The Court of Verona has once again intervened in the long-standing dispute over whether or not the remedy under Article 700 of the Italian Code of Civil Procedure (c.p.c.) is admissible for obtaining the cancellation of a report made to the Central Credit Register (Centrale Rischi).
On this occasion, the Court, following the position most recently formed within the same judicial body (Court of Verona, 18.03.2013), rejects the objections raised by the defendant bank as to the inadmissibility of the procedure under Article 700 c.p.c. in favour of that under Article 10(4) of Legislative Decree 150/11.
In an order of 6.02.2015 (rep. 736/15, Judge Aliprandi), it was in fact specified that “a more restrictive reading of the provision in Article 10(4) of Legislative Decree 150/11 appears preferable, that is, one that excludes its application outside the cases of challenges to the decisions of the Data Protection Authority (Garante per la protezione dei dati personali) on privacy matters referred to in paragraph 3 of the provision, also taking into account that 1) with regard to reporting to the CR (Central Credit Register), the Bank of Italy has a merely managerial function and has no power to assess the substantive content of the reports, so that its activity, which is characterised by substantial neutrality with respect to the data recorded in the Register – which are the result of the mere automated processing of the information flows generated by the intermediary banks (see Bank of Italy Circular no. 139/91, latest Update 29/4/11, ch. 1, sec. I, para. 5) – can hardly take the form of a true enforceable measure capable of being suspended and, therefore, satisfy the objective requirement of Article 10(4) of the aforementioned provision, which speaks of “..enforceability of the contested measure”; 2) even accepting the option of the administrative-measure nature of the activity of the Bank of Italy as manager of the Public CR (see Court of Verona, 23.10.12, cit.), the case of reports made by intermediary banks to private credit registers nevertheless remains problematic, where the database manager itself, and not only the reporting entity, is a private party, that is, by definition without the power to adopt administrative measures with enforceable effect capable of being suspended under the mechanism of Article 5 of Legislative Decree 150/11”. Consequently, protection under Article 700 c.p.c. must be held admissible “not only where the applicant expressly alleges, or it can in any event be inferred from the claim, a breach of the duties of good faith and fairness arising from the contractual relationship between the intermediary bank and the customer, but also where the reported party alleges tout court a breach by the intermediary of the rules on the processing of personal data, that is, of the privacy legislation, the only exception being the case, to be dealt with exclusively under the procedure of Article 10(4) of Legislative Decree 150/11, in which the Bank of Italy’s liability for its own act is expressly alleged, that is, whenever, owing to an error by one of the persons in charge, the intermediary’s report is received and processed incorrectly, and the breach of the legislation on the processing of personal data is therefore attributable to the Bank of Italy itself (or also to it)”.
Leave a Reply