The Italian Data Protection Authority (DPA) has run an inspection on 11 telephony and Internet service providers as to the term and modalities of retention of traffic data. As a general principle, personal data cannot be retained for longer than the term necessary for the purpose for which they have been collected.…
The Italian Data Protection Authority held that data protection obligations in case of performance of marketing, advertising and commercial activities still apply to data of companies and associations. The problem had arisen since in 2011 the Italian Government had removed from the definition of "personal data" and "data subjects" for the…
The Italian data protection authority issued a decision against a company that had adopted a video survaillance system also allowing the audio survaillance of employees of a call center. Indeed, the Italian Worker's Bill of Rights prohibits tools aimed at the remote monitoring of workers which can be allowed only if required by…
The delivery of newsletters without the individuals' prior consent has been sanctioned with 9 months of imprisonment by the Italian Court of Cassation. Article 167 of the Italian Data Protection Code punishes with the imprisonment between 6 months and 24 months the processing of personal data without the consent of the data subject (and other privacy breaches) with either…
The Italian Data Protection Authority has published guidelines on the processing of personal data on health-related websites which provide stringent requirements. Websites, forum, blogs but even social networks that are dedicated to health-related issues provide advice, exchange of information and contain comments from users that in some cases can reveal very sensitive data about their…
The Italian Data Protection Authority has now introduced new relevant data protection obligations for banks. Indeed banks subject to Italian data protection law shall, among others,: 1. Communication of personal data within a group of banks Banks will be able to transfer customers' personal data to other banks of the same group only with the prior consent of the relevant customers,…
It expires today the deadline for the implementation of the so called EU Cookies Directive 2009/136/EC amending, among others, the ePrivacy Directive 2002/58/EC setting out specific privacy-related regulations governing the electronic communications sector. The provision of the EU Cookies Directive that is leading to the most relevant discussions concerns the obligation to…
The Italian Government has recently approved a decree amending some of relevant provisions of the Italian Privacy Code aimed at simplifying the privacy obligations for Italian businesses. In short, these are the main changes: COMPANIES' PERSONAL DATA: Italy was one of the very few EU countries…
Following a number of discussions on the topic, the revised version of the ePrivacy Directive governing the processing of personal data and the protection of privacy in the electronic communications sector will be shortly adopted by the European Commission. The current proposal prescribes: Mandatory Notification of Personal Data Breaches: communications providers and…
