“Violates the employer’s directives (even if implicit, but clear) the employee who, although in a hierarchically superior position to the holder of the access credentials to a company’s IT system, has them revealed in order to gain access without specific authorization: the protection of data through access credentials alone is sufficient to make such directives clear”. This has been established by the Supreme Court of Italy, Criminal Section V, no. 40295/2024.
An employee of a hotel in Chianciano Terme (Italy) had requested from another employee, directly subordinate to him, the access keys to the company’s IT system for the storage and promotional purposes of the customer database, which included about 90,000 individual records, accessing it for purposes unrelated to the mandate received. In the first two levels of judgment, was established the commission of the crime of «Unauthorized access to an IT or telematic system», under Article 615-ter, paragraph 1, of the Italian Penal Code.
The employee appealed to the Italian Supreme Court, claiming that it was not an abuse access, both because he had the power «in his capacity as director and superior manager of the employee» from whom he had requested for the credentials, «also for the purpose of supervising her work» and because until shortly before, he had a personal and direct access to those data.
The Supreme Court of Italy ruled that the offence of unauthorized access to IT systems (under Article 615-ter, paragraph 1, of the Italian Penal Code) also occurs in the case of a hierarchical superior using the access credentials provided by the employee.
The judges of the Italian Supreme Court did not find convincing the appellant’s argument that relied on his power to access any company location in order to carry out checks on those hierarchically subordinate to him. In the case of an IT system protected by credentials, the Court pointed out that «each authorized person has his/her own ‘key’ (i.e., the access credentials)». «This is because it is data which, quite simply, the owner considers should be protected, both by limiting access to those who are provided with such credentials and, at the same time, by ensuring that a digital trace is left of the individual access and of who carries them out ».
It is therefore incorrect to hold that the defendant «solely by virtue of his duties, automatically had the power to access data that, on the other hand, according to the employer’s discretionary assessment, were to remain available only to certain employees (even if subordinate to the appellant) »
Moreover, by doing so, the appellant made it «falsely appear that the access had been made by the employee who, imprudently, had revealed her credentials to him».
Other related insights:
Published in the Italian Official Gazette on December 28, 2024, the so-called “Collegato Lavoro” – which contains provisions on labor matters introduced by the Italian Government and connected to the Budget Law – will officially come into force on January 12, 2025.
Among the main changes introduced:
The Italian Court of Cassation, in the recent sentence no. 26765 dated 15 October 2024, rejected the appeal of a pharmaceutical sales representative who had been dismissed after being caught by his employer lying about the visits made to certain medical doctors as reported in his monthly report.
The case originates from an appeal filed by a pharmaceutical representative against the dismissal for just cause imposed by his employer. The employee was terminated with immediate effect, pursuant to Article 2119 of the Italian Civil Code, for falsifying the monthly report regarding visits made to medical doctors, reporting a significantly higher number of visits than those actually conducted.
The pharmaceutical company had hired a private investigator to verify the accuracy of the information provided by the employee; the investigations conducted confirmed that the employee had lied, reporting activities that were not actually carried out. Specifically, the investigations revealed that, for three consecutive days, the representative had visited far fewer medical doctors than indicated in the monthly report submitted to the employer and had falsely claimed to have visited locations he had not actually been to. Even the visit times reported by the employee were found to be false, as it was established that during those times, he was engaged in personal and recreational activities.
Both the Court of First Instance and the Court of Appeal of Catanzaro upheld the dismissal, deeming the trust relationship between the employee and the company to be irreparably damaged. In particular, the judges considered the employee’s conduct “serious,” especially given that the monthly report submitted by the employee was the employer’s only means to monitor his activities as a pharmaceutical representative, as he enjoyed considerable freedom of movement and self-organization.
Moreover, it was noted that such documentation was also necessary for the company to fulfill its communication obligations to the Italian regulatory authority, AIFA. Consequently, had also found itself, unintentionally, reporting incorrect data to AIFA on the number of medical doctors visited and the average number of interviews conducted by its representatives.
The employee, considering the dismissal disproportionate, appealed the Court of Appeal’s judgment, arguing that his conduct could not justify the dismissal, as it was, at most, a mere “alteration of a timesheet or badge” which, under the NBCA for the Chemical Pharmaceutical sector, would warrant only a disciplinary sanction.
