Sfermusic Competitions

Privacy Code
(Legislative Decree 196/2003)

Part III

Protection of the data subject and sanctions

Title I

Administrative and judicial protection

CHAPTER 0.I (1)

Alternative forms of protection

(1) Title inserted by Article 13, paragraph 1, letter a), Legislative Decree no. 101 of 10 August 2018.

Article 140-bisAlternative forms of protection (1)

1. If the data subject believes that the rights he or she enjoys on the basis of the legislation on the protection of personal data have been violated, he or she may lodge a complaint with the Guarantor or appeal before the judicial authority.

2. A complaint may not be lodged with the Garante if, for the same subject matter and between the same parties, the matter has already been referred to the judicial authority.

3. The submission of the complaint to the Garante makes it impossible to make a further request before the judicial authority between the same parties and for the same subject-matter, without prejudice to the provisions of Article 10, paragraph 4, of Legislative Decree No. 150 of 1 September 2011.

(1) Article inserted by Article 13, paragraph 1, letter a), Legislative Decree No. 101 of 10 August 2018, which inserted the entire Chapter 0.I.

Chapter I (1)

Protection before the guarantor

(1) This Chapter is no longer divided into sections following the amendments provided for by art. 13, paragraph 1, letters b) and d), and 27, paragraph 1, letter c), no. 1), Legislative Decree no. 101 of 10 August 2018.

Originally, this Chapter included:

Section I - General principles (art. 141)

Section II - Administrative protection (Articles 142 to 144).

Section III – Alternative protection to judicial protection (Articles 145 to 151).

Art. 141
Complaint to the Guarantor

1. The data subject may contact the Garante by means of a complaint pursuant to Article 77 of the Regulation.

(1) Article replaced by Article 13, paragraph 1, letter c), Legislative Decree no. 101 of 10 August 2018.

Art. 142Submission of a complaint (1)

1. The complaint shall contain as detailed an indication as possible of the facts and circumstances on which it is based, the provisions alleged to have been infringed and the measures requested, as well as the identification details of the controller or processor, where known.

2. The complaint shall be signed by the data subject or, on behalf of the latter, by a third sector entity subject to the discipline of Legislative Decree no. 117 of 3 July 2017, which is active in the field of protection of the rights and freedoms of data subjects, with regard to the protection of personal data.

3. The complaint shall contain as an attachment the documentation useful for the purposes of its assessment and any mandate, and shall indicate an address for sending communications also by e-mail, fax or telephone.

4. The Garante shall prepare a form for the complaint, to be published on its institutional website, which it shall facilitate the availability of by electronic means.

5. The Garante shall regulate the procedure for examining complaints by means of its own regulations, as well as simplified procedures and shortened deadlines for dealing with complaints concerning the violation of Articles 15 to 22 of the Regulation.

(1) Article replaced by Article 13, paragraph 1, letter e), Legislative Decree No. 101 of 10 August 2018.

Art. 143
Decision of the complaint (1)

1. Once the preliminary investigation has been completed, if the complaint is not manifestly unfounded and the conditions for adopting a measure are met, the Guarantor, even before the conclusion of the procedure, may adopt the measures referred to in Article 58 of the Regulation in compliance with the provisions of Article 56 of the Regulation.

2. The measures referred to in paragraph 1 shall be published in the Official Gazette of the Italian Republic if the addressees of the measures are not easily identifiable by the number or complexity of the investigations.

3. The Garante shall decide on the complaint within nine months from the date of submission and, in any case, within three months from the aforementioned date, shall inform the data subject of the status of the proceedings. In the presence of justified investigative needs, which the Garante communicates to the data subject, the complaint is decided within twelve months. In the event of activation of the cooperation procedure referred to in Article 60 of the Regulation, the deadline remains suspended for the duration of the aforementioned procedure.

4. A judicial appeal may be lodged against the decision in accordance with Article 152.

(1) Article replaced by Article 13, paragraph 1, letter f), Legislative Decree No. 101 of 10 August 2018.

