ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
age-verification requirements by taking a num - ber of actions, including: • removing accounts belonging to users under thirteen years of age; • employment of an AI-based system to verify age; • launching an information campaign to raise awareness; • including an in-app button for reporting those under thirteen years; • improving the language of the privacy notice for users under eighteen years; and • doubling the number of Italian platform con - tent moderators. Another field where the GPDP has recently stepped up its enforcement actions is that of video surveillance. In October 2023, the GPDP reprimanded an individual for installing a home surveillance system with cameras capturing not only their own apartment, but also a public area (including a public park). According to the GPDP, the placement of the cameras violated the prin - ciple of lawfulness, as the data controller failed to show a legitimate interest capable of justify - ing the recording of public areas and conversa - tions through the audio system, as well as the principle of data minimisation. The decision is also interesting because it clarifies that, while domestic surveillance systems are generally exempt from having to comply with the GDPR, such exemption does not apply when involving public or third parties’ properties. The Garante issued a mere reprimand against the data con - troller, considering that the individual promptly rectified the situation by replacing the camera and redirecting it solely towards the entrance of their home. In June 2023, the GPDP issued a sanction of EUR20,000 against an Italian employer for hav -
ing, inter alia, installed a video surveillance sys - tem in its premises without having obtained the prior approval of the workers’ council or of the public labour authority, as required by article 4 of Law No 300/1970 (so-called Workers’ Statute). Moreover, no privacy notice had been drafted and made available to the workers. More recent - ly, in July 2024, the GPDP ordered the Turin municipality to share further information relat - ing to the use of AI-powered “smart CCTVs”, which would allegedly help local police forces to understand whether their intervention is needed in emergency situations, in order for the GPDP to be able to investigate the system’s compliance with the GDPR. Lastly, a field where the Garante has recently focused its attention is that of Artificial Intelli - gence, as shall be seen specifically in the fol - lowing section. The Italian Data Protection Authority at the Forefront of Artificial Intelligence Enforcement During the last couple of years, the GPDP has taken noteworthy initiatives in the context of Artificial Intelligence (AI), including by means of enforcement actions against providers of AI systems. As a result, the Garante is accrediting itself as one of the most active European Union supervisory authorities on the regulation of AI vis-à-vis the GDPR and Italian Data Protection Law. Below, we provide a brief overview of the most important initiatives undertaken by the GPDP in the AI field. Enforcement action against ClearviewAI On 9 March 2022, the GPDP fined the US-based company Clearview AI EUR20 million after find - ing it had carried out processing activities con - cerning biometric data of persons residing within Italian territory.
240 CHAMBERS.COM
Powered by FlippingBook