Processes biometric data, in Italy

Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) · Read the law's page

• Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Italy.
• Do not treat a publicly posted photograph or recording as freely processable for identification purposes; the Garante's Clearview AI decision found no valid legal basis for exactly that.

Garante Provvedimento n. 146 del 5 giugno 2019 · Read the law's page

• Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.
• Do not scrape or process publicly posted facial images to build a biometric identification database without a valid GDPR Article 9 basis.

European Commission, Guidelines on transparency obligations for providers and deployers of AI systems under Article 50 of Regulation (EU) 2024/1689, adopted 20 July 2026

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Italy as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, except within narrow exceptions the law allows.when it serves a public body
• Do not place on the market, put into service, or use an AI system that exploits individuals' vulnerabilities.
• Tell users, before or at the start of an interaction, that they are communicating with an AI system.
• Mark generated image, video, audio and text output in machine-readable form as artificially generated.

D.Lgs. 9 settembre 2026, n. 160, art. 10 · Read the law's page

• Where judicial police officers start facial recognition on a person sought as a suspect, the public prosecutor must submit a request to the judge for preliminary investigations to authorize it without delay and within forty-eight hours of the start (art. 10, comma 2).for a public body
• If the time limits are not observed or authorisation is refused, stop the use and delete the personal data, results and outputs, unless they are the body of the offence (art. 10, comma 2).when it serves a public body
• As controller, the Ministry of the Interior must carry out the data-protection impact assessment beforehand and consult the Garante (art. 10, comma 6).for a public body
• Keep personal data in the reference database for seven days from collection, then delete it automatically (art. 10, comma 7).when it serves a public body
• Allow access only to authorised persons, and record accesses and processing operations automatically in non-modifiable log files kept for five years (art. 10, comma 8).when it serves a public body
• Do not base a decision with adverse legal effects on the person concerned solely on facial-recognition results, and do not use the systems in an untargeted way or for generalised or indiscriminate biometric identification (art. 10, commi 10 and 11).for a public body
• If you operate a place or organise an event with particular public-order and security needs, you may install and maintain the AI components and biometric technologies at no new or greater cost to public finances, and the systems are then lent free of charge to the questura, which has their complete and exclusive use (art. 10, comma 13).
• This article binds the police forces and the Ministry of the Interior as controller, and lets the operators of places and the organisers of events install and maintain the systems at no cost to public finances (art. 10).

D.Lgs. 9 settembre 2026, n. 160, artt. 16-20 · Read the law's page

• If you are sued for damage caused in the use of an AI system, and the claimant presents facts and elements that make the claim plausible, produce on the court's order the evidence specifically relevant to how the system works, including the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the human-oversight information under Article 14 of Regulation (EU) 2024/1689; the order is limited to what is necessary and proportionate, and the court protects trade secrets and confidential information (art. 17, commi 1 to 4).
• If you hold such evidence as a third party to the action, produce it on the same terms (art. 17, comma 1).
• If the damage derives from a breach of an obligation under Regulation (EU) 2024/1689 and you contest the causal link between the breach and the damage, prove the contrary, because the link is presumed (art. 18, comma 1).
• Do not treat compliance with Regulation (EU) 2024/1689, even if certified under Chapter III, Section 5, as of itself excluding your liability (art. 19).
• If a person intending to sue asks whether liability insurance covers the damage, answer within thirty days with the existence and particulars of the contract and the insurer's name (art. 20, comma 1).

D.Lgs. 7 ottobre 2026, n. 179, artt. 4-6 e 21-23 · Read the law's page

• Do not engage in a practice that Article 5 of the EU AI Act prohibits.
• Comply with the obligations in Articles 16, 22 to 26, 31, 33, 34, 50, 73 and 80 of the EU AI Act that Article 23 of the decree backs with a fine.
• Give accurate and complete information to notified bodies and national competent authorities when they ask for it.

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).