{"id":74724,"date":"2026-09-28T12:17:42","date_gmt":"2026-09-28T10:17:42","guid":{"rendered":"https:\/\/www.lexia.it\/?p=74724"},"modified":"2026-09-28T14:37:33","modified_gmt":"2026-09-28T12:37:33","slug":"data-protection-beauty-sector","status":"publish","type":"post","link":"https:\/\/www.lexia.it\/en\/2026\/09\/28\/data-protection-beauty-sector\/","title":{"rendered":"Data protection and consent to the processing of personal data in the beauty and wellness sector"},"content":{"rendered":"\n

By Order No. 25117, published on 8 September 2026, the First Civil Chamber of the Supreme Court of Cassation ruled on the conditions for the lawful processing of personal data and, in particular, on the requirements for valid consent collected under a contract for the provision of beauty services.<\/em><\/p>\n\n\n\n

The Court quashed the judgment of the Court of Pisa No. 562\/2025, which had held that consent to the taking of photographs, signed at the foot of the \u201ctreatment plan\u201d, had been validly given, notwithstanding that the client had shortly beforehand refused to sign the image release and consent to the taking and use of her images.<\/em><\/p>\n\n\n\n

The Order raises issues of practical relevance for operators in the sector; these issues are developed in the Court\u2019s findings and conclusions.<\/em><\/p>\n\n\n\n

The case and the decision of the Court of Pisa<\/strong><\/h2>\n\n\n\n

The dispute arose from the relationship between a client and a beauty centre. Following a trial session, the client purchased a package of six massages, having expressly withheld, in the form provided to her, consent to the taking and use of her images.<\/p>\n\n\n\n

According to the client, during the first session under the package, after her body-fat percentage had been measured, an operator used a tablet to take several photographs depicting her naked and with her face visible. The client immediately requested their deletion, but later discovered that the images had merely been moved to the device\u2019s \u201crecycle bin\u201d and remained recoverable. She therefore terminated the relationship and brought proceedings, seeking a declaration that violations had occurred, damages and repayment of the amounts paid.<\/p>\n\n\n\n

The beauty centre argued that, although the client had refused the image release, she had signed the \u201ctreatment plan\u201d, which contained consent to photographs intended to document the results of the services.<\/p>\n\n\n\n

By Judgment No. 562\/2025, the Court of Pisa dismissed the claims, holding that the refusal to allow the use of the images for marketing purposes and the consent to photographs serving the treatment demonstrated awareness of the choice. It also held that the allegations concerning the manner in which consent had been collected were out of time. The client therefore appealed to the Supreme Court of Cassation.<\/p>\n\n\n\n

The Cassation Court\u2019s findings<\/strong><\/h2>\n\n\n\n

The Supreme Court allowed the client\u2019s appeal, in particular insofar as it challenged the breach and misapplication of Article 6(1) and Article 7(4) of Regulation (EU) 2016\/679 (the \u201cGDPR<\/strong>\u201d), as well as the failure to examine decisive facts concerning the privacy notice and the contractual form.<\/p>\n\n\n\n

The starting point is that the photographic image<\/strong> of a person is personal data<\/strong>: its processing is therefore lawful only where one of the legal bases for processing under Article 6 GDPR applies, in particular the data subject\u2019s consent to processing for one or more specific purposes (point (a)), or where processing is necessary for the performance of a contract to which the data subject is party (point (b)). Under Article 4(11) GDPR, consent must constitute a freely given, specific, informed and unambiguous indication<\/strong> of the data subject\u2019s wishes.<\/p>\n\n\n\n

On this basis, the Court criticised the decision under appeal:<\/p>\n\n\n\n