With its recent ruling n. 41210 of September 8th 2017, the Italian Supreme Court (hereinafter: S.C.) dealt again with the limits of art. 615- ter of the Italian Criminal Code – unauthorized access to an IT system – in order to withdraw some aspects of its previous ruling on the Casani case n. 4694 of September 27th 2011, with which the S.C. denied the subsistence of the aforementioned offense, when the subject entering the computer information or electronic system is authorized to do so with a password, but in order to achieve purposes unrelated to those for which the permission had been granted – the so-called misuse of power.

In fact, according to the S.C.’s reasoning, in determining if the above-mentioned offense was committed or not, what is relevant is the access and permanence in the IT system in breach of the rules provided by the holder of the so-called ius excludendi, and not the type of the sought out purposes, unless the operations carried out are of a completely different nature from the ones for which the subject is responsible for and for which the access was granted, being less relevant in this case the access and permanence in the system.

That said, the Fifth Chamber of the S.C., after having considered the different decisions following the judgement on the Casani case, mainly about the breadth of the concept of unauthorized access by public officers or public service operators, submitted to the Grand Chamber the following law issue: “if the crime ex art. 615-ter par. 2, n. 1 of the Criminal Code subsists also in case the public officer or the public service operator, formally authorized to access the information or electronic system, commits misuse of power, aiming to achieve a non-institutional purpose, even if a specific violation of regulatory or organizational provisions lacks” (In this case, the Court of Appeals, overturning the the judgment of acquittal, condemned a chancellor of the Public Prosecutor’s Office that, after accessing the criminal records register– so-called Re. Ge. – remained to collect information about the prosecution of a friend appointed to a Deputy Public Prosecutor different from the one for which he worked).

The S.C., taking into consideration the ruling on the Carnevale case n. 22024 of 2013, from which the conflict in the case-law pointed out by the Fifth Chamber originated, and ignoring the theory supported by the judgment on the Casani case, attributed within the scope of the case in point the “teleologically inadequate” access and permanence; and specifically “the situation in which the access or permanence in the IT system of the office to which the public official or the public service operator is assigned to, despite the use of personal access credentials and the lack of additional prohibitions about data access, is nevertheless characterised by the officer’s misuse of power, that is to say the use of power in violation of duties that have to inspire the fulfilment of the assigned public tasks”. In particular, the Grand Chamber of the S.C., underlining the principle – ex art. 1 L. 241/1990 – according to which “the administrative activity pursues objectives established by the law and it is held together by specific standards of cost-effectiveness, effectiveness, impartiality, publicity, transparency according to the procedures regulated by this law and in compliance with the rules regulating the procedures, as well as the principles of Community law”, ruled that the behaviour of the public officer, when it hinders the institutional aims the working relationship is based on, is “ontologically inconsistent” with the access to the IT system, turning it into an abuse of public office and misuse of power (In the case brought before the court, the S.C., after reminding that the public employees who work on computerised registration systems have to respect all the rules about access, the instructions given by the chief of the Office about the registers’ management, as well as the staff regulations, which force the personnel to use IT systems only for activities directly connected to their duties, concluded that any kind of behaviour against this purpose is unlawful and abusive, “arising in this case the <> of the access to the IT system, characterised by a use different from the one powers were assigned for”).

To conclude, the S.C. ruled the following law principle: “the behaviour of the public officer or public service operator, who, even without violating the formal prescriptions given by the owner of an information or electronic system with protected access (here, the register of criminal records: Re. Ge), accesses or stays into a system for reasons that are ontologically different from those for which the access is allowed, constitutes a crime ex art. 615-ter, par. 2, n. 1 of the Italian Criminal Code”.

This ruling – which also has effects towards private citizens, who are professionally allowed to use the IT system –, evoking the old line of reasoning – persuasively overcame by the judgment on the Casani case – stated a further revirement in the case-law which raised many doubts.

In fact, by linking the concept of unauthorized access to the one of abuse of public office, the S.C. stretched the literal meaning of art. 615-ter, raising doubts about the compatibility of this interpretation with the Italian principle of legal certainty – constitutionally granted – which compels the judge to follow a strict proceeding of connection between concrete case and the norm.

In any case, the abovementioned law principle, confirmed by some following judgments – lastly, by the ruling n. 1021 of 12th January 2018 of the S.C. – seems to have ushered a univocal case law course (In the abovementioned judgment, the S.C. asserted the lack of criminal offense in case a where police officer with military and civil duties accessed to an IT system for private reasons, considering invalid the judgment under appeal where it “does not point out which investigative acts made possible to think that the researches made by the policeman could be linked to his public duty and not, as the Public Prosecutor affirms, to private reasons related to his relationship status”).