Art. 144
Reports (1)

1. Anyone can submit a report that the Garante may also assess for the purposes of issuing the measures referred to in Article 58 of the Regulation.

2. The measures of the Garante referred to in Article 58 of the Regulation may also be adopted ex officio.

(1) Article replaced by Article 13, paragraph 1, letter g), Legislative Decree No. 101 of 10 August 2018.

Art. 144-bisRevenge porn (1)

1. Any person, including minors over the age of fourteen, who has reasonable grounds to believe that audio recordings, images or videos or other computer documents with sexually explicit content concerning him/her, intended to remain private, may be sent, delivered, transferred, published or disseminated through digital platforms without his/her consent shall have the right to report the danger to the Garante, who, within forty-eight hours of receipt of the report, shall decide in accordance with Articles 143 and 144 of this Code.

2. When audio recordings, images or videos or other electronic documents concern minors, the report to the Garante may also be made by the parents or by those exercising parental responsibility or guardianship.

3. For the purposes referred to in paragraph 1, the sending to the Garante of audio recordings, images or videos or other computer documents with sexually explicit content concerning third parties, carried out by the data subject, does not constitute the offence referred to in Article 612-ter of the Criminal Code.

4. The operators of the digital platforms to which the measures referred to in paragraph 1 are addressed shall keep the material subject to the report, for evidentiary purposes only and with measures indicated by the Garante, also in the context of the same measures, suitable for preventing the direct identification of the data subjects, for twelve months from receipt of the measure itself.

5. The Garante, by means of its own provision, may regulate specific procedures for carrying out the procedures referred to in paragraph 1 and the measures to prevent the direct identification of the data subjects referred to in the same paragraph.

6. Providers of audiovisual content sharing services, wherever established, which provide services accessible in Italy, shall indicate without delay to the Garante or publish on their website an address to which the measures adopted pursuant to paragraph 1 may be communicated. In the event of non-compliance with the obligation referred to in the previous sentence, the Guarantor shall warn the service provider to comply within thirty days. In the event of non-compliance with the warning, the administrative fine referred to in Article 83, paragraph 4, of the Regulation shall be applied. Evaluaciones (2)

7. When, following the report referred to in paragraph 1, the Garante acquires notice of the commission of the offence referred to in Article 612-ter of the Criminal Code, even in attempted form, in the event of ex officio prosecution, it shall transmit to the public prosecutor the report received and the documentation acquired.

(1) Article inserted by Article 9, paragraph 1, letter g), Legislative Decree No. 139 of 8 October 2021, converted, with amendments, by Law No. 205 of 3 December 2021. 2) On the obligation provided for in this paragraph, see art. 9, paragraph 6, Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

Art. 145Appeals (1)

[1. The rights referred to in Article 7 may be asserted before the judicial authority or by appeal to the Garante.

2. An appeal to the Garante may not be lodged if, for the same subject matter and between the same parties, the matter has already been brought before the judicial authority.

3. The submission of the appeal to the Garante makes it impossible to make a further application before the judicial authority between the same parties and for the same subject.]

(1) Article repealed by Article 27, paragraph 1, letter c), no. 1), Legislative Decree no. 101 of 10 August 2018, which repealed the entire Section III of which this article was part. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Art. 146Preliminary ruling (1)

[1. Except in cases in which the expiry of the time limit would expose someone to imminent and irreparable damage, an appeal to the Garante may be lodged only after a request has been made on the same subject matter to the data controller or processor pursuant to Article 8, paragraph 1, and the time limits provided for in this article have expired, or the request has been refused, even partially.

2. Acknowledgement of the request by the data controller or processor shall be provided within fifteen days of its receipt.

3. Within the time limit referred to in paragraph 2, if the operations necessary for a full response to the request are of particular complexity, or if there is another justified reason, the data controller or the data processor shall notify the data subject. In this case, the deadline for full response is thirty days from receipt of the request itself.]

See Gianluca Bozzelli, Access to personal data in the bank: communication within 15 days!, Cass. civil, sec. I, judgment no. 18555 of 2 August 2013.

Art. 147Lodging of an appeal (1)

[1. The appeal shall be brought against the holder and shall indicate:

a) the identification details of the applicant, of any special proxy, of the data controller and, where known, of any person in charge designated to respond to the data subject in the event of the exercise of the rights referred to in Article 7;

b) the date of the request submitted to the data controller or processor pursuant to Article 8, paragraph 1, or of the imminent and irreparable damage that allows the request to be dispensed with;

c) the elements on which the claim is based;

d) the measure requested from the Guarantor;

e) the address elected for the purposes of the proceedings.

2. The application shall be signed by the applicant or by the special prosecutor and shall include:

a) a copy of the request addressed to the data controller or processor pursuant to Article 8, paragraph 1;

b) any power of attorney;

c) proof of payment of secretarial fees.

3. The appeal shall also be accompanied by the documentation useful for the purposes of its assessment and the indication of an address for sending communications to the applicant or to the special prosecutor by e-mail, fax or telephone.

4. The appeal shall be addressed to the Garante and its signature shall be authenticated. Authentication is not required if the signature is affixed to the Office of the Guarantor or by a special attorney registered in the register of lawyers to whom the power of attorney is conferred pursuant to Article 83 of the Code of Civil Procedure, or with a digital signature in accordance with current legislation.

5. An appeal shall be validly lodged only if it is sent by registered post or electronically in accordance with the procedures for signing with a digital signature and acknowledging receipt prescribed pursuant to Article 38(2), or submitted directly to the Office of the Guarantor.]

Art. 148 Inadmissibility of the appeal (1)

[1. The appeal is inadmissible:

a) if it comes from a person who is not legitimate;

b) in the event of non-compliance with the provisions of Articles 145 and 146;

c) if it lacks any of the elements indicated in Article 147, paragraphs 1 and 2, unless it is regularised by the applicant or by the special prosecutor also at the invitation of the Office of the Guarantor pursuant to paragraph 2, within seven days from the date of its submission or receipt of the invitation. In such a case, the appeal shall be deemed to have been lodged when the regularised appeal is received by the Office.

2. The Garante shall determine the cases in which it is possible to regularise the appeal.]

Art. 149Procedure relating to appeals (1)

[1. Except in cases where the appeal is declared inadmissible or manifestly unfounded, the Data Controller shall be notified to the Data Controller within three days by the Office of the Guarantor, with an invitation to exercise within ten days of its receipt the right to notify the applicant and the Office of any spontaneous adhesion. The invitation shall be communicated to the data controller through the data processor, if any, designated to respond to the data subject in the event of the exercise of the rights referred to in Article 7, where indicated in the appeal.

2. In the event of spontaneous adhesion, there is no need to take action. If the claimant so requests, the amount of the costs and fees relating to the appeal, charged to the opposing party or offset for just reasons, even partially, is determined on a flat-rate basis.

3. In proceedings before the Garante, the controller, the processor referred to in paragraph 1 and the data subject shall have the right to be heard, either personally or through a special proxy, and shall have the right to submit briefs or documents. To this end, the invitation referred to in paragraph 1 shall also be sent to the applicant and shall indicate the deadline within which the data controller, the person in charge and the person concerned may submit pleadings and documents, as well as the date on which such persons may be heard in cross-examination, including by means of suitable audiovisual techniques.

4. In the proceedings, the claimant may specify the claim within the limits of what is requested in the appeal or following objections formulated by the holder.

5. The Garante may order, even ex officio, the performance of one or more appraisals. The decision ordering them shall specify the content of the assignment and the deadline for its execution, and shall be communicated to the parties, who may attend the operations in person or through designated attorneys or consultants. The measure also provides for the advance of the costs of the appraisal.

6. In the proceedings, the controller and the processor referred to in paragraph 1 may be assisted by an attorney or other trusted person.

7. If the investigations are particularly complex or if the parties agree, the sixty-day period referred to in Article 150(2) may be extended for a period not exceeding a further forty days.

8. The running of the time limits provided for in Article 150(2) and Article 151 shall be suspended by operation of law from 1 August to 15 September of each year and shall resume from the end of the period of suspension. If the course begins during that period, the start itself is deferred to the end of that period. The suspension shall not apply in cases where the prejudice referred to in Article 146, paragraph 1, exists, and does not preclude the adoption of the measures referred to in Article 150, paragraph 1.]

Art. 150Measures following the appeal (1)

[1. If the particularity of the case so requires, the Garante may provisionally order the blocking of all or part of any of the data, or the immediate suspension of one or more processing operations. The measure may be adopted even before the notification of the appeal pursuant to Article 149, paragraph 1, and shall cease to have any effect if the decision referred to in paragraph 2 is not adopted within the time limit. The same measure may be appealed together with that decision.

2. Once the necessary information has been obtained, the Garante, if it considers the appeal to be well founded, shall order the controller, by reasoned decision, to cease the unlawful conduct, indicating the measures necessary to protect the rights of the data subject and assigning a deadline for their adoption. Failure to rule on the appeal, after sixty days from the date of submission, is equivalent to rejection.

3. If there has been a prior request by one of the parties, the decision closing the proceedings shall determine the amount of the costs and fees relating to the action, which are to be borne by the unsuccessful party, even in part, or offset, even in part, for just reasons.

4. The express measure, including provisional measure, adopted by the Garante shall be communicated to the parties within ten days at the address for service or recorded in the documents. The decision may also be communicated to the parties by e-mail or fax.

5. If difficulties or disputes arise with regard to the implementation of the measure referred to in paragraphs 1 and 2, the Garante, after hearing the parties where requested, shall arrange for the implementation procedures using, if necessary, the staff of the Office or the collaboration of other State bodies.

6. In the event of failure to oppose the measure determining the amount of costs and fees, or if it is rejected, the measure shall constitute an enforceable title for that part pursuant to Articles 474 and 475 of the Code of Civil Procedure.]

Art. 151Opposition (1)

[1. The data controller or the interested party may lodge an objection against the express decision or tacit rejection referred to in Article 150(2) by means of an appeal pursuant to Article 152. The opposition does not suspend the execution of the measure.

2. The court shall act in accordance with the procedures laid down in Article 152.]

Chapter II

Judicial protection

Art. 152.
Ordinary judicial authorities (1)

1. All disputes concerning the matters subject to the judicial appeals referred to in Articles 78 and 79 of the Regulation and those concerning the application of the legislation on the protection of personal data, as well as the right to compensation for damages pursuant to Article 82 of the same Regulation, shall be assigned to the ordinary judicial authority. (2)

1-bis. The disputes referred to in paragraph 1 are governed by Article 10 of Legislative Decree No. 150 of 1 September 2011.

