ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
5.4 Blocking Statutes There are no “blocking” statutes in European legisla - tion in addition to those described in the previous sec - tions concerning the transfer of data outside the EEA. 5.5 Recent Developments The most recent update was in 2024, when the Euro - pean Commission concluded the review process of 11 adequacy decisions regarding the transfer of personal data, confirming their validity. In this regard, the deci - sions remain effective, and it is permissible to con - tinue the free transfer of personal data to Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay.
• the provider must be able to object and obtain judicial review; and • the reviewing court must be empowered to take account of the provider’s EU-protected interests. To assess this, the provider can ask for an opinion from the national authority competent for international legal co-operation, especially where the request con - cerns trade secrets, commercially sensitive data, IP- protected material, or risks of re-identification; that authority may consult the Commission. A similar check applies if national security or defence interests may be involved. If the authority does not respond within one month, or concludes that the safeguards are not met, the provider is entitled to refuse the for - eign request. 5.3 Data Localisation Requirements With reference to personal data , European legislation on the protection of personal data does not provide for any obligation to store data within a specific mem - ber state or the EEA, aiming, on the contrary, to regu - late and facilitate the free movement of such data. In the case of transfers of data to third countries, how - ever, the provisions of Chapter V of the GDPR apply in order to guarantee an adequate level of protection of personal data (see 5.1 Restrictions on International Data Transfers ). With reference to non-personal data , Article 32 of the Data Act states that the providers of data process - ing services shall take all adequate technical, organi - sational and legal measures, including contracts, in order to prevent international and third-country gov - ernmental access and transfer of non-personal data held in the EU where such transfer or access would create a conflict with Union law or with the national law of the relevant member state.
212 CHAMBERS.COM
Powered by FlippingBook