ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
ICT Legal Consulting ICT Legal Consulting Via Borgonuovo 12 20121 Milan Italy Tel: +39 0284 2471 94 Fax: +39 0270 0512 101 Email: info.legal@ictlc.com Web: www.ictlegalconsulting.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Italian regulatory framework on the protection of personal data and privacy is dictated by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individu - als with regard to the processing of personal data and on the free movement of such data, repealing Direc - tive 95/46/EC (GDPR). To the extent that such protec - tion is not mentioned by the GDPR, it is regulated by Legislative Decree No 196/2003 (the “Privacy Code”). Further detailed rules are contained in Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as transposed into Italian law by the Privacy Code. With reference to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the preven - tion, investigation, detection and prosecution of crimi - nal offences or the execution of criminal penalties, the regulatory framework is instead governed by EU Directive 2016/680, transposed into the Italian legal system through Legislative Decree No 51/2018. Final - ly, other specific indications and/or interpretations are contained in the decisions, recommendations and guidelines issued by the national supervisory authori - ties and the European Data Protection Board (eg, in Italy, the requirements for system administrators).
Concerning the extraterritoriality application, Article 2 of the GPDR addresses the application to the pro - cessing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to: • the offering of goods or services, irrespective of whether a payment by the data subject is required, to such data subjects in the EU; or • the monitoring of their behaviour as far as their behaviour takes place within the EU. Finally, as regards the interaction with artificial intel - ligence (AI) rules (Regulation (EU) 2024/1689 and Ital - ian Law No 132/2025) and with cybersecurity rules (in particular, Italian Legislative Decree No 138/2024 transposing Directive (EU) 2022/2555, together with the determinations of the National Cybersecu - rity Agency in the NIS2 framework, Italian Law No 90/2024, and all implementing measures of Regu - lation (EU) 2022/2554), these instruments expressly defer to EU personal data protection law, leaving its content and scope unchanged and fully applicable. 1.2 Rights and Obligations General Principles Relating to Processing of Personal Data According to Article 5 (1) of the GDPR, personal data shall be: • processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”); • collected for specified, explicit and legitimate purposes and not further processed in a manner
200 CHAMBERS.COM
Powered by FlippingBook