Data protection as a criminal matter in Italy

Who is told that data handling has become a criminal matter

An employee copied a customer list before moving to a competitor and found a letter from the old company. A system administrator opened a colleague's mailbox to find a file and was reported. A manager installed monitoring software on staff computers and received a complaint. A marketing team bought a database and sent messages to thousands of people, and a person in the list wrote to the authority. Each of them believed the matter was administrative, and each is now reading about offences.

Other readers are on the opposite side: their own data was taken. A former partner opened their accounts. A company lost a customer database to an intruder. A person's private images were disclosed and they want to know whether to report. Some are directors of firms who have received a request from the supervisory authority and want to know whether false or incomplete answers could be a problem in themselves.

What links these people is a surprise. Most associate data protection with administrative fines, and those do exist. Italian law also keeps criminal offences: unlawful processing causing harm, unlawful disclosure of data on a large scale, fraudulent acquisition of personal data, false statements to the authority and failure to comply with its orders. The offences often arrive together with a charge of unauthorised access to a system, which is treated as a separate crime. This page explains how to react when a matter that looked administrative opens a criminal file.

Decisions in the days after a complaint or an inspection

The way a data case is handled early shapes its later course. Several decisions are urgent, and each has a price.

• Deleting or restoring data. The instinct is to remove what should not have been kept. Doing so after a complaint can be read as destroying evidence, and it can also destroy your own proof of what was stored and why. Preserve before anything else, and let the lawyer decide what can safely be removed.
• Answering the authority. Requests from the supervisory authority come with deadlines, and false or incomplete statements are themselves an offence. A reply that is late is a problem; a reply that is wrong is worse. Draft it with the lawyer.
• Admitting the access. An employee who opened a mailbox may want to explain it was routine. The explanation is also a statement that access happened, with the reason, the time and the authority claimed.
• Telling affected individuals. A company may have duties to notify people. Doing so quickly helps them, but the wording matters in a criminal context.
• Separating the company from the individual. A director and a firm may have different interests, and a lawyer may not be able to serve both.

The sequence should be: preserve, assess, then communicate. Write it into a short instruction and give it to the people who handle the systems, so that nobody acts on instinct while the lawyer is being reached.

Records that show what was collected, why and by whom

A data case turns on logs, purposes and permissions. Collect them while systems still hold them.

• Access logs for the system, mailbox or database involved, exported with dates and user names before routine deletion removes them.
• The written rules the organisation had: privacy notices, internal policies, employee instructions and any consent forms.
• Your contract or appointment documents, showing what your role allowed you to open or copy.
• Emails or messages that explain why an action was taken, who asked for it and who approved it.
• For marketing databases, the source of the data, the contract with the seller, proof of consent and any opt-out records.
• For monitoring, the notices given to staff, the software configuration and any agreement with employee representatives.
• Complaint papers and the supervisory authority's requests, with every deadline noted.
• Proof of any authorisation to access: a written instruction, a helpdesk ticket, a manager's email asking for the file.
• The list of people who knew the data was copied or opened, and when each of them learned of it.
• Backups or snapshots taken before the event, showing the earlier state of the system, if they exist.
• For a person whose data was taken, screenshots of the unauthorised use, the dates and the accounts affected, plus any report already filed.

Make copies in a form that cannot be altered, and note who made them and when.

What a data case does to a job, a business and a reputation

For an employee, the consequence is usually immediate. Access to systems is cut, an internal investigation begins, and a disciplinary process may start in parallel with the criminal case. A dismissal for misuse of data can follow, and a reference given later may mention it. A person in a regulated trade may face a report to the body that supervises it.

For a company, a data matter can affect contracts. Clients and partners ask for assurances, public tenders ask about criminal proceedings, and insurers want notice. A business that depends on customer lists may find itself unable to use them while an investigation continues. The management team has to divide its time between the file and the business.

For individuals whose data was taken, the issue is different. They worry about identity theft, about exposure of private messages or images, and about what the person who has the data may do next. They also face a choice about reporting that has its own price in time and attention. Reputation travels differently in each case. A named employee may be mentioned in an industry forum, while a person whose private material has been leaked may find it spread beyond any chance of recall. Families are drawn in because accounts and devices are often shared at home.

Questions that separate a data file from an ordinary criminal file

These questions apply to data matters specifically.

