ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
cal opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concern - ing health, or data concerning a natural person’s sex life or sexual orientation, is prohibited except in the following cases: • where the data subject has given explicit consent to the processing of that personal data for one or more specified purposes; • where processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment, social security and social protection law in so far as it is authorised by the law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; • where processing is necessary to protect the vital interests of the data subject or of another natu - ral person where the data subject is physically or legally incapable of giving consent; • where processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim, and on condition that the pro - cessing relates solely to the members or to former members of the body or to persons who have reg - ular contact with it in connection with its purposes, and that the personal data is not disclosed outside that body without the consent of the data subjects; • where processing relates to personal data that is manifestly made public by the data subject; • where processing is necessary for the establish - ment, exercise or defence of legal claims or when - ever courts are acting in their judicial capacity; • where processing is necessary for reasons of substantial public interest, on the basis of the law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; • where processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employ -
ee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services on the basis of the law or pursuant to contract with a health professional; • where processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices, on the basis of the law which pro - vides for suitable and specific measures to safe - guard the rights and freedoms of the data subject – in particular, professional secrecy (in this specific regard, reference is made to Article 2-sexies of the Privacy Code); and • where processing is necessary for archiving pur - poses in the public interest, scientific or historical research purposes, or statistical purposes. According to Article 2-septies of the Privacy Code, the Italian supervisory authority ( Garante per la Protezione dei Dati Personali GPDP) may also specify particu - lar safeguards for processing genetic data, biometric data and data concerning health. Personal Data Relating to Criminal Convictions and Offences According to Articles 10 of the GDPR and 2-octies of the Privacy Code – as amended by Article 71 (1)(g) of Law No 182/2025 – processing of personal data relating to criminal convictions and offences or related security measures is carried out only under the control of official authority or when the processing is author - ised by the law providing for appropriate safeguards for the rights and freedoms of data subjects. Data Relating to Minors In accordance with Article 8 of the GDPR and Article 2-quinques of the Privacy Code, restrictions on the processing of minors’ data concern their consent. In particular, minors who have reached the age of 14 may consent to the processing of their personal data in relation to the direct offer of information society services (below this age, consent must be given by those exercising parental responsibility). However, the data controller must draft the information and com - munications relating to the processing in particularly
202 CHAMBERS.COM
Powered by FlippingBook