[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [BUSINESS]

6 clusters · 19 sources · 20 days · First seen · Last updated

Italy data privacy and AI regulation enforcement

Overview

Italy is strengthening its legal and regulatory framework regarding data privacy and artificial intelligence security. The Italian Data Protection Authority (Garante) has issued significant sanctions for GDPR non-compliance. Notably, IQVIA Solutions Italy S. r. l. was fined 7 million euros for processing the health data of approximately one million patients without true anonymity, as detailed information allowed for potential re-identification. Other enforcement actions include a 15,000 euro fine against Agenzia per l'Italia Digitale (AgID) for failing to remove candidate data from a transparency portal, and sanctions against Poste Italiane (48,000 euros) and Deutsche Bank (33,000 euros) regarding inadequate privacy notices for BancoPosta loan applications. A 300,000 euro fine against an energy provider further emphasized the principle of accountability, signaling that privacy policies must be actively applied rather than merely documented.

Parallel to these actions, Italy has introduced criminal penalties for failures in high-risk AI systems through Legislative Decree 160/2026. Under Article 437-bis of the penal code, individuals may face one to five years of imprisonment if technical security omissions during the design, training, or production of high-risk AI systems endanger life or public safety. This aligns national law with the European Union’s AI Act.

Expanding oversight to the workplace, Legislative Decree no. 179/2026 mandates an “anthropocentric approach” in employment relationships. Article 41 prohibits decisions based solely on automated processing, while Article 42 requires companies to assess AI’s impact on the psychophysical well-being of employees. Employers must update safety documentation to address risks such as technostress, algorithmic surveillance anxiety, and errors caused by AI hallucinations.

Entities

Garante per la protezione dei dati personali · Poste Italiane · Agenzia per l'Italia Digitale · Deutsche Bank · Italy

Timeline

  1. [TECHNOLOGY] 4 sources
    Italy introduces new AI regulations for workplace safety and decision-making

    Italy's Legislative Decree no. 179/2026 mandates human oversight in AI-driven employment decisions and requires employers to assess AI's impact on worker health and safety.

  2. [BUSINESS] 2 sources
    Italian Data Protection Authority fines AgID and Poste Italiane

    Italy's privacy regulator fined AgID, Poste Italiane, and Deutsche Bank for various data protection and transparency violations.

  3. [BUSINESS] 2 sources
    Italy's Data Protection Authority restricts workplace AI and surveillance

    Italy's Data Protection Authority has banned AI-driven emotional monitoring in the workplace and fined a company for unauthorized video surveillance, reinforcing employee privacy rights.

  4. [BUSINESS] 5 sources
    Italy fines IQVIA €7 million over patient health data privacy

    Italy has fined IQVIA Solutions Italy €7 million for unlawfully processing the health data of one million patients, ruling that the company's database failed to ensure true patient anonymity.

  5. [TECHNOLOGY] 3 sources
    Italy introduces criminal penalties for high-risk AI security failures

    Italy has introduced Article 437-bis to its penal code, establishing criminal penalties of one to five years for failing to secure high-risk AI systems, aligning national law with the EU AI Act.

  6. [INTERNATIONAL] 4 sources
    Italy's Data Protection Authority issues major privacy fines

    The Italian Data Protection Authority has issued major fines, including 7 million euros against IQVIA, for improper handling of sensitive health data and failing to demonstrate practical GDPR accountability.

Sources

ad-hoc-news.de · aduc.it · bollettinoadapt.it · business.laleggepertutti.it · centrostudilivatino.it · cyberinsider.com · databreaches.net · diritto.it · editorialedomani.it · europesays.com · fedaiisf.it · federlazio.it · helpconsumatori.it · ilgiornaledellazio.it · ilsoftware.it · newsmondo.it · ordinemedicifc.it · pharmacyscanner.it · risoluto.it

This summary has been updated 4 times: see revision history