ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
ry, avoiding abusive or excessively burdensome clauses. Special attention is given to promoting data access for SMEs, which often face chal - lenges in negotiating fair terms with larger cor - porations. Equitable sharing of benefits The Data Act also emphasises the fair distribu - tion of benefits derived from data usage. This principle seeks to prevent monopolistic scenar - ios and promote equitable opportunities linked to data utilisation. Businesses are required to maintain clear and detailed documentation of their data management and sharing procedures, ensuring they can demonstrate compliance dur - ing inspections or audits by competent authori - ties. 3.4 Regulators and Enforcement Please see 1.2 Regulators . In Italy, the general rule is set out by Article 122 of the Privacy Code (which transposes Direc - tive 2002/58/EC), under which all cookies – and other similar tracking tools – other than those strictly necessary for the functioning of the web - site may be installed on the users’ devices only with their consent. In this regard, as clarified by the Guidelines adopted by the Italian Supervisory Authority in 2021, it is essential that consent for the use of cookies is collected in compliance with the prin - ciples established by the GDPR. Accordingly, it must be preceded by a multi-layered notice (cookie banner) that provides information about the cookies and the related personal data pro - cessing and allows the user to freely accept or 4. Sectoral Issues 4.1 Use of Cookies
refuse the use of cookies, as well as to change their decision at any time. A specific consideration applies to analytical cookies, which may be treated as necessary cookies (and therefore not require consent) only when (i) IP anonymisation features are enabled; (ii) the use of analytical cookies is strictly limited to the production of aggregated statistics; and (iii) they are used solely in connection with a sin - gle website or mobile application, such that they do not allow the tracking of users’ navigation across different websites or applications. 4.2 Personalised Advertising and Other Online Marketing Practices In Italy, the general rule is set out by Article 130(1;2) of the Privacy Code (which transposes Directive 2002/58/EC), under which commercial and promotional communications by email, fax, telephone and similar means of communication require the prior consent of the user (natural or legal person). However, Article 130(4) provides for an exception to the requirement of consent, allowing for the processing of the email address provided by the data subject in the context of the sale of a product or a service for the purpose of sending commercial communications aimed at the direct sale of products or services similar to those already purchased, provided that the data subject has been adequately informed and does not refuse such use, either initially or on the occasion of subsequent communications. With specific regard to telephone marketing activities, Article 130(3-bis) provides that data controllers may lawfully contact all users who have not objected to receiving commercial com - munications by telephone by registering in the Register of Opposition. In this sense, pursuant to Law No 5/2018, users may enlist in the register in order to prevent subsequent communications
233 CHAMBERS.COM
Powered by FlippingBook