In Order No. 23755/2026, the Italian Supreme Court of Cassation addressed the proper constitution of proceedings challenging decisions of the Italian Data Protection Authority under Article 10 of Legislative Decree No. 150/2011, clarifying both the Authority’s procedural role and the consequences arising where other parties whose participation is mandatory have not been joined to the proceedings.
According to the Supreme Court, Article 10(6) of Legislative Decree No. 150/2011 — which requires the application to be served on the parties and on the Italian Data Protection Authority — establishes a case of mandatory joinder of defendants by operation of law, falling within the scope of Article 102 of the Italian Code of Civil Procedure.
The ruling is particularly significant from a procedural standpoint. Where proceedings have been brought within the applicable time limit against at least one of the parties whose participation is mandatory, the failure to join another necessary party does not automatically render the challenge inadmissible. In such circumstances, the court is instead required to order that the proceedings be extended to include the omitted necessary party.
The dispute arose from proceedings brought before the Court of Rome challenging a decision by which the Italian Data Protection Authority had closed a complaint concerning the processing of personal data in connection with the obtaining of a criminal records certificate by officers of the registry of the Justice of the Peace.
The Ministry of Justice, identified as the controller in respect of the processing at issue, had not initially been joined to the proceedings.
The Court of Rome considered that omission to preclude the continuation of the proceedings and declared the challenge inadmissible. In the lower court’s view, subsequent joinder could not be ordered because this would effectively circumvent the mandatory 30-day time limit laid down by Article 10(3) of Legislative Decree No. 150/2011 for bringing the challenge.
The Supreme Court of Cassation took the opposite view, upheld the appeal and quashed the judgment, remitting the case to the lower court.
The Court began by examining the particular institutional status of the Italian Data Protection Authority. In exercising the powers conferred on it by the GDPR and the Italian Data Protection Code, the Authority may adopt preventive, prohibitory and corrective measures, intervene in respect of unlawful processing operations and impose administrative sanctions. Although it is required to perform its functions impartially and fairly, in subsequent judicial proceedings challenging its decisions it does not occupy a position comparable to that of a court.
From a procedural perspective, Article 10 of Legislative Decree No. 150/2011, as amended by Legislative Decree No. 101/2018, expressly provides that the application must be served both on the parties and on the Data Protection Authority. The Supreme Court inferred from that provision the existence of mandatory joinder between the Authority and any other persons or entities whose legal position, having regard to the subject matter of the dispute, requires their participation in the proceedings.
The practical consequence is significant. Where the challenge has been brought within the statutory time limit and proceedings have been validly instituted against at least one of the necessary defendants, the omission of another necessary party does not, in itself, render the action inadmissible. Rather, the court must order the joinder of the omitted party pursuant to Article 102 of the Italian Code of Civil Procedure.
A different situation arises where proceedings have been brought solely against a person or entity lacking standing to be sued. In that case, the proceedings have not been validly constituted from the outset against any of the parties whose participation was required, and the mechanism for curing defective joinder is therefore unavailable.
The Supreme Court further clarified that the application of the procedural rules governing employment disputes to proceedings under Article 10 of Legislative Decree No. 150/2011 is not incompatible with a judicial order requiring joinder pursuant to Article 102 of the Code of Civil Procedure, provided that the action was brought within the prescribed time limit against at least one of the necessary parties.
In the proceedings under review, the challenge had been brought in due time against the Italian Data Protection Authority. Accordingly, the Court of Rome should not have declared the application inadmissible on the ground that the Ministry of Justice had not initially been joined. Instead, it should have ordered that the proceedings be extended to include the Ministry.
On that basis, the Supreme Court of Cassation quashed Judgment No. 13820/2025 of the Court of Rome, filed on 8 October 2025, and remitted the case for further proceedings.
The ruling provides important clarification for litigation concerning personal data protection. When preparing a challenge under Article 10 of Legislative Decree No. 150/2011, it is necessary to identify not only the Italian Data Protection Authority, whose participation in the proceedings is expressly required by law, but also any other persons or entities whose legal position is directly affected by the judicial determination sought.
At the same time, failure initially to serve one of those parties does not necessarily result in the loss of the right of action. Where proceedings have been brought in due time against at least one of the necessary parties, the composition of the proceedings may — and must — be regularised by order of the court through the joinder of the omitted party.
