ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
Data Protection Enforcement Trends in Italy Overview Article 51 of the General Data Protection Regulation (GDPR) provides that “each member state shall pro - vide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union”. Under Article 58 GDPR, the supervisory authority is granted a wide range of pow - ers, including investigative, corrective, authorising and advisory powers, among which is – notably – the possibility to levy pecuniary fines and to impose a temporary or definitive ban on the processing of per - sonal data. In Italy, the competent supervisory authority is the Garante per la Protezione dei Dati Personali (so- called “Garante”, or GPDP), whose decisions can be appealed by applying to the ordinary tribunal on sec - ond degree, and to the Supreme Court of Cassation on third degree. The GPDP is widely considered one of most active and influential supervisory authorities, having issued – as of 31 December 2025 – more than 575 pub - licly available enforcement actions, amounting to over EUR315,696,105 in sanctions. This leaves Italy behind only Spain in terms of the number of sanctions issued, given that the Spanish supervisory authority has issued at least 1,027 sanctions, though levying only a total amount of approximately EUR137,721,810 in sanctions. The GPDP has issued fines and lever - aged its corrective powers – including the imposition of a ban on processing – towards most GDPR areas and industry sectors. There are, however, aspects of the GDPR on which the authority seems to focus its attention more often than others. Trends in Enforcement Traditionally, the GPDP has been especially concerned with combating unlawful telemarketing practices, in particular as regards transparency and consent requirements as well as the engagement of third par - ties (such as call centres) as data processors without the necessary data protection safeguards, including performance of audits by the data controller. In this
field, the GPDP has issued some of its highest sanc - tions ever published, such as those against Eni Gas e Luce (issued on 11 December 2019, for a total amount of EUR11.5 million), Tim (issued on 15 January 2020, for a total amount of EUR27.8 million) and Sky Italia (issued on 16 September 2021, for a total amount of EUR3.2 million). More recently, in July 2024, the GPDP ordered Hera (an energy provider) to pay a fine of EUR 5 million for violations in the processing of personal data of over 2,300 customers due to the insufficient implementation of safeguards by Hera’s data proces - sors, which in some cases had led to the activation of energy supply contracts without knowledge or con - sent from the users. During the last few years, the GPDP has also focused its attention on the protection of the data privacy rights of children, as apparent from the enforcement actions undertaken against the popular social network TikTok concerning data verification requirements. On 22 January 2021, following the highly publicised death of a ten-year old girl from Sicily participating in a “blackout” challenge, the GPDP imposed an immedi - ate limitation on the data processing concerning users “whose age could not be established with full cer - tainty so as to ensure compliance with the age-related requirements”. On 3 February 2021, the GPDP noted that, following the enforcement action, TikTok com - mitted to fulfilling GDPR age-verification requirements by taking a number of actions, including: • removing accounts belonging to users under 13 years of age; • employment of an AI-based system to verify age; • launching an information campaign to raise aware - ness; • including an in-app button for reporting those under 13 years of age; • improving the language of the privacy notice for users under 18 years of age; and • doubling the number of Italian platform content moderators. Another field where the GPDP has recently stepped up its enforcement actions is that of video-surveillance. In October 2023, the GPDP reprimanded an individual person for installing a home surveillance system with cameras capturing not only their own apartment but
215 CHAMBERS.COM
Powered by FlippingBook