{"id":23127,"date":"2019-01-28T23:00:00","date_gmt":"2019-01-28T22:00:00","guid":{"rendered":"https:\/\/www.delucapartners.it\/news\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/"},"modified":"2026-02-16T16:10:58","modified_gmt":"2026-02-16T15:10:58","slug":"privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data","status":"publish","type":"post","link":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/","title":{"rendered":"Privacy and disciplinary procedures: employees have the right to access their own data"},"content":{"rendered":"\n

With its order no. 32533, filed 14 December last, the Italian Court of Cassation established that employees, when subject to disciplinary procedures, have the right to access the records concerning them.<\/strong> The Court thus confirmed the full scope of the \u201cright of access\u201d, as governed by Article 7 of the Italian Privacy Code, which was in effect at the time of the events described below, and in accordance with the provisions of Article 15 of EU Regulation 679\/2016 (\u201cGDPR<\/em><\/strong>\u201d), which is currently applicable.<\/p>\n

 <\/p>\n

The facts <\/strong><\/p>\n

 <\/p>\n

The case originated from an appeal submitted by a Bank firstly against the provision issued by the Italian Data Protection Authority [Garante per la protezione dei dati personali] (the \u201cAuthority<\/em><\/strong>\u201d), and subsequently against the judgment of the Court with territorial jurisdiction, which had upheld the Authority\u2019s position.<\/p>\n

In this specific case, following notification that he was being subject to a disciplinary penalty (suspension from service and from the relative financial treatment for one day), an employee of the Bank requested to see the background records that had led to the penalty, which included the assessments made about him.<\/p>\n

The requested documents had been provided for in an internal circular dating back to 2009, and specifically the (i) \u201cNotice in the form of a written report sent to <\/em>\u201cDiscipline\u201d by the Central and Local HR Manager<\/em>\u201d, and (ii) the \u201cAccompanying letter in which the HR Manager makes assessments jointly with the Manager of the local or central office\u201d<\/em>.<\/p>\n

When invited by the Authority to provide a reply to the employee\u2019s requests, the Bank responded that the aforementioned documents<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 contained company data \u201cstrictly for internal use\u201d<\/em>, which was also protected by privacy legislation and subject to the right to organize and manage one\u2019s own activity (Article 41 of the Italian Constitution), and<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 were \u201cintraprocedural records\u201d<\/em>, pertaining only to the precise moment at which the employer\u2019s will was formed. According to the Bank, they could not be deemed relevant for the purposes of the worker\u2019s opposing right of defence. This was a right which, in the Bank\u2019s opinion, had already been guaranteed since all of the necessary information had been provided in the letters notifying the employer of the charges against him.<\/p>\n

The Court upheld the Authority\u2019s Provision and rejected the Bank\u2019s appeal, deeming that<\/p>\n

(i)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 the principles governing defence in disciplinary procedures and in court had absolutely not been respected, and<\/p>\n

(ii)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 the Bank could have simply removed any passages of the requested documentation that were not relevant for the purposes of the worker\u2019s requests if they were prejudicial to any right to confidentiality established in favour of third parties.<\/p>\n

In essence, the Court declared that the employer\u2019s decision to keep some aspects of its own organizational decisions private was unlawful: \u201cthe party cannot be entitled to decide, at its own discretion, what can or cannot be made available<\/em><\/strong>, since such a situation would also allow the appellant company to control all decisions concerning the counterparty\u2019s ability to establish a defence<\/em>\u201d.<\/em><\/p>\n

The Bank filed an appeal against the Court\u2019s ruling at the Court of Cassation, requesting that the dispute be dealt with at a public hearing, given the significance of the issue.<\/p>\n

 <\/p>\n

The ruling of the Court<\/strong><\/p>\n

 <\/p>\n

The ruling of the Court focused on three main points, as outlined below.<\/p>\n

    \n\t
  1. The balancing of the interests involved<\/em><\/li>\n<\/ol>\n

    In this regard, the Supreme Court of Cassation made the same assessments as the trial judge, as mentioned above, deeming that \u2013 following the balancing of opposing interests <\/strong>\u2013 the worker\u2019s right of access prevails over the confidentiality requirements <\/strong>asserted by the Bank.<\/p>\n

    In the Court\u2019s opinion, the Bank could have allowed access to the documents containing assessments about the employee while also protecting the third parties, by redacting information that could be prejudicial to them, for example.<\/p>\n

      \n\t
    1. The extensive interpretation of the right of access <\/em><\/li>\n<\/ol>\n

      Moreover, in upholding the ruling handed down by the trial judge, the Court of Cassation specified that the right of access cannot be understood \u2013 in a restrictive sense \u2013 as the mere right to know any new information in addition to that which has already become known to the interested party: the scope of the right in question is much broader.<\/p>\n

      According to the Court, the purpose of the right of access is \u2013 in protection of the interested party\u2019s dignity and privacy \u2013 to guarantee that he can verify ratione temporis<\/em> whether his personal data (i) has been entered, (ii) remains on record, or (iii) has been removed, regardless of whether or not the interested party has become aware of such information by other means and on different occasions (see the reference to the aforementioned letters notifying the employee of the charges). Therefore, the right to this verification must be guaranteed through the interested party having access to his own personal data at all times during the employment relationship.<\/p>\n

        \n\t
      1. The right of access, with specific reference to documents concerning the employment relationship<\/em><\/li>\n<\/ol>\n

        Finally, the Court of Cassation confirmed and reiterated the orientation that it had established previously, aimed at guaranteeing the right of access to documentation concerning matters connected to the employment relationship. This is applicable both to cases in which that documentation is required by law and to cases in which the documentation is provided for by the business organization, through internal circulars, for example (cf. Court of Cassation Judgment no. 9961 of 2007, inter alia<\/em>), as in the case at hand.<\/p>\n

         <\/p>\n

        Conclusions<\/strong><\/p>\n

         <\/p>\n

        In essence, the Court of Cassation deems that the legislative and regulatory provisions on the \u201cright of access\u201d do not suggest any specific limitation with regard to the specific purposes for which it may or may not be exercised. Therefore, the right in question can be duly exercised by the employee for the purposes of his own defence.<\/p>\n

         <\/p>\n

         <\/p>\n

         <\/p>\n","protected":false},"excerpt":{"rendered":"

