The case, explained

Dossier Investigation and Databases: The Privacy Guarantor's Urgent Intervention

6 min read · Updated November 2026 · Editorial oversight: Avv. Federico Papa

A major judicial investigation has recently concerned the institutions, revealing an alleged network for exfiltrating data from strategic national databases. In response, the Privacy Guarantor adopted an urgent measure aimed at securing critical nodes of the public information system. According to press reports, the case highlights not only individual responsibilities but also systemic fragility in access monitoring. This intervention differs from previous sanctions on the telemarketing chain, as it focuses on the resilience of the State's digital infrastructures and the prevention of unauthorized access by authorized subjects. Through this analysis, we will see how the adoption of advanced technical measures is now a mandatory obligation to prevent dossier building, exploring the issue through our usual twin case.

Dossier Investigation and Databases: The Privacy Guarantor's Urgent Intervention

In brief

The article analyzes the Privacy Guarantor's intervention in an investigation into unauthorized access to public databases. The Guarantor mandated the adoption of alerts and multi-factor authentication to protect Public Administration IT archives. It examines criminal laws on unauthorized access and GDPR security obligations, focusing on the protection of strategic state data.

The facts
The case, currently at the preliminary investigation stage, emerged recently with the execution of precautionary measures coordinated by the competent Judicial Authority. According to reports from major media outlets, at the heart of the investigation are consultants and representatives of a private investigation firm, suspected of having created a dossier-making hub. Investigators hypothesize the existence of a criminal conspiracy aimed at unauthorized access to protected computer systems belonging to the financial administration and central state offices.\n\n1. The group allegedly used a specific application to aggregate illicitly obtained data. 2. Access is thought to have occurred through internal complicity or technical vulnerabilities. 3. The Privacy Guarantor, having examined the records, noted the absence of adequate monitoring systems, imposing through an urgent order immediate corrective measures, such as multi-factor authentication and the activation of alerts for bulk access.
The relevant laws
The relevant legal framework is divided between the Criminal Code and the GDPR.\n\n1. Art. 615-ter of the Criminal Code punishes unauthorized access to a computer system, an offense that also occurs when an authorized subject accesses or remains in the system for purposes other than official duties. 2. Art. 326 of the Criminal Code sanctions the disclosure and use of official secrets by public officials or public service agents. 3. On the administrative side, Art. 32 of the GDPR imposes on the data controller the obligation to adopt technical and organizational measures appropriate to the risk. Violation of this obligation exposes the Public Administration to heavy fines and corrective or prohibitory measures from the Guarantor.
What case law says
The Supreme Court of Cassation in its United Sections has clarified on several occasions that the abusive nature of access does not depend solely on overcoming a computer barrier, but also on the agent's purpose. In particular, a settled orientation holds that a public official or employee commits a crime if, despite possessing legitimate access credentials, queries databases for personal reasons or to favor third parties, violating duties of loyalty and confidentiality. The United Sections have also emphasized that the data controller's (the Public Administration's) liability arises where there is a lack of systematic monitoring of access logs, the digital traces left by those consulting data, which represent the indispensable tool for detecting anomalous behavior in real time.
The twin case
Meanwhile, in Roccamesta…
The Municipality of Roccamesta manages an advanced digital registry. Hon. Ottavio Perdoni, the serving mayor, fears the political rise of a young challenger and informally tasks the firm Ditta Sempronio & Figli, which maintains the software, with finding confidential information on the rival's financial situation. Gaio Sventura, the firm's owner and a willing but reckless technician, accesses the system using his administrator credentials. Having never configured two-factor authentication, Gaio leaves the session open on a shared computer. Basim Casba, a data entry employee, is prompted by Gaio to extract reports overnight, convinced it is a standard backup procedure. The activity is discovered when magistrate Nunzio Gavelio, during a parallel investigation, notices massive access to the municipal database at unusual hours. Avv. Prudenzia Cavillo must now defend Gaio against charges of complicity in unauthorized access and breach of secrecy, while the Guarantor launches an investigation against the Municipality for deficiencies in security measures. Warning: the practical case is a hypothetical educational reconstruction and does not correspond to the real affair nor does it anticipate its outcome; any reference to real people or entities is purely coincidental; the analysis is based exclusively on the norms and orientations referred to and constitutes general legal information, not legal advice.
