skip to content
 

Data Protection Laws and Freedom of Expression: ItalyFile:Flag of Italy.svg

 

 

I. First-Generation Statutory Law

Italy did not adopt any data protection legislation during the first-generation period.
 
 

II. Second-Generation Statutory Law

Italy adopted second-generation data protection Act 675/1996 on the Protection of Individuals and Other Subjects with Regard to the Processing of Personal Data.  The Act was amended a number of times including through a reformulation into a Personal Data Protection Code through Legislative Decree 196/2003.
 
Special Expression Derogation
The Italian data protection legislation provided for limited derogations in favour of the journalistic media. It accordingly did not exempt the media from compliance with the data quality principles but certain legal provisions including a specially drafted Code of Practice which as finally adopted did set out special interpretative provisions in the media’s favour. Similarly, with regard to the proactive direct transparency the Data Protection Journalism Code stated that journalists “must identify themselves, their profession and the process of collection, unless this may endanger their safety or otherwise make it impossible for them to carry out their journalistic activity’ and further adds that ‘they must refrain from subterfuge and harassment’ (Data Protection Journalism Code, art 2(1)). With regards to the proactive indirect transparency rule, the provision in the Data Protection Journalism Code required the media to provide information unless this makes it “impossible for them to carry out their journalistic activity”, leaving it somewhat ambiguous whether such information would need to be provided to the data subjects themselves or merely to any third party who may be supplying data. In addition, the Code required that “if personal data are collected from data banks used by editorial offices, publishing companies must inform the public at least twice a year, through advertisements, of the existence of such data banks’, including also the address where they can apply to exercise their data protection rights. As regards the retroactive transparency rule, Italy provided only a very narrow derogation protecting the confidentiality of the sources of information held by journalists. Meanwhile, whilst the media were exempted from the general regime governing sensitive data, the Data Protection Journalism Code restricted the processing of health and sex life data via specific rule-bound provisions, whilst also requiring adherence to a strict public interest test when using any sensitive data within the other five categories. Meanwhile, the media did not have to comply with the general legitimating ground, but needed to adhere to provisions concerning the materiality of information, protection of a person’s residence, protection of children and protection of personal dignity which are set out in the Data Protection Journalism Code (Personal Data Protection Code, s 171(2) and Data Protection Journalism Code arts. 6-8). In contrast, an unconditional exemption from the notification of processing and data export condition was set out for the media (Personal Data Protection Code, s. 137).
Special expression outside of professional journalism was defined rather narrowly as processing “carried out on a temporary basis exclusively for the purposes of publication or occasional circulation of articles, essays and other intellectual works also in terms of artistic expression” (Ibid, s. 136).The derogations here were comparable to the journalistic exemptions. However, the minimal derogation from subject access which ensured the confidentiality of sources did not apply to these non-journalistic forms of special expression.
 
Broad Expression
No provision was adopted.
 
Personal Exemption
The provisions on liability for damage and the security principle applied in all cases of data processing. Otherwise, there was an exemption for the processing of personal data ‘carried out by natural purposes for exclusively personal purposes’ so long the data are not ‘intended to systematic communication and dissemination’.
 
Knowledge Facilitation Derogation
The law provided that processing for historical, scientific or statistical purposes could be considered compatible with the purposes for which the data had been previously collected, could be kept indefinitely and also transferred to another controller for these purposes (Personal Data Protection Code, s. 99 and s. 100 (which excluded sensitive data)). Otherwise the law unusually strongly distinguished between processing for statistical and scientific purposes, on the one hand, and historical purposes (largely focused on archives) on the other.In each case the law required the DPA to encourage the drawing up a co-regulatory code of conduct (see s. 102(1) and s. 106)).  The law itself recognized that processing health data without consent for medical, biomedical and epidemiological research might be expressly provided for by legislation or by a reasoned opinion of a geographically competent ethics committee and DPA authorisation (s. 110(1)).  The DPA issued a general authorisation in this context in March 2012.  The Act also recognised that the exercise of rectification etc. here may be completed without modifying the data themselves (s. 110(1)).  The Code further elaborated that processing without consent may be justified on ethical, methdological or organisational infeasability grounds (art. 11).  The Code indicated that other private sector processing of sensitive data would only be allowed on the basis of explicit consent (and written unless unduly burdensome) and with DPA authorisation (art. 9(4)).  In all cases it was specified that results be anonymous (s. 8(1)).  The Act itself indicated required that data processing for scientific research and statistical purposes not be used for taking decisions or measures with regard to the data subject or with a view to processing data for different purposes (s. 105(1)), that consent requirements could be simplified through specific authorization by the DPA (s. 107) and under s. 105(4) allowed when personal data had not been collected from the data subject themselves for other forms of publicity (to be further specified by the Code) to replace specific transparency in cases of disproportionate effort, this limitation not as in other European laws applying generally.
The provisions on historical purposes provided that such data “disseminated in any case if they relate to circumstances or events that have been made known either directly by the data subject or on account of the latter's public conduct” (s. 101(3)) and furthermore provided that the code of conduct should set out in particular “rules based on fairness and non-discrimination in respect of users, to be abided by also in communication and dissemination of data, pursuant to the provisions of this Code that are applicable to the processing of data for journalistic purposes or else for publication of papers, essays and other intellectual works also in terms of artistic expression” (s. 102(2)(a)).Interestingly, this acknowledged a clear link between historical purposes and the exercise of special expression.
Parliamentary Debates
Special Expression Derogation
The interface between data protection and journalism was a significant aspect of debate during the adoption of the Act 675/1996 and was influenced by different forces in the two parliamentary chambers.  The initial debate in the Senate resulted in changes focused on safeguarding the data subject with a stricter formulation of the exclusion of data subject control.[1] In contrast, the Chamber of Deputies sought (at least) an equal balance between freedom of information and the right to privacy through wide exemption subject to adherence to a code of conduct, the Senate adopted a more limited approach which restricted the former in favour of confidentiality/privacy.[2]  A particular reformulation empahsised by Gian Franco Anedda MP[3] was to Article 20(1)(d)[4] which enabled the dissemination of personal data within the scope of the journalistic profession without material restriction to the character of information related to facts of public interest but subject to restrictions imposed to protect privacy and in accordance with the code of conduct which the law required to be drawn up on a co-regulatory basis between the DPA and the journalistic profession).
 
Personal Exemption
As indicated above, the final version of the personal exemption was restrictively worded.  Gian Franco Anedda MP of the National Alliance group mentioned that Art. 3 of the proposed Act was amended by the Senate. However, it appears that no substantive debate took place.
 
Knowledge Facilitation Derogation
The necessity of a knowledge facilitation derogation in favour of the processing of historical data and statistical research was emphasized by Fabio Evangelisti MP. However, it appears that no substantive debate took place.[5]
 

III. Third Generation Statutory Law

Italy Decreto legislative 10 agosto 2018, n101.  Law No. 160 of 27 December 2019 adopted changes in a more permanent form and an English translation of the consolidated Personal Data Protection Code is available here.
 
Special Expression Derogation
The amendments expanded the definition of non-journalistic special expression to refer to processing “aimed exclusively at publishing or circulating, also occasionally, articles, essays and other intellectual works also in terms of academic, artistic or literary expression.” (see Data Protection Code, s. 136(1)(c)).  Subject to a grace period, the law also required the DPA to adopt a new journalism code of conduct through a co-regulatory process.  Otherwise, the provisions here mirrored adopted during the second-generation period (see ibid, s. 136-139).  These provisions do not explicitly establish the priority of the special expression derogation over the Knowledge Facilitation Framework.
 
Broad Expression
No provision was adopted.
 