However, the Court of Cassation upheld the Court of Appeal’s decision, asserting that the employee’s conduct did not amount to a mere badge alteration but rather a more serious falsification of an information report on actual work activity performed at specific doctors’ offices and locations, punishable by immediate dismissal under the NBCA.
In conclusion, the Court rejected the employee’s appeal and ordered him to pay the legal costs.
The Supreme Court, by its decision no. 28171 of 31 October 2024, confirmed the validity of a dismissal notified to the employee’s previous address if the employee did not promptly notify the employer of his change of residence or domicile.
The employee, challenging the dismissal, challenged the validity of the notification made to his original address, arguing that, because of his transfer, that notification should be considered invalid.
The Court, rejecting the appeal, ruled that “the dismissal sent to the known address is fully effective, if done within the prescribed time limits”, as it is the worker’s responsibility to notify any change of residence or domicile in writing, as stipulated by the NCBAs and by the principle of good faith that governs the employment relationship. In particular, the Supreme Court referred to Article 1335 of the Civil Code, which states that a communication is deemed to be known at the time it is sent to the known address, and clarified that the employee’s failure to communicate the change of residence does not affect the validity of the notification. This principle was also extended to the letter of disciplinary notice, which is therefore to be considered fully effective once it reaches the employee’s original address.
In its decision no. 10104 of 12 October 2024, the Court of Rome ruled that in the case of a disciplinary dismissal without prior notice, there is not a mere formal deviation from the procedural scheme of the regulation, but an actual nullity which always gives the employee the right to reinstatement.
The employee, a pastry chef at a commercial establishment with less than 15 employees, was dismissed for just cause without a prior disciplinary notice.
The employee challenged in Court the disciplinary dismissal inflicted, claiming – among other things – a breach of the procedure laid down by Article 7 of Law 300/1970, since the employer had failed to give him prior notice of the charge.
The Court of first instance of Rome, preliminarily stated that the employer was an enterprise with fewer than 15 employees and that the employee was hired after the entry into force of Legislative Decree no. 23/2015.
In the absence of the dimensional requirement provided for by Article 18, paragraph 8 and paragraph 9, of Law no. 300/1970, it was therefore necessary to identify the protection applicable to dismissal without prior objection, since this hypothesis was not expressly provided by law.
The Judge has therefore reviewed the regulations contained in Legislative Decree no. 23/2015 in order to identify the protection applicable to the case examined.
The Court of Rome has preliminarily excluded the application of Article 3 (paragraph 2) of Legislative Decree no. 23/2015, since, as known, reintegration protection due to the absence of facts is excluded in the case of companies with less than 15 employees.
Nor did the protection provided by Article 4 of Legislative Decree no. 23/2015, which relates to violations of a purely formal nature, apply to the case under review (whereas the complete absence of a challenge does not constitute a mere formal breach, but rather a breach with substantive consequences).
Even the protection provided for by Article 3 (paragraph 1) of Legislative Decree no. 23/2015, which regulates the hypotheses in which “it is established that the grounds for dismissal for objective justified reason or subjective justified reason or just cause do not exist”, appeared to be not applicable to the case examined.
The Court of first instance, therefore, referred to the Supreme Court’s case law, stating that “the nullity of a disciplinary sanction due to a breach of the procedure aimed at its imposition […] falls within the so-called protective nullities, as it is of a mandatory nature and is intended to safeguard the weaker party in the relationship, namely the employee” (Supreme Courte no. 12770/2019).
In line with the aforementioned case law of the Supreme Court, the Court of Rome therefore ruled that the nullity of a disciplinary sanction for breach of the legislative procedure laid down for its imposition falls – precisely – within the category of protective nullity, given that the guarantee procedure laid down in disciplinary matters (by Article 7 of the Labour Statute) is mandatory and is based on the obvious aim of protecting the weaker party of the contract (i.e. the employee).
On those grounds, the Court of Rome – ruling that the said nullity was established, given the failure to comply with the procedure laid down as a guarantee for the employee – upheld the claim brought by the employee, ordering the employer to reinstate him in service.
Other related insights:
