The Court of Cassation has clarified that criminal liability exists even if the system administrator, while not violating the employer's formal provisions, accesses or remains in the system for reasons ontologically unrelated to those for which he has the right to access.
A company system administrator was convicted by the Milan Court of Appeal for unauthorized access to a computer system and for violating correspondence for having unlawfFFully entered a system by learning the contents of an employee's email as part of a defensive audit in relation to negotiations aimed at appointing a new administrator by the employer company.
With ruling no. 23158 of June 20, 2025, the Court of Cassation rejected the administrator's appeal, which argued that he had the prerogative to access the data. It held that the purpose of the defendant's conduct was unrelated to that which justified his role, given that the checks had been carried out in violation of the principles established by the Italian Data Protection Authority, which prohibit widespread, prolonged, and indiscriminate monitoring of an employee's activities.
Criminal liability exists – the ruling specifies – even if the system administrator, while not violating the employer's formal provisions, accesses or remains in the system for reasons that are ontologically unrelated to those for which he or she has the right to access.
In dismissing the appeal, the Supreme Court found that the checks carried out exceeded Article 4 of the Workers' Statute as they were neither proportionate nor reasonable.
Given that the emails were password-protected, the Supreme Court also found that, in addition to the crime of unauthorized access to a computer system, the formal concurrence of the crime of violation of correspondence in relation to the acquisition of the emails stored in the archive was also unobjectionable.
Attorney Nicoletta Di Lolli