[CLSTR]
< Back to situation

[REVISION HISTORY]

Italy data privacy and AI regulation enforcement

Updated 4 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-22 15:36 UTC → 2026-10-23 13:28 UTC · added removed

Italy is strengthening its legal and regulatory framework regarding data privacy and artificial intelligence security. The Italian Data Protection Authority (Garante) has issued significant sanctions for GDPR non-compliance, such as a 7 million euro fine against non-compliance. Notably, IQVIA Solutions Italy S. r. l. was fined 7 million euros for improper processing of patient the health data. data of approximately one million patients without true anonymity, as detailed information allowed for potential re-identification. Other enforcement actions include a 15,000 euro fine against Agenzia per l'Italia Digitale (AgID) for failing to remove candidate data from a transparency portal, and sanctions against Poste Italiane (48,000 euros) and Deutsche Bank (33,000 euros) regarding inadequate privacy notices for BancoPosta loan applications. A 300,000 euro fine against an energy provider further emphasized the principle of accountability, signaling that privacy policies must be actively applied rather than merely documented. Parallel to these enforcement actions, Italy has introduced criminal penalties for failures in high-risk AI systems through Legislative Decree 160/2026, which allows for 160/2026. Under Article 437-bis of the penal code, individuals may face one to five years of imprisonment if technical security omissions during the design, training, or production of high-risk AI systems endanger life or public safety. This aligns national law with the European Union’s AI Act. Expanding its oversight to the workplace, the Garante has previously prohibited AI systems designed to analyze employee emotions. This regulatory focus has been further formalized through Legislative Decree no. 179/2026, which introduces specific rules for AI in employment relationships. This decree emphasizes 179/2026 mandates an “anthropocentric approach” and mandates stronger human supervision in decision-making. Under employment relationships. Article 41 of the new decree, employers are prohibited from making prohibits decisions regarding specific aspects of employment based solely on automated processing. Furthermore, processing, while Article 42 requires both public and private companies to assess the AI’s impact of AI on the psychophysical well-being of employees. Employers must now update occupational safety documentation to address risks including such as technostress, anxiety stemming from algorithmic surveillance, surveillance anxiety, and errors caused by AI hallucinations or faulty model outputs. These assessments must account for work rhythms influenced by algorithmic scheduling and the use of predictive algorithms in operational processes. hallucinations.

Versions

  1. 2026-10-23 13:28 UTC Italy data privacy and AI regulation enforcement
  2. 2026-10-22 15:36 UTC Italy data privacy and AI regulation enforcement
  3. 2026-10-13 09:11 UTC Italy data privacy and AI regulation enforcement
  4. 2026-10-05 12:43 UTC Italy data privacy and AI regulation enforcement
  5. 2026-10-03 12:06 UTC Italy data privacy and AI regulation enforcement

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.