 P b T knowex antewith certainty the final outcome of the assessments that the 6 C b I artificial intelligence system operates - because otherwise it would be 7 A 3 U 2 A less useful - but the proceeding which is conducted at 9 M 4 I there same. r A S: 4 .2 . - In mathematics, a procedure to follow comes 3rd C or G s described synthetically by an equation, which is made up of . m . AND S R C T P V The algorithm is a procedure for solving a problem: from A L U S TO THE certain input data(input)derive solutions (output). to the W D T The "executive scheme" of a specific algorithm, therefore, is and O And S steps to be performed in sequence, to reach the result. I C U A L R Studies of the subject matter know that a lgorithm is C E The S constructible, if the data and the procedure comply with some requirements. Z V L N To E : : D D t t 10 of 13 m m F F Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 requiring that the steps be elementary, unique, in number finite, operable in a finite time and with a single result. And, in this case, it is not a question of whether the algorithm, for function algebraically and therefore for the computer process, possessed these requirements. 4.3. - The true point is that, in the matter for which it is the cause - as in others, where they are similarly observed in the order with revision oscibility entrusted to an algorithm - it's not the 2 ui c 3 to it serves to understand whether the consent given by the subject 4 can speak knowledgeably and knowledgeably; that is, if, as stated : the the rescission order of the Court, the consent has been, pursuant to and S T of the art. 23 Legislative Decree no. 196 of 2003, "validly provided". 7 A f L According to the art. 23 Legislative Decree. n. 196 of 2003, applicable ratione 5 E 2 O to M temporis with regard to the provision of the opposing guarantor, on 0 ER 6 P b T consent makes the processing of personal data by 6 A lawful b IF private individuals, and, the rule continues, it can concern the entire treatment 4 L 6 U 4 Q or one or more operations thereof. And it «is validly 5 M 4 RE # I provided only if it is freely and specifically expressed in i D and C 3 to reference to a clearly identified treatment, if it is A D C s documented in writing, and if the N and To E . AND S O AND AT A L The art. specifies. 13 that the interested party must be previously informed B A R O regarding the purposes and methods of the processing for which the: N D O or N data, the mandatory or optional nature of the provision of data, s A m CO AND IF the consequences of a refusal to answer, the subjects or categories I C U AN of subjects to whom personal data may be communicated, L RF I E I E who can come to know us as responsible and Z V THE HONORABLE P GE to to: D D to at r mr F Fi Genl register number 30123/2022 Sectional number 4327/2023 General registration number 28358/2023 Publication date 10/10/2023 the scope of dissemination of the same data, as well as the rights to him due. The requirements of consent are, therefore, the free and specific in reference to a clearly identified treatment and the prior information referred to in the art. 13, that is, in particular, approximately and themodalitiesof the treatment. When, as in the present case, the personal data are intended for be "worked" by a given rhythm, it must therefore also be m ode be covered by consensus. 2 Therefore, in the matter in question, to integrate the conditions of the c 3 to "free and specific"consent, for it to be legitimate and valid, is 4 it is required that the aspiring associate be able to know and : the the algorithm, understood as a reliable procedure for obtaining a and S T certain result or solve a certain problem, which is described 7 A f L to the user unambiguously and in a detailed manner, such as 5 E 2 O to M capable of leading to the result in a finite time. 0 E 6 P b T Then, the procedure, as explained with the terms of 6 A b F common language, is also suitable to be translated into 4 L language 6 U 4 Q mathematics is as necessary and certain as it is irrelevant: ed 5 M 4 I # I in truth, it is neither required nor required that this mathematical language be and C 3 to exposed to users, much less that they understand it. TO C s What is important, however, is that it is possible to translate N e into language To E . AND mathematical/computer science the starting data, so that everything becomes S O IT'S AT A L suitably understandable by the machine, thanks to the B A subjects R O expert programmers, according to the sequences and instructions drawn: N D O or N from "unencrypted" data, as described in the regulation cited several times. s A m C AND AND 4.3. - Now, on the basis of the findings carried out by judge I C U A of the merit, these reference parameters were all present in the L F I E I E regulation. Z V LON P G to to D D to to r r F F Genl register number 30123/2022 Sectional number 4327/2023 General collection number 28358/2023 Publication date 10/10/2023 While the claim that the "weight" was indicated is not understood specific" of the various criteria - given that it is a scientific term, concerningthe relationship between the weight and volume of a matter, not always being appropriate to transfer the terms of others to the law sciences - you may not even agree with logic or with someone of the criteria underlying the system illustrated in the regulation, which the first reason for the appeal states: but this issue is not relevant now, requesting consent for the purposes of processing personal data of the interested party, only that the system of ostensible parameters was 2 sufficiently determined. c 3 to And this is precisely the factual situation, ascertained by the judge d 4 of merit, hence its assumption in the specific case of the valid and : the consent was due, according to the control entrusted to this Court in e S T seat of legitimacy. 7 A f L - The third reason is absorbed. 5 E 2 O to M 6. - Upon acceptance of the appeal, the contested sentence is 0 ER 6 P b T quashed and, as no further factual investigations are necessary, 6 A b IF case decided on the merits, pursuant to art. 384, paragraph 2, c.p.c., with 4 L 6 U 4 Q 6. 5 m 4 RI # I 7. - The newness of the question in d u c e to the integral D and C 3 to compensation for the costs of the entire trial. TO C s P.Q.M. N e To E . AND The Court accepts the first and second grounds of the appeal, S O AND AT A L absorbed the third; set aside the contested sentence and, deciding in B A R O : N D O or N It compensates the litigation costs between the parties for the entire trial. s A m CO AND IF Thus decided in Rome, in the council chamber of 6.10.2023. I C U AN The President L RF I E I E Francesco Antonio Genovese Z V THE HONORABLE P GE to to: D D to at 13 of 13 r mr F Fi