ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
Failure to submit written counterarguments or a request for a hearing shall not prejudice the continu - ation of the proceedings. Decision Where necessary, the board of the GPDP, by its own resolution, shall adopt the corrective and sanctioning measures referred to in Article 58 (2) of the GDPR (in the case of an administrative pecuniary sanction, the quantum is calculated on the basis of the criteria indicated by Article 83 of the GDPR). The decision is notified to the parties by the department, service or other organisational unit that has supervised the preliminary investigation. Appeal Against Measures of the GPDP Under penalty of inadmissibility, an appeal against the measures adopted by the GPDP must be lodged within 30 days from the date of communication of the decision or within 60 days if the appellant resides abroad, with the ordinary court of the place where the data controller resides, or with the court of the place of residence of the data subject. At the time of the appeal, it is also possible to request the court to suspend the enforceability of the contested decision. The so-called “work ritual” applies to the judicial pro - cedure, and the sentence that defines the judgment is not appealable before the judge and may prescribe the necessary measures and compensation for dam - ages. 1.9 Enforcement Trends Over the past 24 months, Italian enforcement has con - centrated on a few high-risk clusters: • telemarketing and unlawful lead chains, with record-level fines (notably the Enel Energia case) for weak control over data sources and processors; • generative AI and web-scraping, where the GPDP has moved from warnings to major sanctions (eg, OpenAI/ChatGPT, Replika) focusing on lawful basis for training, transparency and child protection; • biometrics/facial recognition, treated as exception - al and stopped when safeguards or voluntariness are insufficient; • workplace monitoring via metadata and logs, now enforced as strictly as traditional surveillance; and
• cookies/dark-pattern consent, seen as basic com - pliance hygiene. A parallel trend is the growing privacy–competi - tion convergence, with Italian Competition Authority (AGCM) scrutiny on consent and data-combination practices.
2. Privacy Litigation 2.1 Privacy Litigation Overview
In recent years, data protection litigation in Italy has experienced significant growth, driven by an increas - ing awareness of rights among data subjects. The most frequent disputes involve unlawful data processing, data breaches, and the improper use of personal data by companies and public administra - tions. Claims for compensation for privacy violations, particularly for non-material damages, are also on the rise. In this context, the GPDP is playing a crucial role, imposing substantial fines that influence corporate strategies, seeking to stay ahead of other European authorities, and positioning itself as a leader on issues related to AI (for instance, the proceedings initiated against OpenAI and ChatGPT, which concluded with a sanction in December 2024) and employee monitor - ing, especially concerning the retention of metadata generated through employees’ use of email tools (ie, the decision against Regione Lombardia on metadata and logs relating to internet browsing). 2.2 Recent Case Law The most significant recent decision for EU/Italian privacy litigation is the CJEU’s Deloitte judgment C-413/23 P ( EDPS v SRB ), 4 September 2025. The Court held that pseudonymised data is not automati - cally “personal data” for every actor: for a third-party recipient, the qualification depends on whether that recipient has reasonably likely and practically avail - able means to re-identify individuals. If, in the recipi - ent’s hands, identification is not realistically possible, the data may be treated as anonymous for that recipi - ent, even though it remains personal data for the origi - nal controller who retains the re-identification key. The
206 CHAMBERS.COM
Powered by FlippingBook