By Order No. 25117, published on 8 September 2026, the First Civil Chamber of the Supreme Court of Cassation ruled on the conditions for the lawful processing of personal data and, in particular, on the requirements for valid consent collected under a contract for the provision of beauty services.
The Court quashed the judgment of the Court of Pisa No. 562/2025, which had held that consent to the taking of photographs, signed at the foot of the “treatment plan”, had been validly given, notwithstanding that the client had shortly beforehand refused to sign the image release and consent to the taking and use of her images.
The Order raises issues of practical relevance for operators in the sector; these issues are developed in the Court’s findings and conclusions.
The case and the decision of the Court of Pisa
The dispute arose from the relationship between a client and a beauty centre. Following a trial session, the client purchased a package of six massages, having expressly withheld, in the form provided to her, consent to the taking and use of her images.
According to the client, during the first session under the package, after her body-fat percentage had been measured, an operator used a tablet to take several photographs depicting her naked and with her face visible. The client immediately requested their deletion, but later discovered that the images had merely been moved to the device’s “recycle bin” and remained recoverable. She therefore terminated the relationship and brought proceedings, seeking a declaration that violations had occurred, damages and repayment of the amounts paid.
The beauty centre argued that, although the client had refused the image release, she had signed the “treatment plan”, which contained consent to photographs intended to document the results of the services.
By Judgment No. 562/2025, the Court of Pisa dismissed the claims, holding that the refusal to allow the use of the images for marketing purposes and the consent to photographs serving the treatment demonstrated awareness of the choice. It also held that the allegations concerning the manner in which consent had been collected were out of time. The client therefore appealed to the Supreme Court of Cassation.
The Cassation Court’s findings
The Supreme Court allowed the client’s appeal, in particular insofar as it challenged the breach and misapplication of Article 6(1) and Article 7(4) of Regulation (EU) 2016/679 (the “GDPR”), as well as the failure to examine decisive facts concerning the privacy notice and the contractual form.
The starting point is that the photographic image of a person is personal data: its processing is therefore lawful only where one of the legal bases for processing under Article 6 GDPR applies, in particular the data subject’s consent to processing for one or more specific purposes (point (a)), or where processing is necessary for the performance of a contract to which the data subject is party (point (b)). Under Article 4(11) GDPR, consent must constitute a freely given, specific, informed and unambiguous indication of the data subject’s wishes.
On this basis, the Court criticised the decision under appeal:
- the Court did not carry out the assessment required of it: the judge was required to verify that the signature of the “treatment plan” satisfied the elements qualifying as consent, as defined in Articles 4(11), 6 and 7 GDPR, and not merely to note that a contractual document had been signed;
- the burden of proof was reversed: under Article 7 GDPR, the Controller bears the burden of demonstrating consent and, accordingly, the court of first instance erred in holding that the client’s allegations concerning the manner in which consent was collected had been submitted out of time, since the client did not bear that specific evidential burden;
- separate signing does not prove awareness: the different and opposing choices made in the two parts of the contract – (i) refusal of the image release and consent for marketing purposes and (ii) consent to the “treatment plan” – far from demonstrating awareness of the choice, may at most have neutral and non-decisive significance when assessing whether the consent satisfies the statutory requirements;
- consent included in a written statement that also concerns other matters – in this case, the “treatment plan” – must be presented in a manner clearly distinguishable from the other matters; failure to satisfy this requirement adversely affects the statement, to the extent that no part of it constituting a breach of the GDPR is binding;
- there was no assessment of whether consent was freely given: when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract, with the evident aim of preventing coercion to give consent;
- the court of first instance, finally, did not rule on the “necessity” of processing for the performance of the contract, which, if established, could have led to the application of point (b) of Article 6.
The Court therefore allowed the appeal and quashed the judgment under appeal, remitting the case to the Court of Pisa, before a different judge, for reconsideration on the merits in light of the principles established concerning the lawfulness of processing and the conditions for consent.
Conclusions
The principle arising from the Order is clear: the validity of consent cannot be inferred from the signature of the contract or the sequence of choices made on the forms, but must be determined by a concrete assessment of the requirements laid down by the GDPR, the burden of proving which lies entirely with the Controller.
A further issue concerns data concerning health that may be collected in the context of beauty and wellness services. In addition to a legal basis under Article 6 GDPR, their processing requires one of the conditions set out in Article 9(2). For the ordinary activities of beauty centres, the explicit consent of the data subject is of particular relevance, whereas the exception for care purposes does not automatically extend to wellness services. It is therefore necessary to verify the nature of the data actually collected and prepare privacy notices and consent requests consistent with the purposes pursued.
Practical implications
For beauty and wellness centres, the principles identified by the Court require a review of the forms used and the manner in which data are actually collected and used:
| Requirement | Description |
| Identification of the legal basis | Verify whether processing is necessary for the performance of the contract (Article 6(1)(b) GDPR); if not, identify an appropriate legal basis and, where required, obtain valid consent. |
| Processing of data concerning health | Assess the applicability of Article 9 GDPR; where processing is based on consent, obtain explicit consent; exceptions for care purposes do not automatically extend to wellness services. |
| Distinguishability of the consent request | Make the request for consent clearly distinguishable from the other contractual provisions, including where it appears in the same document (Article 7(2) GDPR). |
| Distinction from consent to the service | Keep consent to the processing of personal data separate from any informed consent to the service: they serve different purposes and have different legal bases and, where required, must be requested separately and in a recognisable manner. |
| Specificity and granularity of consent | Provide separate choices for each purpose (e.g., provision of the service, marketing and profiling), without pre-ticked boxes and with the possibility of refusing without being subject to conditions. |
| Documentation of consent | Retain evidence of the data subject’s choice and of the privacy notice provided (form/version, date/time and withdrawal registers) in order to discharge the burden of proof. |
| Authorisation and staff training | Ensure authorisations, instructions and prior verification of the client’s choices before taking photographs or collecting other data, as well as the proper handling of refusals and withdrawals. |
| Effectiveness of erasure | Ensure definitive and irreversible removal where erasure is required; moving data to the “recycle bin” does not amount to erasure. |
| Use and dissemination of images | Regulate in writing the use and any dissemination of clients’ images, with separate and specific consents for different purposes; do not confuse an image release with consent to the processing of personal data. |