(1) The article that reads as follows:
"1. All disputes concerning, in any case, the application of the provisions of this Code, including those relating to the provisions of the Guarantor on the protection of personal data or their failure to adopt, shall be assigned to the ordinary judicial authority.2. For all disputes referred to in paragraph 1, the action shall be brought by means of an appeal filed with the registry of the court of the place where the data controller resides.3. The court shall in any case decide in a monocratic composition.4. If an appeal is lodged against a decision of the Garante also pursuant to Article 143, the appeal shall be lodged within thirty days from the date of communication of the measure or from the date of tacit rejection. If the appeal is lodged after this deadline, the judge declares it inadmissible by order that can be appealed to the Court of Cassation.5. The filing of the appeal does not suspend the execution of the Garante's measure. If there are serious reasons, the judge, after hearing the parties, may order otherwise, in whole or in part, by means of an order that can be appealed together with the decision defining the level of proceedings.6. When there is an imminent danger of serious and irreparable damage, the judge may issue the necessary measures by reasoned decree, setting the hearing for the parties to appear within a period not exceeding fifteen days. At this hearing, by order, the judge shall confirm, modify or revoke the measures issued by decree.7. The judge sets the hearing for the appearance of the parties by decree by which it assigns the applicant the peremptory deadline within which to notify the other parties and the Guarantor. No less than thirty days shall elapse between the day of service and the appearance hearing.8. If the applicant does not appear at the first hearing without giving any legitimate impediment, the judge orders the removal of the case from the register and declares the discontinuation of the trial, imposing the costs of the proceedings on the applicant.9. During the proceedings, the judge disposes, even ex officio, omitting any formality not necessary for the adversarial proceedings, the means of proof that he deems necessary and may order the summoning of witnesses even without the formulation of chapters.10. Once the preliminary investigation has been completed, the judge invites the parties to clarify the conclusions and to proceed, at the same hearing, to the oral discussion of the case, pronouncing immediately after the judgment by reading the operative part. The reasons for the sentence are filed with the registry within the following thirty days. The judge may also draw up and read, together with the operative part, the grounds of the judgment, which are immediately afterwards deposited at the registry.11. If necessary, the court may grant the parties a time limit not exceeding ten days for the lodging of defence notes and adjourn the case to the hearing immediately following the expiry of the time limit for discussion and delivery of the judgment.12. With the judgment, the judge, also by way of derogation from the prohibition referred to in Article 4 of Law no. 2248 of 20 March 1865, Annex E), when it is necessary also in relation to any act of the public entity owner or responsible, accepts or rejects the claim, in whole or in part, prescribes the necessary measures, orders compensation for damages, if requested, and shall charge the losing party with the costs of the proceedings.13. The sentence cannot be appealed, but an appeal to the Court of Cassation is allowed.14. The provisions of this article shall also apply in the cases provided for in Article 10, paragraph 5, of Law No. 121 of 1 April 1981, as amended." was amended by art. 34, Legislative Decree no. 150 of 1 September 2011. (2) Most recently, this paragraph has been replaced by Article 13, paragraph 1, letter h), Legislative Decree no. 101 of 10 August 2018.

TITLE II

Independent supervisory authority (1)

(1) Heading replaced by Article 14, paragraph 1, letter a), Legislative Decree no. 101 of 10 August 2018. Previously, the heading was as follows: 'Authority'.

Chapter I

The Guarantor for the protection of personal data

Art. 153Guarantor for the protection of personal data (1)

1. The Guarantor is composed of the Board, which constitutes its top, and the Office. The College is made up of four members, two elected by the Chamber of Deputies and two by the Senate of the Republic with limited votes. The members must be elected from among those who submit their candidacy as part of a selection procedure, the notice of which must be published on the websites of the Chamber of Deputies, the Senate and the Guarantor at least sixty days before the appointment. Applications must be received at least thirty days before the appointment and CVs must be published on the same websites. Applications can be made by persons who ensure independence and who have proven experience in the field of personal data protection, with particular reference to legal or IT disciplines.

2. The members shall elect a president from among their members, whose vote shall prevail in the event of a tie. They also elect a vice president, who assumes the functions of the president in the event of his absence or impediment.

3. The term of office of chairman and member shall have a seven-year term and shall not be renewable. For the entire duration of the office, the president and the members may not exercise, under penalty of forfeiture, any professional or consultancy activity, even if unpaid, nor be directors or employees of public or private bodies, nor hold elected offices.

4. The members of the Board of Statutory Auditors shall maintain secrecy, both during and after the termination of their office, with regard to confidential information to which they have had access in the performance of their duties or in the exercise of their powers.

