ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
Court set aside the General Court’s approach because it had relied on an abstract presumption (pseudonymi - sation = personal data) without assessing Deloitte’s concrete re-identification capability. 2.3 Collective Redress Mechanisms The national legislation on personal data protection does not currently provide explicit regulation for col - lective redress mechanisms. However, data subjects may rely on the tools generally available under civil procedure law or those designed to protect their rights as consumers. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation In Italy, the protection and governance of non-per - sonal data is largely shaped by directly applicable EU regulations, rather than by autonomous national leg - islation. There is no standalone Italian “horizontal” law equivalent to the EU Data Act; instead, Italy relies on the EU data strategy instruments, complemented only by sectoral or administrative measures. The starting point is the Free Flow of Non-Personal Data Regulation (Regulation (EU) 2018/1807), which establishes the principle of the free movement of non- personal data within the EU. It prohibits unjustified data-localisation requirements imposed by member states, and promotes portability and switching for professional users of data processing and cloud ser - vices. Importantly, for mixed datasets (where personal and non-personal data are intertwined), the Regula - tion operates alongside the GDPR: the GDPR applies to the personal component, while the free-flow rules apply to the non-personal component. This baseline is expanded by the Data Governance Act (Regulation (EU) 2022/868), which provides a cross-sector EU framework to increase data availabil - ity and sharing, covering both personal and non-per - sonal data. It regulates the re-use of certain protected data held by public sector bodies, introduces trusted roles such as data intermediation service providers, and supports voluntary mechanisms such as data altruism and the development of Common European
Data Spaces. Italy has adopted implementing meas - ures mainly to designate competent authorities and procedural arrangements, but the substantive regime remains EU-based. Finally, the EU Data Act (Regulation (EU) 2023/2854) – applicable across the EU, including Italy, from 12 September 2025 – constitutes the central horizon - tal regime for access to and use of data generated by connected products and related services (ie, IoT ecosystems). It sets out rights and obligations for key actors such as data holders, users (B2C/B2B) and data recipients, and applies to both personal and non- personal data depending on the nature of the dataset, subject to GDPR compliance for any personal ele - ments. A core pillar is the mandatory B2B/B2C data access and sharing framework, often under FRAND (fair, reasonable and non-discriminatory) terms, and another pillar addresses the cloud and edge layer by imposing rules on switching, interoperability and the removal of contractual/technical lock-ins in data pro - cessing services. Beyond these EU Regulations, Italy has not enacted a separate Data Act-like statute. National activity is mainly confined to sector-specific governance (espe - cially for public-administration data and cloud secu - rity classifications) and to procedural implementation where EU Acts require member state designation of authorities or enforcement structures. 3.2 Interaction of Data Regulation and Data Protection These frameworks are designed to complement, not override, privacy and IP rules, so the interaction works in layers. When the data to be accessed or shared includes personal data (or is part of a mixed dataset), the GDPR remains fully controlling. The Data Act and the Data Governance Act do not create a new lawful basis on their own: any disclosure must still rely on an Article 6 GDPR ground already applicable to the data holder, and must respect all GDPR principles, includ - ing confidentiality, minimisation, purpose limitation, transparency and security. In practice, the user’s Data Act access right can be exercised only within what is lawful under the GDPR, and any recipient of personal data must comply with the GDPR as an autonomous controller or processor.
207 CHAMBERS.COM
Powered by FlippingBook