Supreme Court on Unauthorized Access and Dossiering: The Misuse of Digital Power

1. The fact

   National news outlets have given extensive coverage to investigations concerning the creation of confidential dossiers on political and business figures. According to «Il Dubbio» and «Diritto e Giustizia», investigations conducted by the Public Prosecutor's Offices of Perugia and Milan have revealed a system of massive queries to protected databases, such as the SDI and suspicious activity reports (SOS). The investigations, currently at the preliminary investigation stage, showed that individuals possessing regular access credentials queried thousands of records without any investigative mandate or official justification. The core of the prosecution's case lies in the nature of the accesses: not mere curiosity, but a systematic collection of information aimed at private or political ends. Although the suspects were technically authorized to access the system, the Prosecution alleges the crime of aggravated unauthorized access, arguing that technical authorization does not permit the arbitrary use of data. The case awaits trial, but it has already prompted clarifying guidance from the Supreme Court on the concept of functional unauthorized access.

2. 

   The laws at play

   The central legal provision is Art. 615-ter c.p., which penalizes unauthorized access to a computer or telecommunication system. The provision sanctions not only forced entry into the system, but also remaining in it against the express or implied will of the person entitled to exclude others.

   1. Aggravating factor for public officials: paragraph 2, no. 1, increases the penalty to imprisonment from one to five years if the offense is committed through abuse of powers or breach of duties inherent to the function or service.
   2. Breach of official secrecy: Art. 326 c.p. penalizes public officials or public service agents who disclose official information required to remain confidential.
   3. Data protection: EU Regulation 2016/679 (GDPR) imposes security obligations and purpose limitation principles, the violation of which entails substantial administrative fines for the entity operating the database.

3. What the case law says

   Case law from the Supreme Court has progressively shifted away from the technical breach criterion, embracing a functional and purpose-based approach. The United Sections have clarified that access is unauthorized whenever a user, even if holding valid credentials, performs activities objectively incompatible with the reasons justifying credential issuance and use. The core principle is that system authorization is granted solely for institutional duties. Recent rulings have confirmed that querying a database for personal curiosity, to benefit third parties, or for dossiering constitutes a misuse of digital power. In such cases, exceeding the objective boundaries established by system rules or by the public function exercised renders the conduct criminally relevant. Thus, the formal validity of access credentials is irrelevant when there is a substantive breach of duties of loyalty and confidentiality.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Traceability and auditability: lawyers advising public entities and corporations should recommend adopting logging systems that record not only access, but also the explicit operational justification for each query.
   2. Defense strategy: in criminal proceedings, defense counsel must focus on the functional justification of queries, producing documentary evidence of relevance to official duties.
   3. Organizational risk management: organizations must train staff that using official credentials for personal purposes is not merely a disciplinary breach, but constitutes a criminal offense.
   4. Contract drafting: regarding external consultants, access scopes and data handling permissions must be defined with precision to avoid allegations of unauthorized access.

References: Articolo 615-ter Codice PenaleArticolo 326 Codice PenaleRegolamento UE 2016/679 (GDPR)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 22 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction