Source: https://iclg.com/practice-areas/data-protection-laws-and-regulations/italy
Timestamp: 2019-04-23 18:45:35+00:00

Document:
Prior to the entry into force of GDPR, the main legislation on data protection was the so-called “Privacy Code”, Legislative Decree No 196/2003 of 30 June 2003 and further amendments. The Privacy Code will not be repealed “tout court” with the entry into force of the GDPR. The so-called “European delegation Law” No 163/2017 of last October 2017 assigned the Government with the task of adapting the national legislation to the upcoming EU rules within a six-month period. So far, the “European Law” No. 167/2018 and the last yearly Budget Act have introduced some specific rules. The current regulatory position Italy is therefore in a “work in progress” phase, and some aspects are still uncertain. This questionnaire has been filled based on the information and on the legislation currently in force at the date of submission.
Legislative Decree No. 206/2005, the so-called Consumer Code.
“Guidelines on the processing of personal data contained in administrative documents and documents processed by public entities for publication and dissemination on the web” of 2 March 2011 .
The authority responsible for data protection in Italy is the “Garante per la Protezione dei dati personali”, also called “Garante della Privacy”, established in 1996 with Law No.675/1996 (hereinafter referred to as the “Garante”). Among the many tasks of the Garante, there are: the monitoring of the compliance of the processing of data with the law; examining claims and reporting; banning illegitimate processing; issuing general authorisation orders; disseminating information of data protection; collaborating with the legislature for the drafting; and enforcement of the law.
“Identifying data” means the personal data allowing to directly identify a data subject.
“Judicial data” means those data providing information on whether a data subject was investigated, charged and/or convicted for certain crimes.
“Anonymous data” means those data which originally, or following processing, cannot be associated to any specific data subject.
Personal data must be processed lawfully, fairly and in a transparent manner. Controllers must provide information to data subjects regarding the collection and further processing of their personal data. Such information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
A data subject has the right to obtain from a controller the following information in respect of the data subject’s personal data: (i) confirmation of whether, and where, the controller is processing the data subject’s personal data; (ii) information about the purposes of the processing; (iii) information about the categories of data being processed; (iv) information about the categories of recipients with whom the data may be shared; (v) information about the period for which the data will be stored (or the criteria used to be determine that period); (vi) information about the existence of the rights to erasure, to rectification, to restriction of processing and to object to processing; (vii) information about the existence of the right to complain to the relevant data protection authority; (viii) where the data was not collected from the data subject, information as to the source of the data; and (ix) information about the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on the data subject.
Data subjects have the right to lodge complaints concerning the processing of their personal data with the Italian Data Protection Authority, if the data subjects lives in Italy or the alleged infringement occurred in Italy.
The Italian Privacy Code (Art. 37 and ff.) provides for the obligation to notify the Garante of the processing of certain types of data which could be particularly sensitive, such as genetic data, data indicating the geographic position of a person or object during a communication, data related to the sexual or psychic health of a person and data detained by specific types of entities, sensitive data stored for staff recruitment purposes, etc. The Garante is allowed to extend the list of the types of processing which need prior notification.
Also, the data controller should communicate in advance to the authority any processing of data capable of revealing the state of health of a data subject as a result of a health research programme or when the processing implies a transfer of data between public authorities (Art. 39 Italian Privacy Code).
The GDPR system is driven by a different general rule. Under the GDPR, the controller carries out a prior assessment of the risk connected with the data treatment and only where it determines there is a high risk, the controller must consult the authority prior to processing such data (Art. 36 Italian Privacy Code).
It still remains to be seen whether the Italian implementation of the GDPR will expressly repeal the obligation of prior notification under the Italian Privacy Code.
The notification according to Art. 37 of the Italian Privacy Code should be carried out on one single occasion before the start of the data processing. It should include the personal data of the data subject(s), the purpose of the data processing activity and a general description thereof, in order to allow the Garante to assess the adequacy of the measures adopted with a view to ensuring the safety of the data processing.
Notification according to the Italian Privacy Code is carried out with respect to each data subject(s) based on the relevant data category and processing purpose.
Notifications according to the Italian Privacy Code are carried out by the data controller. The data controller is the entity or entities (local or foreign) having actual autonomous decision-making power over the purposes and methods of the processing in relation to the personal data they control, and should not be limited by choices made at the middle or top level of the entity.
According to the Italian Privacy Code, failure to notify or communicate data processing according to Articles 37 and 39 is subject to an administrative sanction of EUR 20,000 to EUR 120,000.
There is administrative fee of EUR 150 per notification.
According to the Italian Privacy Code, the notification should be done only once before the start of the processing of data. However, the notification shall be renewed in the event that there are updates to the information contained in the initial notification.
