Italy: Data Protection

Il Garante per la protezione dei dati personali ha sanzionato una società con €460.000 per aver violato la normativa sulla privacy nella gestione delle caselle di posta elettronica aziendale dei dipendenti. La decisione stabilisce che gli indirizzi email aziendali individualizzati e il loro contenuto costituiscono dati personali soggetti a garanzia di riservatezza, e che la conservazione sistematica dei messaggi richiede autorizzazione preventiva secondo lo Statuto dei lavoratori.

The Italian Data Protection Authority has ruled that an employer's systematic monitoring and retention of employee work email accounts constitutes unlawful data processing, imposing a substantial €460,000 fine. The case examines the boundaries between legitimate business interests and employee privacy rights, particularly regarding the confidentiality of work correspondence and the procedural requirements for workplace monitoring under Italian law.

Il Garante Privacy ha sanzionato un'azienda per l'utilizzo illecito di sistemi GPS sui veicoli aziendali che monitoravano i dipendenti ogni 60 secondi. Il provvedimento evidenzia le violazioni dei principi di minimizzazione e proporzionalità del GDPR, nonché l'assenza di una valutazione d'impatto preventiva. La decisione chiarisce quando il controllo tramite geolocalizzazione supera i limiti della liceità, anche in presenza di accordo sindacale.

An employee at Intesa Sanpaolo unlawfully accessed thousands of customer records over two years, leading to a €31.8 million fine from Italy's data protection authority. The ruling underscores that insider threats demand proactive, risk-based controls and that unauthorised access alone—even without data extraction—triggers serious breach notification obligations under GDPR.

The European Commission's Digital Omnibus Package proposes significant amendments to the AI Act, introducing targeted simplification measures for high-risk AI systems, extending regulatory relief to small-to-medium companies, and clarifying the interaction between AI regulation and existing EU legislation. The European Parliament has already published proposed amendments, with final adoption expected by the end of 2026 and gradual implementation beginning in 2027.

Law No. 132 (the Italian Artificial Intelligence Act) took effect on 10 October 2025.1 Under the Italian AI Act, at least one implementing decree that defines an "organic framework" for data, algorithms and artificial intelligence (AI)-training methods is due by October 2026.

After the first year of enforcing Regulation (EU) 2022/2560 on foreign subsidies distorting the internal market (the "FSR"), the European Commission has published a document...

With the new Data Act, the European Union (EU) wants to create a single European market for data, open up competition around data-driven business models and make it easier for customers to switch providers.

The Data Act means cloud service providers need to take action. Part 2 of our article provides an overview of the process for switching providers.