Law No. 196/2009 (Italy)

Law No. 196/2009 (Italy)
Name	Law No. 196/2009
Long title	Italian Code regarding the protection of personal data
Enacted by	Italian Parliament
Enacted	2009
Status	Amended

Law No. 196/2009 (Italy) Law No. 196/2009 codified provisions on personal data protection in the Italian legal system, integrating prior Italian statutes and aligning national rules with European instruments such as the Directive 95/46/EC and the Charter of Fundamental Rights of the European Union. The law established a consolidated framework for processing personal data affecting entities including Comune di Roma, Ministero dell'Interno (Italy), Agenzia delle Entrate, and private actors such as ENI and Fiat Chrysler Automobiles. It served as the principal domestic norm until extensive reforms following the Regulation (EU) 2016/679.

Background and Legislative Context

Law No. 196/2009 emerged amid debates involving the Italian Parliament, the Senate of the Republic (Italy), the Camera dei Deputati, and oversight from the Garante per la protezione dei dati personali against a backdrop of European developments like Directive 95/46/EC and the drafting of Regulation (EU) 2016/679. The legislative process drew input from stakeholders including the Italian Data Protection Authority, Confindustria, trade unions such as CGIL, and academic institutions like the University of Bologna and Sapienza University of Rome, reflecting controversies reminiscent of disputes around Codice Civile (Italy) revisions and legislative responses to judgments from the European Court of Human Rights and the Court of Justice of the European Union. Political actors including Silvio Berlusconi, Giorgio Napolitano, and cabinets led by Romano Prodi and Mario Monti influenced timing and content of the code.

Key Provisions and Structure of the Law

The code structured Italian protections by consolidating principles, rights and obligations in titles mirroring provisions seen in Convention 108 and Directive 95/46/EC, defining terms such as data controller and data processor with references to public bodies like the Ministero della Salute and private firms such as Telecom Italia. It enumerated lawful bases for processing applied to contexts involving Agenzia delle Entrate, INPS, and Istituto Superiore di Sanità and set rules for sensitive data categories linked to decisions in cases litigated before the Corte Suprema di Cassazione and adjudicated by the Tribunale di Milano. The code prescribed safeguards for automated decision-making, cross-border data transfers referencing regimes associated with United States entities, and obligations for breach notification paralleling standards later codified in Regulation (EU) 2016/679.

Implementation and Administrative Bodies

Implementation duties were assigned to the Garante per la protezione dei dati personali, Italian ministries including the Ministero della Giustizia (Italy), supervisory bodies like AGCOM, and administrative offices such as Agenzia per l'Italia Digitale, coordinating with regional authorities like Regione Lombardia and municipal administrations including Comune di Milano. The Garante exercised powers comparable to authorities in France (CNIL) and United Kingdom (ICO), issuing guidelines, measures, and sanctions that involved public employers such as Polizia di Stato and private corporations like Enel. Implementation also entailed collaboration with European networks such as the European Data Protection Board and international forums including the OECD and Council of Europe.

Impact on Data Protection Practices

The code influenced operational practices within institutions such as Ministero dell'Economia e delle Finanze, Banca d'Italia, and private actors including UniCredit and Intesa Sanpaolo by necessitating privacy impact assessments, appointment of data processors, and documentation standards resembling those later enforced across the European Union. Its provisions shaped corporate compliance programs at multinationals like Fiat and Pirelli and directed public sector reforms in entities such as Agenzia delle Entrate and INAIL, while affecting litigation strategies before the Corte Costituzionale and enforcement in proceedings at the Tribunale di Roma. The code also informed scholarly commentary in journals affiliated with Scuola Superiore Sant'Anna and policy recommendations from think tanks like Istituto Affari Internazionali.

Amendments, Jurisprudence and Legislative Revisions

Following rulings by the Court of Justice of the European Union and national decisions of the Corte Costituzionale, Law No. 196/2009 underwent amendments and harmonization efforts culminating in legislative acts and decrees linked to Regulation (EU) 2016/679 and national measures promoted by cabinets of Matteo Renzi and Paolo Gentiloni. Jurisprudence from courts including the Corte Suprema di Cassazione and administrative decisions by the Consiglio di Stato interpreted provisions on consent, profiling, and cross-border transfers, while regulatory guidance from the Garante and cooperative mechanisms within the European Data Protection Board guided transitions. Subsequent legislative instruments adjusted sanctions, administrative procedures, and the interplay with sectoral laws such as those governing Telecom Italia, RAI, and public procurement frameworks linked to the Code of Public Contracts (Italy).

Criticisms and Controversies

Critics including civil society groups such as Associazione Nazionale Difesa Consumatori and academics from Università Commerciale Luigi Bocconi argued that the code retained ambiguities similar to earlier disputes over the Testo Unico and raised concerns echoed in debates involving Transparency International and media outlets like La Repubblica and Il Sole 24 Ore. Controversies arose over balancing surveillance prerogatives of security agencies like the Agenzia per la Sicurezza Nazionale with privacy rights upheld in cases before the European Court of Human Rights, debates on the adequacy of sanctions vis-à-vis multinational firms such as Google and Facebook, and tensions between national authorities and EU institutions including the European Commission. These disputes prompted legislative reviews and continued public, judicial, and scholarly scrutiny.

Category:Law of Italy