ItalyGDPR Article 82 and Azione di Classe (Codice di Procedura Civile Art. 840-bis)
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person in Italy who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Codice Privacy Article 167 (Trattamento illecito di dati, unlawful processing of data) punishes, for anyone acting to gain a profit or cause harm to the data subject and who thereby causes concrete harm: imprisonment from six months to one year and six months for processing in violation of the Article 123, 126, and 130 electronic-communications rules or a Garante order under Article 129 (Art. 167(1)); rising to imprisonment from one to three years where the unlawfully processed data are GDPR Article 9 or 10 special categories, or the violation is an unlawful transfer of personal data to a third country or international organization (Art. 167(2)-(3)). A related offense, Article 170, punishes failure to comply with a Garante order issued under GDPR Article 58(2)(f) that causes concrete harm to a data subject, with imprisonment from three months to two years, prosecutable only on the injured person's own complaint. The Codice Privacy's Titolo III, Capo II also criminalizes unlawful communication or dissemination of large scale processed data (Art. 167-bis), fraudulent acquisition of large scale processed data (Art. 167-ter), false statements to the Garante (Art. 168), and processing violations in an employment context (Art. 171); Art. 169's separate security measures offense is abrogated.
Penalty structure
Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the provisions listed in (a) to (e), including non-compliance with a supervisory-authority order under Article 58. The lower Article 83(4) tier, up to EUR 10,000,000 or 2 percent, applies instead to the Article 25 to 39 controller and processor obligations, including the Article 33 and 34 breach notification duties, recorded on the instrument covering those articles. Italy applies both GDPR tiers through the Garante's own Codice Privacy Article 166 procedure, confirmed against the article's own text: Article 166 maps specific Codice Privacy provisions to each GDPR Article 83 paragraph, directs that the Legge 24 novembre 1981, n. 689 administrative-sanctions procedure applies so far as compatible, and lets the Garante add an accessory sanction publishing the sanctioning order, in full or extract, on its own website.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Garante per la protezione dei dati personali (Italian Data Protection Authority), Italy's GDPR Article 51 supervisory authority, established under Codice Privacy Title II, Capo I (Artt. 153-154).
Enforcement record
Counts the corrective and sanctioning measures (provvedimenti correttivi e sanzionatori) the Garante reports for calendar year 2025 in the press summary of its annual report on its activity in 2025. The figure covers the Garante's enforcement of the personal-data regime as a whole, not only this instrument, and does not split fines from other corrective orders. The same summary reports that fines collected exceeded EUR 37 million and that 2,415 data breaches were notified to the Authority; neither figure is counted as an action.
- As of
- Source link
- https://www.garanteprivacy.it/garante/doc.jsp?ID=10266612
- Actions per year
- 506
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Can the azione di classe under Article 840-bis of the Codice di procedura civile, which protects diritti individuali omogenei, be used to claim compensation under Article 82 of the GDPR, which that article does not name?
What it makes you log
Logging duty
GDPR Article 82 gives a right to compensation, and the class action of Article 840-bis of the Codice di procedura civile is a court procedure; neither requires a log or record. The Garante's power to demand documents sits in Codice Article 157, and the court's power to order the respondent to produce evidence in Article 840-quinquies of the Codice di procedura civile, both outside the provisions this instrument cites.
- Kind
- None
- As of
What this law does
In Italy the supervisory authority under General Data Protection Regulation (GDPR) Article 51 is the Garante per la protezione dei dati personali. Under Article 166(3) of the Codice Privacy the Garante imposes the fines of GDPR Article 83. GDPR Article 82 arms an individual with a direct private right of action.
Italy additionally has a general class-action mechanism, Article 840-bis of the Codice di procedura civile (azione di classe), which covers homogeneous individual rights against enterprises or public-service managers, brought by an individual class member or a registered nonprofit organization. The class-action law entered into force on . The article does not name data protection specifically, and no use of it for a GDPR claim has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .