The service of the Mevaluate Onlus Association consists in calculating a reputational rating of natural and legal persons with the aim of "making socio-economic relationships more efficient, transparent and safe". The rating is built through an algorithm starting from the collection of personal data from different sources carried out at the request of the interested parties. These data are collected from documents uploaded to the platform by the users themselves and other data freely usable from the web. The algorithm automatically processes the collected data and assigns to the surveyed subjects a reliability score divided into five sub-ratings ("criminal", "fiscal", "civil", "work and civil commitment" "studies and training"). Both users registered on the platform and third parties can be scored. The latter has the possibility to join the platform at any time and submit new documents aimed at integrating and / or modifying the relevant profiles.
In 2016 the Italian Data Protection Authority provision n. 488 had declared unlawful the processing of personal data connected to the services offered through the "Mevaluate Intangible Infrastructure for Reputational Qualification". In particular, the Italian Authority highlighted, among others, the following findings:
The legal system recognizes and regulates only the "company rating" (Article 83 of Italian Legislative Decree 50/2016). The rating of natural persons does not have a regulatory basis.
Reputational assessments on an automated basis could affect the life of the individuals surveyed and therefore negatively affect their dignity.
The law requires that the consent of the data sujects to the processing of personal data must be informed and freely expressed: these conditions do not exist in the case of autonomous data processing by an automated system, when the data subject does not know how the system works.
The processing appears in violation of the principles of data minimization (since it is based on a massive collection of data and documents) and of proportionality of the processing (since the relevance of the data and documents collected appears unproven);
The provision of the Italian Data Protection Authority was challenged by the Mevaluate Association before the Court of Rome, which, with sentence no. 5715/2018, on the other hand, considered the reputational rating to be lawful, as "all the activities of uploading information and validating and certifying documents are subject to the consent of the interested party and the voluntary nature of his action". The Court of Rome ordered the partial cancellation of the provision of the Italian Data Protection Authority, maintaining the prohibition of processing the personal data of third parties not associated with Mevaluate and not registered on the platform.
Upon appeal by the Italian Data Protection Authority, recently the Italian Supreme Court of Cassation with order 14381/2021 expressed the following principle of law: "in terms of the processing of personal data, consent is validly given only if freely expressed and specifically in reference to a processing clearly identified; it follows that in the case of a web platform (with an IT archive) preordained for the elaboration of reputational profiles of natural or legal persons, centered on a calculation system based on an algorithm aimed at establishing the reliability scores, the requirement of awareness cannot be considered satisfied if the executive scheme of the algorithm and the elements of which it is composed remain unknown or not known by the data subjects ".
The Italian Supreme Court has therefore confirmed the legitimacy of the processing of personal data for the purpose of calculating a reputational rating of individuals, provided it is confirmed by the consent of the data subject and therefore an expression of his private autonomy. In this case, according to the Supreme Court, the consent will be valid as long as the data subject receives adequate information on the operating mechanisms of the algorithm.
Avv. Chiara Civitelli
The content of this article does not constitute legal advice, but has an informative function. For tailor made legal advice, contact the firm by e-mail to: info@dongpartners.eu or by phone +39 06 916505710. © Dong & Partners International Law Firm, All rights reserved