Italy: Privacy

An employee at Intesa Sanpaolo unlawfully accessed thousands of customer records over two years, leading to a €31.8 million fine from Italy's data protection authority. The ruling underscores that insider threats demand proactive, risk-based controls and that unauthorised access alone—even without data extraction—triggers serious breach notification obligations under GDPR.

The European Commission's Digital Omnibus Package proposes significant amendments to the AI Act, introducing targeted simplification measures for high-risk AI systems, extending regulatory relief to small-to-medium companies, and clarifying the interaction between AI regulation and existing EU legislation. The European Parliament has already published proposed amendments, with final adoption expected by the end of 2026 and gradual implementation beginning in 2027.

Law No. 132 (the Italian Artificial Intelligence Act) took effect on 10 October 2025.1 Under the Italian AI Act, at least one implementing decree that defines an "organic framework" for data, algorithms and artificial intelligence (AI)-training methods is due by October 2026.

With the approval of Law No. 132 of September 23, 2025 (the "Law"), Italy becomes the first European Union member state to have adopted a comprehensive...

All 46 applicants have successfully passed this initial scrutiny, which will now continue today with the unsealing of the envelopes containing the economic bids supporting the applications.

The Italian Data Protection Authority has issued a new decision that further restricts employers' ability to use information from third-party reports, private conversations, or social media posts as evidence in disciplinary proceedings.