Garante per la protezione dei dati personali – Court Ruling (Italy, 2023)

The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under [https://www.garanteprivacy.it/codice Article 154(1)(d) of the Italian Privacy Code] the mentioned data processing operations due to a breach of [https://www.garanteprivacy.it/codice Articles 2, 3, 11, 23, 24 and 26 of the Code]. The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of [https://www.gazzettaufficiale.it/anteprima/codici/codiceCivile Article 41 of the Civil Code], [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the European Charter for Fundamental Rights], [https://www.garanteprivacy.it/codice Articles 13, 23, 26 of the Italian Privacy Code], as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative. The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked. Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subjects had to give their consent freely for a specific data processing and that information on the data processing had to be provided on the basis of [https://www.garanteprivacy.it/codice Article 13 of the (now updated) Italian Privacy Code]. Therefore, because the data subjects were able to recognize the algorithm and the data processing, which was described to them by the appellant in an unambiguous and specific way, the Supreme Court repealed the judgment by the Court of Rome. Thus, it also found that it was not necessary to consider the third reason brought by the appellant.