ITALY Law and Practice Contributed by: Francesco Paolo Patti and Marta Vittoria Colombo, Studio Patti
1.1.4 Smart Contracts Under Italian law, so-called smart contracts can be accommodated within the existing framework of con- tract law, provided that the general requirements for contractual validity are satisfied. These include the agreement of the parties, a lawful cause ( causa ), an object that is sufficiently determined or determinable, and compliance with any applicable formal require- ments. The use of automated execution through code does not displace these elements. Rather, it presup- poses them. The legal analysis therefore remains centred on the existence of a valid agreement, the identification of the parties, and the determination of the contractual content. From this perspective, a smart contract is more accu- rately understood not as a distinct legal category, but as a technological modality for the performance and execution of contractual obligations. The fact that performance is automated does not eliminate the need to establish, through conventional legal means, that a contract has been concluded and to interpret its terms. In case of dispute, courts will continue to assess the parties’ common intention, and the code will be considered as one element – albeit a tech- nically relevant one – within the broader evidentiary framework. Italian legislation has nonetheless introduced statu- tory definitions that help situate these concepts within the legal system. Article 8-ter of Decree-Law No 135 of 2018, as converted into Law No 12 of 2019, defines “distributed ledger technologies” as shared, distrib- uted, replicable registers, accessible simultaneously, architecturally decentralised on a cryptographic basis and capable of recording, validating, updating and storing data in a manner that is verifiable and resist- ant to alteration. The same provision defines “smart contracts” as computer programs operating on such technologies, whose execution automatically binds two or more parties based on predefined effects. These definitions serve an important classificatory function, providing a point of reference for market par- ticipants and courts. However, they do not create a new category of contract or introduce a self-standing legal regime. The traditional principles of Italian con- tract law continue to apply in full. As a consequence,
ant nor inherently incompatible with data protection rules. Compliance depends on system design and governance choices, including data minimisation, identification of controllers and processors, lawful bases for processing, and security measures. The Italian Data Protection Authority ( Garante per la protezione dei dati personali ) aligns its approach with European guidance, including positions developed at the level of the European Data Protection Board and the European Data Protection Supervisor. In practice, a number of compliance principles have emerged. Market participants are generally expected to avoid recording personal data directly on immutable ledg- ers, to rely on off-chain storage solutions with on- chain references such as hashes, and to treat pseu- donymisation as a risk-mitigation technique rather than a full exemption from GDPR applicability. Par- ticular attention is required in defining mechanisms to address data subject rights, including requests for erasure or rectification. At a high level, the so-called right to be forgotten is not considered incompatible with blockchain technol- ogy, but it requires careful architectural planning. A commonly adopted approach involves separating the immutable ledger layer from the storage of personal data, so that the ledger contains only indirect refer- ences while personal data remains subject to modifi- cation or deletion off-chain. This layered model allows the immutability of the ledger to be preserved without undermining compliance with data protection obliga- tions. Finally, with regard to pseudonymisation, Italian prac- tice reflects the jurisprudence of the Court of Justice of the European Union, according to which data remains “personal” where individuals can be identified through reasonably available means. Consequently, blockchain identifiers and addresses are often treated as personal data if they can be linked, directly or indi- rectly, to a natural person. This reinforces a prudent compliance approach, under which blockchain solu- tions must be designed with the assumption that data protection rules will apply in full whenever identifiabil- ity cannot be definitively excluded.
338 CHAMBERS.COM
Powered by FlippingBook