The processing of sensitive data is conditional upon the prior approval by the Garante. However, the Garante regularly issues general authorisation for certain types of processing (such as for processing by freelance workers, processing by associations and foundations, processing for scientific research, etc.).
The processing of data different from sensitive data and judicial data, and which implies specific risks for the fundamental rights and for the dignity of the data subject, shall undergo a prior check by the Garante.
According to Art. 39 of the Italian Privacy Code, data processing can be started after 45 days from communication to the Garante in the absence of any response. However, the Garante can issue a later communication to the data controller ordering to cease the treatment or amend the manner thereof.
Yes, it has to be completed online on the Garante website according to the Italian Privacy Code.
Yes, the Garante manages a publicly accessible register for notifications.
The notification is deemed complete once the online form has been completed, or the communication is received by the Garante.
Yes. The business that appoints a processor to process personal data on its behalf, is required to enter into an agreement with the processor which sets out the subject matter for processing, the duration of processing, the nature and purpose of processing and the obligations and rights of the controller (i.e., the business).
Recital 47 of the GDPR provides that the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding.
As to electronic marketing in Italy, there is an obligation to inform the data subject that data are processed for such purpose, and to obtain his explicit consent which shall be recorded in writing. Consent is always required for marketing and activities and the like.
Consent to automated commercial communications extends to traditional communication methods such as normal mail and phone calls which are not pre-registered. Consent to traditional means of communication does not automatically extend to automated means.
A public registry of the oppositions (opt-out) exists whereby the private citizens whose fixed line telephone number appears in the public telephone directories or similar can sign in, in order to prevent being contacted for direct phone marketing. A public registry for opting out from normal mail marketing has not been established yet.
The Italian Privacy Code and related rules apply to the processing of personal data, even if held abroad, carried out by anyone established in the Italian territory or in a place subject to the Italian sovereignty, as well as to the processing of personal data carried out by anyone established in the territory of a country outside the European Union and using, for processing, instruments located in the Italian territory, unless they are used only for transit purposes within the territory of the European Union (Art. 5).
It should be noted that, however, the GDPR will have a broader scope of application, as, in general, it applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not (Art. 3).
The Garante is active in such enforcement as it issues guidelines and notes on the issue and as it is competent to issue decisions imposing sanctions in the event of a breach of the Italian Privacy Code, including breaches of marketing restrictions. The Garante is particularly careful in monitoring the lawfulness of profiling activities.
According to the national rules, the data controller shall inform the data subject of the planned communication and/or transfer to third parties, also specifying what type of entities these are. The data controller shall also obtain a separate and specific consent from the data subject.
Breaches of marketing restrictions are subject to the sanctions provided for at Art. 161 and ff. of the Italian Privacy Code, which differ on the basis of the type of data breach incurred (for instance, the absence of notice on data processing is subject to the administrative sanction of between EUR 6,000 and EUR 36,000, the maximum penalty for unlawful data processing is EUR 120,000). Unlawful processing of data can also imply criminal liability.
No prior consent is needed for the use of the so-called technical or analytics cookies (i.e. those used for the sole purpose of transmitting over an electronic communications network, or those used only to the extent that they are strictly necessary for the provision of a service which was specifically requested by the subscriber or user).
Pursuant to Article 5 of the EU ePrivacy Directive, 2002/58/EC, the storage of cookies (or other data) on an end user’s device requires prior consent (the applicable standard of consent is derived from Directive 95/46/EC and, from 25 May 2018, the GDPR). For consent to be valid, it must be informed, specific, freely given and must constitute a real indication of the individual’s wishes. This does not apply if: (i) the cookie is for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (ii) the cookie is strictly necessary to provide an “information society service” (e.g., a service over the internet) requested by the subscriber or user, which means that it must be essential to fulfil their request.
The Commission’s proposal for a new ePrivacy Regulation, 2017/0003 (COD), provides that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors. For the other types of cookies, including third-party cookies, the new Regulation will render it more user-friendly as browser settings should provide for an easy way to accept or refuse tracking cookies and other identifiers.
The Garante issues guidelines and notes concerning cookies and it provides for related information through various channels. It is competent to issue sanction decisions and it regularly does so (see question 10.4 below).
The penalties for non-compliance with the data protection provisions are established at Article 161 and ff. of the Italian Privacy Code. These depend on the type of breach. For example, the omission or provision of unsuitable notifications can imply a sanction of between EUR 6,000–36,000; installation of cookies on users’ terminals without their prior consent can result in a sanction of between EUR 10,000–120,000; and omission or incomplete notification to the Authority can result in a sanction of between EUR 20,000–120,000.