• Which conduct is described as unlawful: processing, disclosure, acquisition or access, and what separates them in my file?
• Does the offence require an intention to profit or to harm, and what is said about my purpose?
• If access to the system was authorised, how can it still be unlawful?
• What is the position of the company, and does the organisation answer separately from me?
• Can the supervisory authority and the criminal court reach different results on the same facts?
• Does paying an administrative fine have any effect on the criminal file?
• If a device was seized, how do I protect privileged communications and unrelated personal material?
• If my data was taken, what should I preserve and where do I report?
• Is there a time limit for answering the authority, and what happens if the lawyer needs more time to read the file?
• If I acted on a manager's instruction, how does my responsibility differ from his?
• May I keep working with the system while the matter is open, or should I step back?
• What does a criminal file mean for my work in a regulated trade or for a security clearance?

The answers depend on the facts, so bring the logs and the policies to the conversation.

Things not to do when systems, logs or devices are at stake

These habits cause avoidable harm in data matters.

• Do not delete logs, emails or backups. The deletion will itself appear in the logs.
• Do not log in again to check what was accessed. Each access changes the record.
• Do not forward the data to yourself or to a personal account to keep proof. That can be a new act of copying.
• Do not confront a colleague or former partner about the access. The conversation will be quoted.
• Do not answer the authority by email in a hurry. The reply is a document, and false statements to it carry their own risk.
• Do not post about the incident. A public statement from a company can be a disclosure itself.
• Do not hand over passwords casually. Access to an account usually gives access to others.
• Do not rename, move or reorganise files to tidy up. Changing folder structures alters metadata and can look like concealment.
• Do not let the company lawyer speak for you without checking. The interests of firm and individual may diverge.
• Do not rely on a manager's verbal approval. Without writing, the instruction may be denied later. Ask for confirmation by email and keep it.
• Do not use the data again while the matter is open. A fresh use after a complaint is read as intent.

When the data, the servers or the people are in different countries

Data cases cross borders more easily than any other kind. A customer base may sit on servers in another state, an intruder may be abroad, a cloud provider may keep copies in another place, and the employee who did the copying may be a foreign national who has since gone home. Each location has its own rules about disclosure, and each makes it harder to know what is lawful.

Evidence from another country, such as logs held by a hosting company, usually arrives through a formal request, and the delay can be long. Ask the lawyer early whether it is needed and whether to request it. Documents in a foreign language, such as the privacy notice used by a parent company, need careful translation so that their meaning is preserved.

Time zones matter when a provider has to be contacted urgently. Support desks often do not understand the urgency, and written requests with dates are better than calls. If the data subject or the respondent is abroad, they will need a lawyer there who can explain local obligations to notify. The Italian lawyer coordinates with that counsel to avoid giving contradictory messages to authorities in different states. Consulates have no role in the substance but can help with interpreters and with finding local counsel.

How the firm handles a data matter, from the opening message

Send the complaint, the authority's letter or the record of seizure, along with the policies in force and a short explanation of your role. The email address is avvmassimoromano@gmail.com, and the telephone number on this page is also available on WhatsApp.

The opening call clarifies who is who: the individual, the company, the complainant and the authority. The lawyer asks what systems are involved, who has access, whether logs exist and what has already been said or deleted. The call ends with a plan for the next hours, normally preservation, then a review of what the authority asked, then a decision about who answers.

Work is conducted in English. Documents in Italian are explained in plain terms, and technical material can be reviewed with an expert chosen by the firm in agreement with you. The firm has offices in Rome, Milan and Naples, so a matter anywhere in the country can be followed in person. Where systems or people are abroad, a correspondent there is asked to take statements and collect records in the form an Italian office will accept. The engagement is set out in writing, with the scope and the way of reporting stated plainly. Short written updates follow each step, so that a family member or a director who cannot attend a call still has the position in hand, and if a hearing or an inspection is called at short notice the lawyer can be reached by telephone outside office hours.

Words from complaints, orders and inspection notes

The terms below come from the page itself. Each has a narrower sense than in everyday use.

• Unlawful processing — handling personal data without a valid basis, which becomes criminal when it causes harm and was done for profit or to cause harm.
• Disclosure on a large scale — making data available to many people. Volume is what raises the seriousness.
• Fraudulent acquisition — obtaining personal data by deception.
• False statements to the authority — untrue information given in proceedings before the supervisory body.
• Failure to comply with an order — ignoring an instruction the authority has issued.
• Unlawful access — entering or staying in a protected system against the wishes of the holder, which can include misuse of credentials you were given.
• Monitoring — observing employees through software or devices, which is lawful only within conditions.
• Supervisory authority — the independent body that regulates data handling and can both fine and refer matters for prosecution.

When a notice uses a word that is not on this list, send it to the lawyer without translating it yourself. A word that sounds technical may have a narrow legal meaning, and a word that sounds legal may be a software term, so ask which sense is meant before replying. Ask also how the organisation itself has described the incident in writing, since an internal description can differ from the way a prosecutor will put it.