Here you can read some articles on Italian and international privacy, cybersecurity and data protection issues drafted by either Giulio Coraggio or the other authors of GamingTechLaw.
Cybersecurity liability for the supermarket freezer attacks that hit France in October and northern Europe on 1 November 2026 will turn on what each operator did in the three weeks between the two waves, and the questions it raises, from NIS2 scope to food law and insurance, must be answered in the usual emergency, just as CRA reporting, national cyber laws and the new product liability regime land on the same companies.
The European Data Protection Board (EDPB) recently adopted Guidelines 04/2026 on administrative fines (published on 17 September 2026 and open for public consultation until 13 November 2026).
NIS 2 Italy has moved from registration to enforcement. Entities listed in April 2025 have reached the 18-month deadline for the basic security measures this month, incident notification has been mandatory since January, and the annual cycle of declarations and updates now runs whether boards pay attention to it or not.
The EDPB consultation on the anonymisation and web scraping guidelines closes on 30 October 2026, and the companies with most at stake are those already relying on de-identified datasets or on scraped training data, because the final text will become the benchmark supervisory authorities apply when those datasets are challenged.
The new tracking pixel rules adopted by the Italian data protection authority become binding on 29 October 2026, requiring prior consent for the invisible images that report when a marketing email is opened, and companies that have not rebuilt their consent, withdrawal and identifier design by that date will be exposed to an authority that can verify the breach from outside the company, simply by receiving one of their emails.
When your own company’s AI agent is hacked, who is liable for what happens next? This is a question I expect to hear much more often as companies give AI agents access to internal systems, business applications, customer data and, increasingly, the ability to take actions without a human approving every step.