5. Upon acceptance of the appointment, the President and the members shall be placed out of office if they are employees of public administrations or magistrates in active service; if tenured university professors, they are placed on leave without allowances pursuant to Article 13 of Presidential Decree No. 382 of 11 July 1980. Staff placed out of tenure or on leave cannot be replaced.

6. The President and the members shall be entitled to an allowance equal to the remuneration enjoyed by the First President of the Court of Cassation, within the limits provided for by law for the all-inclusive annual remuneration of anyone who receives emoluments or salaries from the public purse in the context of employment or self-employment relationships with public administrations of the State. The function allowance referred to in the first sentence is to be considered all-inclusive with the exception of the reimbursement of expenses actually incurred and documented on the occasion of institutional activities. (2)

7. The Office referred to in Article 155 shall be placed under the authority of the Guarantor.

8. The Chairman, the members, the Secretary General and the employees shall refrain from dealing with proceedings before the Garante for two years after the termination of their office or service with the Garante, including the submission of complaints, requests for opinions or rulings on behalf of third parties.

(1) Article replaced by Article 14, paragraph 1, letter b), Legislative Decree no. 101 of 10 August 2018. (2) Paragraph as amended by art. 9, paragraph 1, letter h), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

Art. 154Tasks (1)

1. In addition to the provisions of specific provisions and Section II of Chapter VI of the Regulation, the Garante, pursuant to Article 57, paragraph 1, letter v) of the same Regulation, also on its own initiative and with the help of the Office, in accordance with the regulations in force and with regard to one or more data controllers, has the task of:

a) check whether the processing is carried out in compliance with the applicable regulations, even in the event of its cessation and with reference to the retention of traffic data;

b) deal with complaints submitted pursuant to the regulation and the provisions of this code, also by identifying specific procedures for dealing with them in its own regulations, as well as by setting annual priorities for issues arising from complaints that may be investigated during the reference year;

c) promote the adoption of deontological rules, in the cases referred to in Article 2-quarter;

d) report the facts that can be configured as offences that can be prosecuted ex officio, of which he becomes aware in the exercise or because of his duties;

e) transmit the report, prepared annually pursuant to Rule 59 of the Rules of Procedure, to Parliament and the Government by 31 May of the year following the year to which it refers;

f) to ensure the protection of the fundamental rights and freedoms of individuals by suitably implementing the Regulation and this Code;

g) also carry out the tasks assigned to it by European Union or State law and perform the additional functions provided for by the law.

2. Pursuant to paragraph 1, the Garante shall also carry out the function of monitoring or assisting in the processing of personal data provided for by laws ratifying international agreements or conventions or by Community or European Union acts and, in particular:

(a) Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) and Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II);

(b) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA;

(c) Regulation (EU) 2015/1525 of the European Parliament and of the Council of 9 September 2015 amending Council Regulation (EC) No 515/97 on mutual assistance between the administrative authorities of the Member States and cooperation between them and the Commission to ensure the correct application of customs and agricultural legislation and Council Decision 2009/917/JHA, of 30 November 2009 on the use of information technology in the customs field;

(d) Regulation (EC) No 603/2013 of the European Parliament and of the Council of 26 June 2013 establishing Eurodac for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and for applications for comparison with Eurodac data submitted by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice;

(e) Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 on the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) and Council Decision 2008/633/JHA of 23 June 2008 on access for consultation of the Visa Information System (VIS) by the designated authorities of the Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and other serious criminal offences;

(f) Regulation (EC) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (IMI Regulation) Text with EEA relevance;

(g) the provisions of Chapter IV of Convention No 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted in Strasbourg on 28 January 1981 and enforced by Law No 98 of 21 February 1989, as the authority designated for the purposes of cooperation between States pursuant to Article 13 of the same Convention.

3. For matters not provided for in the Regulation and in this Code, the Garante shall govern by means of its own Regulations, pursuant to Article 156, paragraph 3, the specific procedures for the procedures relating to the exercise of the tasks and powers attributed to it by the Regulation and by this Code.

