On 14 December 2018 the Court of Cassation rejected an appeal filed by an employer in the banking sector and found that its employee had been entitled to access evaluation documents which had led to disciplinary measures being taken against him. The bank had firmly refused the request for confidentiality reasons.
The employee, who had been subject to a disciplinary procedure, filed a claim with the Authority for the Protection of Personal Data to access the documents that had been used to discipline him, as they included evaluations by various competent bodies in charge of disciplinary actions, as provided by the relevant corporate policy.
The employee argued that he wanted to exercise his right to a defence and challenge the disciplinary measures.
On the authority's invitation, the bank replied that it had provided the employee with all of the information necessary to assess the correctness of the measure taken – in particular, a letter of complaint and a suspension letter.
The bank opposed the employee's request for a copy of the evaluations. The request had been made ratione temporis pursuant to Article 7 of Legislative Decree 196/2008, which had been in force when the facts occurred (this article was repealed by Legislative Decree 101/2018 and replaced by Articles 15 et seq of the EU General Data Protection Regulation (GDPR) (2016/679)).
The bank's opposition was based on the assumption that said documents contained company data for "strictly internal use, and protected by the regulations on privacy" as an "expression of the right to organize and manage its own activity (constitutionally guaranteed by article 41 of the Constitution)". Further, the bank argued that it had taken "precursory steps", which "are relevant only at the time the employer's decision is made, and, therefore, do not have… any relevance with respect to the right of defence opposed" by the employee (a right which the bank claimed had already been guaranteed since all of the objectively relevant documents had been made available to the employee).
The authority accepted the employee's request. The bank opposed this measure before the competent court, which rejected the opposition based on the authority's arguments that the employee had had a legitimate interest in knowing about "the preparatory acts for the company to make its decision".
As regards the bank's claim that its refusal to allow access to the documents had been justified by the need to protect the interests of third parties, the court reiterated that the bank was responsible for the adoption of effective data processing procedures that would protect the interests of third parties and employees.
The bank appealed the decision before the Court of Cassation.
The Court of Cassation rejected a number of the bank's formal objections regarding the alleged invalidity of the judgment under appeal. With regard to the substance of the matter, the bank reiterated the arguments set out by the first-instance court.
In particular, the Court of Cassation stated that the right of access pursuant to Article 7 of Legislative Decree 196/2003 (ratione temporis applicable) cannot be restrictively understood as a data subject's right only to gain knowledge of new and additional data, given that this provision aims to protect data subjects' dignity and confidentiality and guarantee their right to verify that their data has been:
- recorded, ratione temporis;
- stored; or
- deleted.
This right exists regardless of the fact that a data subject may already be aware of this information and requires that they are able to access their personal data at any time.
In addition, the Court of Cassation underlined how employment documentation requirements, set out either by law (eg, payroll and staff headcount documents) or company policy (eg, communicated through internal circulars), result in the drafting of documents subject to the right of access provided for in Article 7 of Legislative Decree 196/2003, as they comprise personal data (Court of Cassation Decision 9961/2007).
As regards the alleged right of third-party confidentiality, which the bank cited in its refusal to grant the employee access to his personal data, the Court of Cassation reiterated that the employer could have simply removed any passages of the aforementioned documentation not relevant to the employee's request to avoid any potential infringement of third-party confidentiality rights.
Finally, with regard to the bank's alleged need to keep certain aspects of its organisational choices confidential, the Court of Cassation noted that it cannot be up to one party to decide what may be disclosed, as such an approach would leave the scope of the other party's defence up to the discretion of its opponent.
The case concerned the regulation of access to personal data under Article 7 of Legislative Decree 196/2003 (the so-called 'Privacy Code'), which was repealed by Legislative Decree 101/2018, which harmonised the Privacy Code with the GDPR. However, the decision sets out principles which remain valid under Articles 15 et seq of the GDPR, which further strengthen the rights of data subjects with regard to the processing of their data.
The case under review shows that employees have the right to access all documents, including evaluative documents that contain employer opinions of employees. Therefore, the decision also applies to appraisal documents, candidate assessments undertaken during recruitment and, as in the case at hand, all preliminary steps taken to impose disciplinary penalties.
It is therefore extremely important to prepare these documents with the utmost care and sensibility, bearing in mind that they may need to be provided to the data subjects concerned, who could use such content to challenge the outcome of disciplinary measures.
As Italo Calvino said, "writing is a matter of hiding something so as to allow for its discovery"; employers should therefore be extremely careful when they write or they may have to pay a price.
For further information on this topic please contact Luca Daffra at Ichino Brugnatelli e Associati by telephone (+39 02 48193249) or email ([email protected]). The Ichino Brugnatelli e Associati website can be accessed at www.ichinobrugnatelli.it.
This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.
