FAQs On Sanctions Under The Italian Privacy Legislation

The Italian legislative decree no. 101 of August 10, 2018, amending and adapting the Italian Data Protection Code (Legislative decree no. 196/2003) to the GDPR, confirmed a hybrid punitive framework based on both administrative fines and criminal penalties.

The legislative decree no. 101/2018 has indeed implemented the right, granted by article 84 of the GDPR to the all the member states, to lay down rules on other penalties—including criminal penalties— for infringements of certain data protection obligations, in addition to the strict administrative fines provided for by the GDPR. Such implementation has taken into account the ne bis in idem principle, as provided for by Recital 149 of the GDPR, according to which the imposition of criminal penalties and of administrative penalties should not lead to a breach of the principle of ne bis in idem.

Here below you can find a FAQ list concerning the main provisions on penalties provided by the new Italian Data Protection Code.

1. Which provisions of the Italian Data Protection Code entail administrative fines?

In addition to the cases provided for by the GDPR, under Article 166 of the Italian Data Protection Code, administrative fines up to €10 million or up to two percent of the total worldwide annual turnover apply to the infringements of the certain provisions of Italian Data Protection Code, including the following:

Failure to use clear and plain language for the purpose of obtaining valid consent for processing minors' personal data in relation to the direct offer of services of the information society; Failure to adopt the measures provided for by the Italian data protection authority (Garante per la protezione dei dati personali) in relation to processing activities carried out for the performance of a task of public interest that presents high risks; Failure to provide information in accordance with Articles 13 and 14 of the GDPR in relation to traffic data processed by providers of public communication networks or publicly available electronic communications services; Failure to carry out a DPIA (data protection impact assessment) in the context of medical, biomedical and epidemiological research. Higher administrative fines, up to €20 million or four percent of the total worldwide annual turnover, also apply in case of infringement of certain provisions of the Italian Data Protection Code, including the following:

Failure to obtain a valid consent for processing minors' personal data in relation to the direct offer of services of the information society; Dissemination of biometric, genetic and health-related data; Infringements of the principles set forth in relation to the processing of judicial data; Unlawful processing of personal data relating to...