Italy, Data Protection, International Corporate Rules

Law n. 133 passed on Aug. 6, 2008 amends the Italian Data Protection Code and allow conglomerates and multi-national companies to freely exchange personal data, provided that their internal corporate rules system matches Italian Data Protection Regulation.

This is a way to circumvent the strict limits imposed by former regulation, that forbade the exchange of personal data with countries (like United States of America) with a lower level of personal data legal protection.

The piratebay case. A dangerous decision

The Court of Bergamo (IT) issued an order of preemptive seizure against piratebay.org, a swedish website accused of copyright contributory infringement, by running a torrent search engine.

The Court affirmed its jurisdiction even if there were no evidence of an actual involvement of Italian citizens, by not excluding, in theory, this possibility. If confirmed, this decision might disrupt the legal notion of jurisdiction, allowing every State to shut down ? “disturbing” websites hosted in different countries.

Towards an Italian National DNA Database

Italy started the legal process to establish a National DNA Database.

A draft law proposed by Goverment (and not yet approved by the Parliament) establish the power for Law Enforcement officer to obtain DNA samples with moderate use of force, inflicting a minimum pain.This provision is said to be necessary in case the suspect refuses to volounteerly provide the sample.

It is still unclear which structure the DNA database will assume, but is seems that both DNA samples and profiles will be collected and stored in a central facility.

Data Retention in Italy. The state of the art

This table summarizes the new Italian Data Retention Regulation.

Data Retention timeframe
(italian version taken from Interlex)

Data and Retention scope Retention Duration Provision
Traffic-related data not included in Sect. 123 para I and II Data protection code Anonnymized or deleted when no more necessary Sect. 123, Para I
Traffic data strictly needed for billing purposes, and/or support customer claims 6 mpnths, or more, in case of legal action Sect. 123, Para 2
Traffic data for marketing purposes, or Value Added Serice purposes As needed, only if the customer opted-in Sect. 132, Para 3
Traffic data (voice) for criminal investigation purposes 24 months Sect. 132, Para 1
Traffic data (digital) for criminal investigation 12 months Sect. 132, Para 1
Unanswered call-related data 30 days Sect. 132, Para 1-bis
Network related Traffic Data – upon concerned authorities order, for preemptive investigation and/or prosecute specific crimes – From 90 Days, up to six months Art. 132, c. 1-quater