Step-by-step analysis
1. The first issue concerns the legal qualification of the access: although Gaio and Basim possessed valid credentials, entering the system for purposes unrelated to maintenance constitutes unauthorized access.
2. The subjective element in Gaio's case is evident, as he acted on political promptings, whereas for Basim, mistake of fact or execution of an apparently lawful order must be evaluated.
3. Mayor Perdoni's position is relevant under the profile of instigation and complicity in the crime, having induced others to perform the unlawful access.
4. On the administrative side, the Municipality of Roccamesta is liable for failing to implement adequate measures, such as data masking and download volume monitoring, in violation of the accountability principle under the GDPR.
Possible outcomes
1. Conviction for unauthorized access: if the extra-professional purpose is proven, Gaio and the Mayor risk significant prison sentences, aggravated by the public nature of the system breached.
2. Dismissal or acquittal for Basim: should it emerge that the employee acted in good faith, executing a technical instruction without awareness of the illegality, he could be exempt from criminal liability.
3. Administrative sanction: regardless of the criminal proceedings, the Guarantor could impose a pecuniary penalty on the Municipality for the systemic vulnerability found, ordering immediate adaptation of security protocols.
From the twin case to the real case
The hypothetical case of Roccamesta clearly reflects the legal core of the investigation referred to: the ease with which legitimate access credentials can be diverted to illicit purposes in the absence of automated controls. In the real case, the Guarantor highlighted that data protection cannot rely solely on the integrity of individuals, but must rest on resilient IT architectures. While criminal investigations will have to ascertain the intent of the individuals involved, the Privacy Authority's order establishes a new minimum operating standard for the Public Administration, turning cybersecurity into a fundamental pillar of institutional legality.
Meet the cast of the columnGaio Sventura and the other inhabitants of Roccamesta return in every practical case.Read their stories
Analysis drafted and verified with edit.legal
To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.
Try edit.legal AI
What it teaches professionals
1. GDPR compliance is not a static formality, but requires proactive monitoring of system logs to promptly intercept behavioral anomalies.
2. Lawyers assisting public and private entities must encourage the adoption of multi-factor authentication (MFA) protocols as a preventive safeguard against liability for negligent supervision.
3. In criminal defense against charges of unauthorized access, it is essential to distinguish formal access authorization from the scope of duties actually assigned.
4. Data protection consultancy must ensure strict segregation of duties, preventing any single operator from exfiltrating massive volumes of data without triggering automated blocks.

References: Articolo 615-ter Codice PenaleArticolo 326 Codice PenaleRegolamento UE 2016/679 (GDPR) Articolo 32Provvedimento d'urgenza del Garante Privacy recante misure di sicurezza per l'accesso alle banche dati nazionali

Editorial oversight: Avv. Federico Papa·ICAMUpdated 15 November 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction

Frequently asked questions

What does a public employee risk by consulting data for personal reasons?

They risk prosecution for the crime of unauthorized access to a computer system (Art. 615-ter of the Criminal Code), which carries aggravated penalties for public officials or public service agents, in addition to disciplinary sanctions that can lead to dismissal.

Can Public Administrations be fined by the Guarantor for these violations?

Yes, the Guarantor can impose significant administrative fines and binding instructions if it finds that the security measures adopted are inadequate to protect personal data.

How can it be proven that access was unauthorized?

Proof is essentially based on the analysis of log files, which record time, user identity, and search queries, cross-referenced with the absence of a specific case file or official duty justification.