As previously announced, the Italian Law of 22nd December 2011, No 214 on “Conversion, with amendments, of Decree Law of 6th December 2011, No 201 “(also known as the Monti Economic Measures ) was published in the Ordinary Supplement No 276 of Official Gazette No. 300 of December 27th, 2011.
The law, which came into force on the 28th of December, 2011, introduces the forecasted revolution of the Italian Privacy Code.
It should be noted that the conversion law has not led to further changes to the Privacy Code except for those already contained in the Decree Law of 6th December 2011.
In order to simplify compliance regarding privacy, the changes have effectively eliminated the right to protection of personal data for private and public bodies in Italy.
The following are the details of the changes to the regulations on personal data protection.
In Art. 4, paragraph 1, lett. b) of the Civil Code the notion of “personal data” is drastically reduced. All reference to private and public bodies or associations has disappeared from the definition and it has also been excluded from the category of “interested party”, referred to in subparagraph i).
In other words, only information relating to natural persons is now protected and only natural persons can exercise their rights under Art. 7, such as, for example, the right to find out the source of their personal data, to request their being updated, their rectification, their cancellation or to oppose their processing for commercial or advertising purposes.
In line with the rationale of these changes, the Monti measures also delete the last sentence of Art. 9, paragraph 4, of the Privacy Code, which set out the details of how to identify the natural person entitled to exercise the above rights on behalf of private bodies, public bodies or associations
Paragraph 3 bis of art. 5, has also been deleted even though it was only introduced a few months ago by the so-called “Development Decree” and which excluded from the application of the privacy Code the processing of data carried out by companies, organizations or associations for administrative and accounting purposes.
Letter h) of Art. 43 concerning the transfer of data of legal persons abroad has also been deleted.
In any case, the significant innovations provided for by Law 214 of 2011 do not affect obligations which companies processing personal data relating to individuals must comply with.
It is likely that this “liberalization” of the use of company data will benefit advertising activities targeted at companies and a clarifying comment by the Authority for the protection of personal data on this matter is not to be excluded.
Among the various provisions of the Monti government’s new economic measures (Law Decree no.201 of December 6, 2011) published in Official Gazette no. 284 of December 6, 2011, we find the introduction of a radical change to the Italian Privacy Code (Legislative Decree 196 of June 30, 2003).
In order to reduce the administrative burden on companies, by amending Article 4, paragraph 1, letter b) of the Privacy Code, Art.40, paragraph 2 excludes from the definition of personal data all information relating to private and public bodies or associations.
As a result of this exclusion the measures also include an amendment to Art. 4, paragraph 1, letter i) which defines who should be considered “an interested party” by the treatment of the data, namely the individual to whom the personal data refers. Whereas previously private and public bodies or associations could be “interested parties”, only natural persons are considered as “interested parties” with the current amendment.
Therefore this revolutionary provision limits the privacy protection of private and public bodies whose data can now be processed without having to obtain permission and restricts the right to data protection only to natural persons.
Alongside these significant changes, Monti’s measure also deletes the last sentence of Art. 9, paragraph 4 of the privacy Code, which detailed how to identify the natural person entitled to exercise rights on behalf of private bodies, public bodies or associations, paragraph 3-bis of art. 5, which excluded from the application of the Privacy Code the processing of data regarding public and private bodies and associations in communications between said bodies for administration and accountancy purposes, and finally also letter h) of paragraph 1 of article. 43 concerning the processing of data of private bodies, public bodies or associations when transferred abroad.