Relevant GDPR Provisions
Paragraph 4) of the preamble of the GDPR states that the processing of personal data should be designed to serve humanity. The right to protect personal data is not an absolute right; it must be considered in relation to its role in society and balanced with other fundamental rights, in accordance with the principle of proportionality.
Paragraph 47) of the preamble of the GDPR provides that legitimate interests of the data controller, including those interests of the controller to whom personal data may be disclosed, or of a third party, can form the legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject do not prevail, considering reasonable expectations based on their relationship with the data controller.
Paragraph 20) of the preamble of the GDPR specifies that the competence of supervisory authorities should not cover the processing of personal data when courts act in their judicial capacity to protect the independence of the judiciary in performing judicial tasks, including issuing decisions.
Article 17, paragraph 3, item e) of the GDPR provides an exception to the right of data subjects to request the deletion of personal data, when such data processing is necessary for the establishment, exercise, or defense of legal claims.
Article 21, paragraph 1 of the GDPR states that data subjects have the right to object to the processing of their personal data based on legitimate interests at any time, considering the circumstances of their particular situation. The controller will no longer process the data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.
Given the above, GDPR allows for an assessment of the balance of interests, where the right to defense can first prevail over the right to protect personal data.
Circumstances of the Specific Case
During a meeting between company managers and employees aimed at resolving internal organizational issues, one of the employees ("Controller") secretly made an audio recording of the conversation, of which the managers were unaware.
Several years later, another employee used the recording as evidence in an employment dispute filed against the company.
As a result, the managers, as the data subjects, filed a complaint with the Italian Personal Data Protection Commissioner (Garante per la protezione dei dati personali – "Commissioner"), requesting the deletion of the recording.
Decisions of the Relevant Authorities
1. Decision of the Commissioner
The Commissioner rejected the complaint, stating that the use of the audio recording should be considered lawful data processing, as its sole purpose was to prove the employee's claims in the employment dispute.
2. Decision of the Court
The data subjects challenged the Commissioner’s decision before the Court of Venice (Tribunale di Venezia – "Court").
Contrary to the Commissioner’s view, the Court accepted the data subjects' arguments, concluding that the processing was unlawful and imposed a fine of EUR 5,000 on the Controller, along with an obligation to delete the data.
The Court justified its decision with the following reasoning:
- The provisions of Article 2(2)(c) of the GDPR, which exempts processing by a natural person in the course of purely personal or household activities, were not applicable.
- When the recording was made, there was no need for defense.
- The dispute in which the recording was used occurred several years later.
3. Decision of the Supreme Court
The Controller appealed the Court’s decision to the Italian Supreme Court of Cassation (Corte di Cassazione – "Supreme Court").
The Supreme Court justified its decision with the following reasoning:
- The fact that the then-applicable Italian personal data protection law stated that consent was not required from the data subjects when data processing was necessary for the establishment or defense of legal claims, provided the data was processed solely for those purposes and not longer than necessary to achieve them, irrespective of who made the recording.
- According to national case law, this rule applies not only during the course of the dispute but also for all preliminary activities necessary for collecting evidence to initiate and conduct a dispute.
- The EU Court of Justice's practice in the case C-268/21, Norra Stockholm Bygg, paragraph 58, where it was established that it is up to the judge in the particular case to decide whether to admit and use such evidence, after having assessed the balance between the right to protect personal data and the right to defense.
- The aforementioned provisions of the GDPR.
Conclusion
Taking the above into account, particularly the provisions of Articles 17(3)(e) and 21(1) of the GDPR, which allow the right to defense to potentially outweigh the right to protect personal data, and considering the provisions of the Italian Constitution guaranteeing high protection of employees' rights, the Supreme Court overturned the lower court's decision and upheld the Commissioner’s ruling that there had been no violation of the personal data of the managers in the recording.
Borinka Dobrnjac
Senior Associate
borinka.dobrnjac@prlegal.rs; legal@prlegal.rs;