With two judgments of May 2018, the Supreme Court once again ruled on a particular case, which was an opportunity to summarize some principles regarding privacy: in particular, the Court of Cassation had to assess whether it is legitimate, by a worker to record conversations and / or videos in the workplace and without the knowledge of colleagues.

The Supreme Court examined the case of an employee who had delivered a USB stick containing recordings of conversations made during working hours and at work, involving other employees, without their knowledge.

Upon further verification, it was found that the employee had made other recordings, as reported by work colleagues who had reported seeing him also take pictures and shoot videos in the workplace, without any authorization from them. Therefore, a disciplinary procedure was initiated, which ended with the dismissal of the employee, his actions deemed unlawful by the Court.

The Supreme Court stated that the processing of personal data is only permitted with the express consent of the person concerned and therefore highlighted that “the processing of personal data, normally admitted in the presence of the consent of the interested party, can be performed even in the absence of such consent, if it is aimed at asserting or defending a right in court or to carry out the defensive investigations and this provided that the data are processed exclusively for such purposes and for the period strictly necessary for their pursuit.

It is specified that this exception makes the activity, if carried out in compliance with the conditions laid down therein, is in itself already lawful.

Therefore, where the processing of personal data, made in the absence of the consent of the data owner themselves, it is strictly instrumental to the judicial protection of a right by those who carry out such treatment, the presupposition of illicit conduct is non-existent.

In light of the above, it is clear that, in order to verify the existence of a hypothetical derogating from the general rule (need for consent to data processing), the judge must make an assessment of the circumstances of the case, not being sufficient, on the part of the employee, to affirm that such treatment would be aimed at exercising his right of defense.