With its order no. 32533, filed 14 December last, the Italian Court of Cassation established that employees, when subject to disciplinary procedures, have the right to access the records concerning them. The Court thus confirmed the full scope of the “right of access”, as governed by Article 7 of the Italian Privacy Code, which was in effect at the time of the events described below, and in accordance with the provisions of Article 15 of EU Regulation 679/2016 (“GDPR”), which is currently applicable.
The facts
The case originated from an appeal submitted by a Bank firstly against the provision issued by the Italian Data Protection Authority [Garante per la protezione dei dati personali] (the “Authority”), and subsequently against the judgment of the Court with territorial jurisdiction, which had upheld the Authority’s position.
In this specific case, following notification that he was being subject to a disciplinary penalty (suspension from service and from the relative financial treatment for one day), an employee of the Bank requested to see the background records that had led to the penalty, which included the assessments made about him.
The requested documents had been provided for in an internal circular dating back to 2009, and specifically the (i) “Notice in the form of a written report sent to “Discipline” by the Central and Local HR Manager”, and (ii) the “Accompanying letter in which the HR Manager makes assessments jointly with the Manager of the local or central office”.
When invited by the Authority to provide a reply to the employee’s requests, the Bank responded that the aforementioned documents
– contained company data “strictly for internal use”, which was also protected by privacy legislation and subject to the right to organize and manage one’s own activity (Article 41 of the Italian Constitution), and
– were “intraprocedural records”, pertaining only to the precise moment at which the employer’s will was formed. According to the Bank, they could not be deemed relevant for the purposes of the worker’s opposing right of defence. This was a right which, in the Bank’s opinion, had already been guaranteed since all of the necessary information had been provided in the letters notifying the employer of the charges against him.
The Court upheld the Authority’s Provision and rejected the Bank’s appeal, deeming that
(i) the principles governing defence in disciplinary procedures and in court had absolutely not been respected, and
(ii) the Bank could have simply removed any passages of the requested documentation that were not relevant for the purposes of the worker’s requests if they were prejudicial to any right to confidentiality established in favour of third parties.
In essence, the Court declared that the employer’s decision to keep some aspects of its own organizational decisions private was unlawful: “the party cannot be entitled to decide, at its own discretion, what can or cannot be made available, since such a situation would also allow the appellant company to control all decisions concerning the counterparty’s ability to establish a defence”.
The Bank filed an appeal against the Court’s ruling at the Court of Cassation, requesting that the dispute be dealt with at a public hearing, given the significance of the issue.
The ruling of the Court
The ruling of the Court focused on three main points, as outlined below.
- The balancing of the interests involved
In this regard, the Supreme Court of Cassation made the same assessments as the trial judge, as mentioned above, deeming that – following the balancing of opposing interests – the worker’s right of access prevails over the confidentiality requirements asserted by the Bank.
In the Court’s opinion, the Bank could have allowed access to the documents containing assessments about the employee while also protecting the third parties, by redacting information that could be prejudicial to them, for example.
- The extensive interpretation of the right of access
Moreover, in upholding the ruling handed down by the trial judge, the Court of Cassation specified that the right of access cannot be understood – in a restrictive sense – as the mere right to know any new information in addition to that which has already become known to the interested party: the scope of the right in question is much broader.
According to the Court, the purpose of the right of access is – in protection of the interested party’s dignity and privacy – to guarantee that he can verify ratione temporis whether his personal data (i) has been entered, (ii) remains on record, or (iii) has been removed, regardless of whether or not the interested party has become aware of such information by other means and on different occasions (see the reference to the aforementioned letters notifying the employee of the charges). Therefore, the right to this verification must be guaranteed through the interested party having access to his own personal data at all times during the employment relationship.
- The right of access, with specific reference to documents concerning the employment relationship
Finally, the Court of Cassation confirmed and reiterated the orientation that it had established previously, aimed at guaranteeing the right of access to documentation concerning matters connected to the employment relationship. This is applicable both to cases in which that documentation is required by law and to cases in which the documentation is provided for by the business organization, through internal circulars, for example (cf. Court of Cassation Judgment no. 9961 of 2007, inter alia), as in the case at hand.
Conclusions
In essence, the Court of Cassation deems that the legislative and regulatory provisions on the “right of access” do not suggest any specific limitation with regard to the specific purposes for which it may or may not be exercised. Therefore, the right in question can be duly exercised by the employee for the purposes of his own defence.