A DPIA must be undertaken with assistance from the Data Protection Officer when there is a systematic monitoring of a publicly accessible area on a large scale. If the DPIA suggests that the processing would result in a high risk to the rights and freedoms of individuals prior to any action being taken by the controller, the controller must consult the data protection authority.
The Garante issued various notes and orders concerning CCTV; in particular, the order of 8 April 2010 contains binding provisions for all those making use of CCTV and aiming at ensuring the privacy of the data subjects. In particular, the limits on use do not differ from those regulating the processing of data through other means. When CCTV is only used for personal purposes (for security of personal property, for example) the Italian Privacy Code does not apply – and no consent is needed. However, when the Italian Privacy Code applies, it is necessary to operate a balance of interests between the need to acquire the consent of the data subject and the legitimate interests for which the CCTV is based (safety, collecting evidence, etc.).
Employee monitoring shall always be respectful of the fundamental rights of the employees, not only with regard to privacy, but also to personal dignity and to freedom of communication and of expression. The so-called “Jobs Act” of 2015 amended Art. 4 of the “Statute of Employees”, the main employee-related legislation. The new rules make a distinction between CCTV (and distance control devices) and other kinds of monitoring.
The former is not allowed unless: i) its use is linked to the organisation or production-related needs, or it is linked to safety or to the protection of the company’s assets; and ii) there is a trade union agreement or an administrative authorisation by local labour authorities.
The restrictions under points i) and ii) are not applicable to those other tools that can allow monitoring used by the employee directly to perform his/her tasks (including smartphones, PCs, etc.) and to the apparatus to record access and presence at the workplace. The data and information recorded by these tools can only be used for work-related purposes (which include disciplinary purposes).
Employees shall be provided with proper information (notification) concerning the monitoring carried out as described above. This shall include information on the existence, manner, compulsory or non-compulsory nature of the processing, on the consequence of a possible refusal to consent, the persons or entities which could process such data, the responsible data processors and the employees’ rights. In the absence of such notification to employees, the data cannot be used.
Trade unions (namely the internal trade union representatives (so-called RSA or RSU), or, in case of undertakings having theirs seats in different regions, the most representative national trade union associations) need to give their agreement for CCTV (and distance control devices). Where there is no agreement specific administrative authorisation is needed (see question 14.1 above).
The Garante regularly issues sanctions or bans on particular data processing activities when due to their nature, methods or effects, these imply significant prejudice to the data subject. For example, the Garante very recently banned a leading mobile phone operator from continuing its massive marketing activities of sending text messages and phone calls without the prior consent of the data subjects, and even subsequent to the data subjects having expressly indicated that they did wish not to be contacted by the operator.
In its judgment of 1 October 2015 in case C-230/14 (confirming its findings from the Google Spain case, C-131/12), the Court of Justice of the EU stated that the concept of “establishment” pursuant to Art. 4(1)(a) of the EU Data Protection Directive 95/46/EC cannot be interpreted restrictively, but rather must be interpreted in the light of the specific nature of the economic activities concerned. The Court clarified that even carrying out of a “minimal” real and effective activity could amount to “establishment” and thus trigger the application of the law of a certain Member State.
However, as the CJEU pointed out, there is a distinction between investigative and sanctioning powers: a data protection authority cannot impose sanctions against a controller established outside its jurisdiction, but can only investigate its activities in the territory of that Member State. In such a case, the data protection authority would need to seek the cooperation of the data protection authority of the State in which the controller is established, which may carry out other investigations and actually impose sanctions. In accordance with this principle, the Italian Garante would need to contact local data protection authorities in other jurisdictions in order to seek cooperation.
The answer to this question actually depends on the legal standing (or entitlement) of the law enforcement agencies to request the e-discovery/disclosure of documents, on the type of documents requested and on the reasons for requesting. In general, it should be taken into account that, other than privacy limitations, also strict attorney-privilege limitations apply in Italy. It should also be noted that e-discovery and disclosure requests are not part of the Italian legal system.
The Garante has not issued any specific guidance on this topic.
The Garante: (i) has been active in investigating and sanctioning telecom companies and other business carrying out aggressive telemarketing activities; (ii) is concerned about the risks connected to the amount of data circulating via social networks and the related profiling (especially after the Cambridge Analytica case); and (iii) is also active in the field of fighting cyberbullying.
The hot topic is currently the execution provisions that should be adopted by the Italian legislature in view of the entry into force of the GDPR, and the compliance measures and practices that businesses will have to put in place. Particulary important is the issue of the possible wide interpretation of the principle according to which data processing can be lawful when it is supported by a legitimate interest.

References: Art. 37
 Art. 39
 Art. 161
 Art. 4
 Art. 4
 CJEU