Cassation

Siri-Report case: sanction by the Privacy Guarantor is out of time

In the grounds of the judgment, the criminal nature of the Authority's punitive power is emphasised. Otherwise, there is a risk of a legacy of the supremacy of the PA

by Patrizia Maciocchi

19 January 2026

Il giornalista e conduttore Sigfrido Ranucci posa per i fotografi nello studio del programma televisivo della Rai “Report”, Roma, 07 novembre 2025. ANSA/ANGELO CARCONI

4' min read

Translated by AI

Versione italiana

Key points

The criminal nature of the punitive power according to the ECHR
The taxability of the term
The Right of Defence and the Constitution

4' min read

Translated by AI

Versione italiana

The validity of the sanctions of the Privacy Guarantor is subject to the Authority's compliance with the time limits within which the action must be exercised. And this is because "the lack of a peremptory final term, on the contrary, places the authority holding the punitive power in an unjustifiably privileged position that, in the current legal context, is configured as an anachronistic legacy of the special supremacy of the public administration". These are the reasons (sentence 984/2026) with which, on 26 December last, the Cassazione rejected the appeal by Armando Siri, today a member of the Federal Council of the League - Salvini Premier, and of the Privacy Guarantor, against the sentence of theCourt of Rome which, on 22 October 2024, had recognised the peremptory nature of the term (twelve months from the filing of the complaint) indicated by the same authority for the conclusion of the sanctioning proceedings.

The criminal nature of the punitive power according to the ECHR

The Capitoline judges had been approached byRiAi, who had summoned the Garante and Armando Siri to ascertain the legitimacy of the processing of personal data on the occasion of the services broadcast and produced for the programme "Presa Diretta" (of 28 September 2020) and "Report", of 26 October 2020. RAI requested the annulment of the Garante's Order 297 of 6 July 2023 and the cancellation of the prohibition placed on the further dissemination of the e-mails projected in the two services. The Court - in support of its decision to consider as peremptory the time within which to exercise the sanctioning power, attributed by the legislator to independent administrative authorities such as the Garante - had valorised the case law of the European Court of Human Rights, according to which it is a substantially criminal 'punitive' power and of strict legality, in line with the so-called 'Engel criteria'.

The taxability of the term

Imposing the timeliness of the entire procedure is thereforethe afflictiveness of the final decision. And the deadline must be respected to protect the defendant's right of defence, recognised and guaranteed by Article 24 of the Constitution. The judges on the merits - with a decision that the Supreme Court endorses, without entering into the merits of the case - had therefore thrown in the towel on the Garante's measure, because it had arrived out of time: when the terms, indicated by the same authority in the extension measure adopted on 19 October 2021, had by then expired.

The virtually identical argument of the two appellants - according to whom 'the Court of Rome, although in the absence of an express legal provision in this regard, erroneously considered the time limits relating to the administrative procedure before the Garante to be peremptory and not of an ordinary nature' - does not pass.

The Right of Defence and the Constitution

The judges of legitimacy recall that, already in judgment 18583/2025, concerning the activities of the Garante aimed at ascertaining violations and the imposition of sanctions, they had distinguished, on a logical and chronological level, the sanctioning phase in the strict sense and the previous investigative or pre-investigative phase.

The connecting element between the investigation phase and the sanctioning phase, which starts with the notification of the alleged violations, provides for a proper investigation phase and culminates in the adoption of the sanctioning measure. The Supreme Court recalls in this regard the Guarantee Regulation 2/2019 "which in point 2 of Annex 'B' ('Time limits relating to proceedings identified in the Personal Data Protection Code') provides, for the exercise of sanctioning powers (Article 166, paragraph 5, of Legislative Decree 196/2003), a term of one hundred and twenty days from the ascertainment of the breach for the notification thereof to residents in the territory of the Republic or 360 days for the notification thereof to residents abroad". A countdown of one hundred and twenty days for the sanction that starts "from the final ascertainment of the infringement and requires the exercise of the sanctioning power, by sending the communication referred to in the combined provisions of Articles 12, paragraphs 1 and 2, of the regulation of the Guarantor No 1/2019, and 166, paragraph 5, Legislative Decree 196/2003, within four months of knowledge (assessment) of the violation, under penalty of exhaustion of the sanctioning power".

The anachronistic over-power of the Pa

The time limit - the Court of Cassation states - cannot but run, according to the same of the Guarantor's Regulation, "from the commencement of the corresponding sanctioning procedure, i.e. from the time when it is communicated to the data controller and, where appropriate, to the data processor". As to the rigidity of the time limit, this is also supported by the jurisprudence of the Constitutional Court (judgment Court 151/2021), according to which the "legislative pre-definition of a time limit for the issuance of a sanction expressive of the punitive power of the public administration, the useless expiry of which produces the consummation of the power itself, is coessential to a sanctioning system consistent with the constitutional parameters of legal certainty and right of defence".

The lack of a peremptory final deadline, on the contrary, places the authority holding the punitive power "in an unjustifiably privileged position that, in the current legal context, is configured as an anachronistic legacy of the special supremacy of the public administration". The Court of Cassation's ruling goes beyond the individual case examined and establishes ageneral rule that can be extended to all proceedings and any querelle on the Authority's exceeding of time limits.