        With its order no. 32533, filed 14 December last, the Italian Court of Cassation established that employees, when subject to disciplinary procedures, have the right to access the records concerning them. The Court thus confirmed the full scope of the \u201cright of access\u201d, as governed by Article 7 of the Italian Privacy Code, which was […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[167,177,190],"tags":[1154,869,1707],"class_list":{"0":"post-23127","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"hentry","6":"category-case-law","7":"category-insights","9":"tag-corte-di-cassazione-en","10":"tag-garante-en","11":"tag-privacy-en"},"acf":[],"yoast_head":"\nPrivacy and disciplinary procedures: employees have the right to access their own data - De Luca & Partners<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/posts\/23127\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Privacy and disciplinary procedures: employees have the right to access their own data - De Luca & Partners\" \/>\n<meta property=\"og:description\" content=\"With its order no. 32533, filed 14 December last, the Italian Court of Cassation established that employees, when subject to disciplinary procedures, have the right to access the records concerning them. The Court thus confirmed the full scope of the \u201cright of access\u201d, as governed by Article 7 of the Italian Privacy Code, which was […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/\" \/>\n<meta property=\"og:site_name\" content=\"De Luca & Partners\" \/>\n<meta property=\"article:published_time\" content=\"2019-01-28T22:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-02-16T15:10:58+00:00\" \/>\n<meta name=\"author\" content=\"Melismelis\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Melismelis\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/\"},\"author\":{\"name\":\"Melismelis\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#\\\/schema\\\/person\\\/00d0832a12e3889dce887a31e29d65f8\"},\"headline\":\"Privacy and disciplinary procedures: employees have the right to access their own data\",\"datePublished\":\"2019-01-28T22:00:00+00:00\",\"dateModified\":\"2026-02-16T15:10:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/\"},\"wordCount\":983,\"publisher\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#organization\"},\"keywords\":[\"Corte di Cassazione\",\"Garante\",\"Privacy\"],\"articleSection\":[\"Case Law\",\"Insights\",\"Insights\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/\",\"url\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/\",\"name\":\"Privacy and disciplinary procedures: employees have the right to access their own data - De Luca & Partners\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#website\"},\"datePublished\":\"2019-01-28T22:00:00+00:00\",\"dateModified\":\"2026-02-16T15:10:58+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/insights\\\/giurisprudenza\\\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privacy and disciplinary procedures: employees have the right to access their own data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/\",\"name\":\"De Luca & Partners\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#organization\",\"name\":\"De Luca & Partners\",\"url\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.delucapartners.it\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/De-Luca-Partners.png\",\"contentUrl\":\"https:\\\/\\\/www.delucapartners.it\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/De-Luca-Partners.png\",\"width\":600,\"height\":56,\"caption\":\"De Luca & Partners\"},\"image\":{\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.delucapartners.it\\\/en\\\/#\\\/schema\\\/person\\\/00d0832a12e3889dce887a31e29d65f8\",\"name\":\"Melismelis\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/abc81b0c708aea145c773c368ae5bc3f1f3fd0d40a61429cb96d09523d41ab66?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/abc81b0c708aea145c773c368ae5bc3f1f3fd0d40a61429cb96d09523d41ab66?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/abc81b0c708aea145c773c368ae5bc3f1f3fd0d40a61429cb96d09523d41ab66?s=96&d=mm&r=g\",\"caption\":\"Melismelis\"},\"sameAs\":[\"https:\\\/\\\/www.delucapartners.it\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Privacy and disciplinary procedures: employees have the right to access their own data - De Luca & Partners","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/posts\/23127\/","og_locale":"en_US","og_type":"article","og_title":"Privacy and disciplinary procedures: employees have the right to access their own data - De Luca & Partners","og_description":"With its order no. 32533, filed 14 December last, the Italian Court of Cassation established that employees, when subject to disciplinary procedures, have the right to access the records concerning them. The Court thus confirmed the full scope of the \u201cright of access\u201d, as governed by Article 7 of the Italian Privacy Code, which was […]","og_url":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/","og_site_name":"De Luca & Partners","article_published_time":"2019-01-28T22:00:00+00:00","article_modified_time":"2026-02-16T15:10:58+00:00","author":"Melismelis","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Melismelis","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/#article","isPartOf":{"@id":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/"},"author":{"name":"Melismelis","@id":"https:\/\/www.delucapartners.it\/en\/#\/schema\/person\/00d0832a12e3889dce887a31e29d65f8"},"headline":"Privacy and disciplinary procedures: employees have the right to access their own data","datePublished":"2019-01-28T22:00:00+00:00","dateModified":"2026-02-16T15:10:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/"},"wordCount":983,"publisher":{"@id":"https:\/\/www.delucapartners.it\/en\/#organization"},"keywords":["Corte di Cassazione","Garante","Privacy"],"articleSection":["Case Law","Insights","Insights"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/","url":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/","name":"Privacy and disciplinary procedures: employees have the right to access their own data - De Luca & Partners","isPartOf":{"@id":"https:\/\/www.delucapartners.it\/en\/#website"},"datePublished":"2019-01-28T22:00:00+00:00","dateModified":"2026-02-16T15:10:58+00:00","breadcrumb":{"@id":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.delucapartners.it\/en\/insights\/giurisprudenza\/privacy-and-disciplinary-procedures-employees-have-the-right-to-access-their-own-data\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.delucapartners.it\/en\/"},{"@type":"ListItem","position":2,"name":"Privacy and disciplinary procedures: employees have the right to access their own data"}]},{"@type":"WebSite","@id":"https:\/\/www.delucapartners.it\/en\/#website","url":"https:\/\/www.delucapartners.it\/en\/","name":"De Luca & Partners","description":"","publisher":{"@id":"https:\/\/www.delucapartners.it\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.delucapartners.it\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.delucapartners.it\/en\/#organization","name":"De Luca & Partners","url":"https:\/\/www.delucapartners.it\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.delucapartners.it\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.delucapartners.it\/wp-content\/uploads\/2026\/01\/De-Luca-Partners.png","contentUrl":"https:\/\/www.delucapartners.it\/wp-content\/uploads\/2026\/01\/De-Luca-Partners.png","width":600,"height":56,"caption":"De Luca & Partners"},"image":{"@id":"https:\/\/www.delucapartners.it\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.delucapartners.it\/en\/#\/schema\/person\/00d0832a12e3889dce887a31e29d65f8","name":"Melismelis","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/abc81b0c708aea145c773c368ae5bc3f1f3fd0d40a61429cb96d09523d41ab66?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/abc81b0c708aea145c773c368ae5bc3f1f3fd0d40a61429cb96d09523d41ab66?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/abc81b0c708aea145c773c368ae5bc3f1f3fd0d40a61429cb96d09523d41ab66?s=96&d=mm&r=g","caption":"Melismelis"},"sameAs":["https:\/\/www.delucapartners.it"]}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/posts\/23127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/comments?post=23127"}],"version-history":[{"count":1,"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/posts\/23127\/revisions"}],"predecessor-version":[{"id":23128,"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/posts\/23127\/revisions\/23128"}],"wp:attachment":[{"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/media?parent=23127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/categories?post=23127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.delucapartners.it\/en\/wp-json\/wp\/v2\/tags?post=23127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}