Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 14 JUNE 2018

Data Protection & Cyber Security 2018

LCA Studio Legale
LCA Studio Legale
Contributor
LCA Studio Legale

LCA Studio Legale

LCA Studio Legale is an independent full practice law firm with renowned international experience...

View firm profile
Explore more from LCA Studio Legale

As regards personal data protection and cybersecurity, Italy's main law is the Personal Data Protection Code or Privacy Code (Legislative Decree No 196 of 30 June 2003: Codice in materia di protezione...

ItalyPrivacy
Gianluca De Cristofaro
Gianluca De Cristofaro
Chiara Bocchi
Chiara Bocchi

1. Basic National Legal Regime

1.1 Laws

As regards personal data protection and cybersecurity, Italy's main law is the Personal Data Protection Code or Privacy Code (Legislative Decree No 196 of 30 June 2003: Codice in materia di protezione dei dati personali o Codice Privacy), which constitutes the transposition of directive 95/46/EC and directive 2002/58/EC, and repeals Law No 675 of 31 December 1996 (the very first Italian data protection law). The Privacy Code is the consolidated statute on both data protection and cybersecurity, and it is complemented by guidelines, recommendations, orders and codes of conduct issued and approved by the Italian Personal Data Protection Authority (referred to as Garante per la protezione dei dati personali or Garante).

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Pseudonymised, Not Anonymous: What The Italian Garante’s €7 Million IQVIA Fine Means For Health Data

The Italian data protection authority fined IQVIA Solutions Italy €7 million for treating patient records as anonymous when they were actually pseudonymised personal data subject to GDPR. This decision demonstrates regulators' strict interpretation of what constitutes personal data, even as the EU considers narrowing this definition through the Digital Omnibus reforms.
GlobalPrivacy
Arnold & Porter
Arnold & Porter
Article

Tracking Pixels In Emails: The Garante’s New Guidelines And Requirements For Businesses

The Italian Data Protection Authority has issued comprehensive guidelines on tracking pixels in email communications, establishing strict transparency and consent requirements for both public and private entities. Organizations now face a six-month compliance deadline to overhaul their email marketing practices, update privacy notices, and implement granular consent mechanisms for these invisible tracking tools.
ItalyPrivacy
A&O Shearman
A&O Shearman
Article

Tracking Pixel And Email: New Guidelines Issued By The Italian Data Protection Authority To Be Implemented By 29 October 2026

On 17 April 2026, the Italian Data Protection Authority ( Garante per la protezione dei dati personali ) (“ Italian DPA ”) adopted the “ Guidelines on the Use of Tracking Pixel in email Communications ” ( doc. web n. 10241943 ), which set out the applicable legal framework, transparency obligations and conditions for obtaining consent for all entities using tracking pixels.
ItalyPrivacy
Chiomenti
Chiomenti
Article

EU KIDS Act: Brussels Rewrites The Rules For Digital Services For Minors

The European Commission's proposed EU Kids Act introduces sweeping new requirements for digital service providers, establishing a harmonised age threshold of 15 for social media access and mandating safety-by-design principles across online platforms. This comprehensive regulatory framework fundamentally reshapes how providers must verify ages, design interfaces, and protect minors in the digital space, with sanctions reaching up to 6% of worldwide annual turnover for non-compliance.
European UnionPrivacy
ADVANT Nctm
ADVANT Nctm
Article

When AI Meets Children: Italy’s Garante Fines Character.AI Over Transparency And Safeguarding Failures

The Italian Data Protection Authority has issued a landmark decision against Character Technologies, Inc., examining how generative AI services must comply with GDPR requirements when processing personal data for model training and operation. The case establishes critical precedents for transparency obligations, age verification mechanisms, and the timing of data protection impact assessments for AI developers operating in the European Union.
European UnionPrivacy
GVZH Advocates
GVZH Advocates
Article

Artificial Intelligence: Legislative Decree 160/2026 Enters Into Force On 30 September

Italy's new Legislative Decree No. 160/2026 fundamentally reshapes the legal landscape for artificial intelligence systems by introducing criminal liability for security failures and expanding corporate responsibility under the 231 framework. The legislation establishes strict requirements for high-risk AI systems while imposing significant penalties on organizations that fail to implement adequate technical safeguards and human oversight mechanisms. How will businesses need to restructure their AI governan
ItalyCorporate/Commercial Law
LCA Studio Legale
LCA Studio Legale
Article

Concessioni balneari: il Consiglio di Stato fissa i paletti sulle gare

Il Consiglio di Stato con la sentenza n. 6539 del 18 agosto 2026 chiarisce i tempi per l'indizione delle gare per le concessioni balneari e le tutele spettanti ai concessionari uscenti. La pronuncia stabilisce che il termine del 30 settembre 2027 non costituisce una proroga automatica, ma rappresenta il limite massimo entro cui i Comuni devono completare le procedure competitive, mentre gli indennizzi ai concessionari uscenti non sono automatici ma subordinati alla prova di investimenti non ammortizzati.
ItalyGovernment, Public Sector
LCA Studio Legale
LCA Studio Legale
Article

Intelligenza Artificiale: Dal 30 Settembre In Vigore Il D.Lgs. 160/2026

Il 30 settembre 2026 entrerà in vigore il D.Lgs. 160/2026 che introduce rilevanti novità in materia di responsabilità penale, civile e amministrativa degli enti per l'impiego di sistemi di intelligenza artificiale. Il decreto adegua la normativa nazionale al Regolamento UE 2024/1689 (AI Act) e interviene sul sistema della responsabilità amministrativa degli enti ai sensi del D.Lgs. 231/2001, rendendo necessario per le imprese valutare non solo la conformità tecnica dei sistemi di AI
ItalyCorporate/Commercial Law
LCA Studio Legale
LCA Studio Legale
Article

Piccole derivazioni idroelettriche: la CGUE esclude l’applicazione della Bolkestein

La Corte di Giustizia dell'Unione Europea ha stabilito che la Direttiva Bolkestein non si applica agli impianti di piccole derivazioni idroelettriche, poiché la produzione di energia elettrica costituisce un'attività di produzione di beni e non una prestazione di servizi. Questa sentenza chiarisce il quadro normativo applicabile alle concessioni di derivazione d'acqua e segna un importante cambio di rotta rispetto a precedenti interpretazioni dell'Autorità Garante della Concorrenza e del Merc
ItalyEnergy and Natural Resources
LCA Studio Legale
LCA Studio Legale