ItalyGDPR Article 9 Special Categories and Codice Privacy Article 167(2)
Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Italy.
- Do not treat a publicly posted photograph or recording as freely processable for identification purposes; the Garante's Clearview AI decision found no valid legal basis for exactly that.
These lines are LexLint's reading of the law's text. Also read by: Garante per la protezione dei dati personali (Italian Data Protection Authority) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9124510
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- Garante per la protezione dei dati personali (Italian Data Protection Authority)
- Open questions
- Which safeguard measures set by the Garante under Article 2-septies of the Codice privacy govern the processing of biometric data for identification, beyond the prescriptions of Provvedimento 146/2019?
What it makes you log
Logging duty
GDPR Article 9 and Codice Article 167(2) set no record duty: Article 167(2) makes unlawful processing of special-category data an offence. The Garante's Provvedimento 146/2019, section 5.7(e), separately requires audit-log systems for access to centralized genetic-research databases; that prescription is not part of the provisions cited for this row.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category. The Codice Privacy adds its own criminal offense in Article 167(2), punishing the processing of Article 9 and 10 data in breach of Articles 2-sexies, 2-octies or the safeguards under Article 2-septies, which covers genetic, biometric and health data. The Garante's Provvedimento 146/2019 sets prescriptions for the processing of genetic data.
In its decision of , the Garante declared unlawful Clearview AI's processing of facial images collected by web scraping, including biometric data. It fined Clearview AI EUR 20 million in the same decision.
When LexLint raises it
When your app profile says your app processes biometric data, crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .