With judgment No. 22791, published on 6 July 2026, the Italian Supreme Court addressed the relationship between the time limit governing complaint proceedings before the Italian Data Protection Authority and the time limits applicable to the subsequent administrative sanctioning procedure.

The case concerned an administrative fine imposed on a publishing company following the publication of a book relating to criminal proceedings involving the complainants’ father. The IDPA found that the publication unlawfully disclosed personal data enabling the identification of the complainants by including information on their academic qualifications and professions. The complaint was submitted to the IDPA on 27 May 2021, the notice initiating the sanctioning procedure was served on 23 November 2021 and the final sanctioning order was served on 20 March 2023. The publishing company challenged the decision, arguing that the IDPA had exceeded the maximum time limit as provided for in Article 143 of the Italian Privacy Code (set out in one year) for deciding complaints and had therefore forfeited its power to impose the fine.

The Supreme Court rejected this argument, holding that the one-year time limit provided for in Article 143 is intended solely to protect the complainant’s right to obtain a timely decision on the complaint. By contrast, the sanctioning proceeding, although it may arise from a complaint, constitutes a separate and independent administrative proceeding, initiated following the completion of the assessment of the complaint and aimed at protecting broader public interests. Accordingly, the one-year period does not form part of the constitutive elements of the IDPA’s sanctioning powers and its expiry does not result in the extinction of those powers.

The Court also addressed the 120-day period provided under point 2 of Annex B to the IDPA’s Regulation No. 2/2019. It held that this period applies to the notification of the alleged infringements under Article 166(5) of the Italian Privacy Code and runs from the definitive assessment of the alleged infringement. According to the Court, such assessment does not coincide with the mere receipt of information concerning a possible infringement, but with the point at which the IDPA is reasonably in a position to assess all the constituent elements of the alleged violation. It therefore does not constitute a final deadline for the adoption of sanctioning order. Under the present judgment, the same period is recharacterized as a deadline for notifying the alleged violations only. As a result, once the alleged violations have been notified within 120 days of the definitive assessment, no peremptory deadline applies to the subsequent adoption of the sanctioning order, which remains subject only to the five-year limitation period under Article 28 of Law No. 689/1981.

 The Court expressly declined to rule on whether the one-year period under Article 143 is peremptory or merely directory, considering it unnecessary to resolve that question in order to decide the case. In declining to introduce a judicial deadline for the final sanctioning order, the Court referred to judgment No. 151/2021 of the Italian Constitutional Court, which had itself found that the five-year limitation period alone is insufficient to ensure legal certainty and the effective exercise of the right of defense, while leaving it to the legislature to identify an appropriate time limit.

Finally, the Supreme Court upheld the findings on the merits. It confirmed that the disclosure of the data subjects’ academic qualifications and professions exceeded the principle of essentiality applicable to the publication of personal data in connection with matters of public interest. The Court reiterated that the assessment of whether the disclosure of personal data is essential to the exercise of freedom of expression must be carried out by the court deciding the merits, on the basis of the circumstances of each individual case.