In its ruling no. 2286 of 3 December 2021, the Court of Venice, Civil Section II, ruled on the legitimacy of an audio recording made by a third party during a court case. Two of the three defendants in their proceedings against the same employer, had produced an audio recording of a work meeting held two years earlier in their absence which was made by a colleague.
The Court of Venice confirmed that the EU Regulation no. 2016/679 ( GDPR) had to be applied in order to settle the dispute, given that the audio recording (a) constitutes automated processing of personal data and (b) in this case it did not represent processing carried out by an individual for personal activities – which would have excluded the application of the above European legislation – since it was connected “to a commercial or professional activity” as provided for in Recital no. 18 of the GDPR.
Having established that the audio recording constituted a data processing operation under privacy legislation, the Court focused on verifying the legitimacy of such processing under Art. 5 of the GDPR, stating that the processing should have been carried out by the data subject to protect his position within the company and provide evidence. This is without prejudice to the relevance of the recording to the defence argument and that the information was not excessive for the relevant purposes which, as stated by the legitimacy case law (see Court of Cassation Civil Labour Section ruling no. 12534/2019). The data processing lawfulness is based on the existence of a legitimate and interest in determining or exercising one’s right, in the absence of which the processing must be deemed unlawful. A person who carried out the data processing must demonstrate the existence of a litigious background or injury suffered that has led them to undertake the processing to protect their legitimate and binding interest.
Continue reading the full version published in Norme & Tributi Plus Diritto of Il Sole 24 Ore.