Personal Exemption – see GDPR, art. 2(2)(c)
 
Knowledge Facilitation Framework - see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Under the amended law, the scope of this area was adjusted to conform to the new wording found in article 89 of the GDPR but in most other respects continues to mirror the old law.  The framework previously relating to historical purposes was rephrased as archiving purposes in the public interest or historical research purposes and similarly the provisions previously referring to statistical and scientific purposes to statistic purposes or scientific research purposes.  Whilst in light of direct effect of article 5(1)(b) of the GDPR the references to compatibility were removed, the provisions on keeping data indefinitely and also transferring data to another controller were retained (s. 99 and s. 100 (which still excludes sensitive including criminal-related data)).  The provisions on what is now styled archive purposes in the public interest or historical research purposes continue to acknowledge a clear link with the exercise of special expression. The law introduces a bespoke possibility of DPA approval which maybe of general nature to process sensitive data for scientific research or statistical research.  It is stated that this is only available for indirectly obtained data, is subject to a threshold of at least disproportionate effort and is subject to prior minimization and “anonymization” (which might refer to pseudonymization) of the data  (s. 110-a).  No clear basis is provided for the processing without consent of sensitive data under the provisions for archiving purposes in the public interest or historical research. 
Parliamentary Debates
Special Expression Derogation
In the Senate, during a debate of the Special Commission for the Examination of Urgent Acts, Rapporteur Perilli (of the Movimento 5 Stelle) inter alia opined on the need to provide for exemptions or derogations for the processing of personal data for journalistic purposes in accordance with Art. 85 GDPR.[6] The opinion was approved by the Commission, noting several technical inconsistencies in the transitional articles and the need to protect those exercises of freedom of expression which do not fall within the category of professional journalism.[7]
 
Knowledge Facilitation Derogation
In the Senate, in the statement of the Special Commission for the Examination of Urgent Acts, concerns were raised regarding the norms on the ‘re-use’ (‘riutilizzio’) of data for scientific and statistical purposes and the ‘interpretative doubts’ they cause. Such a permission to re-use could not extend to sensitive and judicial data, in particular relating to health and sex life. These concerns were reiterated in a dossier summarizing the legislative changes and comments made thereon.[8] The Confindustria Radio Televisioni criticized the proposed Art. 110bis as it would severely limit the re-use of data. The Confindustria noted in particular that the prior authorization and the limitation of the re-use of data to scientific and statistical research purposes would be contrary to Art. 85 GDPR. It would also unjustifiably limit the use of archives for journalistic purposes. This critique was reiterated by the Organismo Congressuale Forense. The Instituto Italiano per la Privacy, too, concurred. It proposed to limit the articles scope of application to sensitive genetic, biometric or health data in accordance with art. 9(4) GDPR.[9]
 

[1] See remarks of The Hon. Sandro Schmid (Democratic Left wing ’The olive tree’),  Rapporteur, Permanent committee XIV for the Euro- pean Union policies, in the consultative sitting, report of 17.12.1996 p.128.
[2] See remarks of The Hon. Gian Franco Anedda (National Alliance group) rapporteur of the Standing Committee II (Justice), in the legislative report, 17.12.1996, p.51.
[3] Ibid.
[4] A similar provision remained with section 137(3) of the reformulated Personal Data Protection Code.
[5] L’Ulivo, rapporteur of the XIV Committee for the European Union Policies, 18.09.1996, p. 110.
[6] Comissione Speciale Per L’Esame Degli Atti Urgenti Presentati Dal Governo, ‘Schema di decreto legislativo recante disposizioni per l'adeguamento della normativa nazionale alle disposizioni del Regolamento (UE) 2016/679, relativo alla protezione delle persone fisiche con riguardo al trattamento dei dati personali, nonché alla libera circolazione di tali dati e che abroga la direttiva 95/46/CE (regolamento generale sulla protezione dei dati) (n. 22)’ (20 June 2018) http://www.senato.it/japp/bgt/showdoc/frame.jsp?tipodoc=SommComm&-leg=18... (last accessed 4 August 2020).
[7] Ibid.
[8] ‘L’Adeguamento della Disciplina sulla Protezione die Dati Personali al Regolamento (UE) 2016/679 – Le posizioni espresso dagli auditi’ (18 June 2018) https://www.senato.it/service/PDF/PDFServer/BGT/-01067826.pdf (last accessed 4 August 2020).
[9] Ibid.