4. The Garante shall cooperate with other independent national administrative authorities in the performance of their respective tasks.

5. Without prejudice to the shorter time limits provided for by law, the opinion of the Garante, including in the cases referred to in Articles 36, paragraph 4, of the Regulation, shall be delivered within forty-five days of receipt of the request. After the deadline, the administration may proceed regardless of whether the opinion has been obtained. When, for investigative reasons, the deadline referred to in this paragraph cannot be respected, this deadline may be interrupted only once and the opinion must be rendered definitively within twenty days of receipt of the investigative elements by the administrations concerned.

5-bis. The opinion referred to in Article 36, paragraph 4, of the Regulation is given by the Garante only in cases where the law or regulation being adopted expressly regulates the methods of processing by describing one or more operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as well as in cases where the law or regulation expressly authorises the processing of personal data by private parties without refer the regulation of the methods of processing to subordinate sources. Evaluaciones (2)

5-ter. When the President of the Council of Ministers declares that reasons of urgency do not allow prior consultation and in any case in cases of adoption of decree-laws, the Garante shall express the opinion referred to in paragraph 5-bis:

a) during parliamentary examination of bills or bills converting decree-laws;

b) during the final examination of the draft legislative decrees submitted to the Parliamentary Committees for their opinion. Evaluaciones (2)

6. A copy of the measures issued by the judicial authority in relation to the provisions of this Code or in the field of computer crime shall be sent by the Registry to the Guarantor.

7. The Garante shall not be competent to supervise the processing operations carried out by the judicial authorities in the performance of their functions.

(1) Article amended by Article 4, paragraph 1, Legislative Decree No. 109 of 30 May 2008 and, subsequently, replaced by Article 14, paragraph 1, letter c), Legislative Decree No. 101 of 10 August 2018. (2) Paragraph inserted by art. 9, paragraph 1, letter i), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

Article 154-bisPowers (1)

1. In addition to the provisions of specific provisions, Section II of Chapter VI of the Regulation and this Code, pursuant to Article 58, paragraph 6, of the Regulation, the Garante has the power to:

a) adopt guidelines regarding the organisational and technical measures for implementing the principles of the Regulation, including for individual sectors and in application of the principles referred to in Article 25 of the Regulation;

b) approve the rules of ethics referred to in Article 2-quarter.

2. The Garante may invite representatives of another national independent administrative authority to participate in its meetings, or be invited to the meetings of another national independent administrative authority, taking part in the discussion of topics of common interest; it may also require the collaboration of specialised staff assigned to another independent national administrative authority.

3. The Garante shall publish its measures on the basis of the provisions of a general act which also regulates the duration of such publication, publicity in the Official Gazette of the Italian Republic and on its institutional website as well as cases of blackout.

4. In consideration of the simplification needs of micro, small and medium-sized enterprises, as defined by Recommendation 2003/361/EC, the Guarantor for the protection of personal data, in compliance with the provisions of the Regulation and this Code, promotes, in the guidelines adopted pursuant to paragraph 1, letter a), simplified procedures for fulfilling the obligations of the data controller.

(1) Article inserted by Article 14, paragraph 1, letter d), Legislative Decree no. 101 of 10 August 2018.

Article 154-terPower of action and representation in court (1)

1. The Garante is entitled to take legal action against the data controller or processor in the event of a breach of the provisions on the protection of personal data.

2. The Guarantor shall be represented in court by the State Attorney's Office, pursuant to Article 1 of Royal Decree No 1611 of 30 October 1933.

3. In cases of conflict of interest, the Guarantor, after consulting the State Advocate General, may be a party to the proceedings through its officials registered in the special list of lawyers employed by public bodies or lawyers of the free forum.

(1) Article inserted by Article 14, paragraph 1, letter d), Legislative Decree no. 101 of 10 August 2018.

Chapter II

The office of the guarantor

Art. 155
Office of the Guarantor (1)

1. In order to guarantee responsibility and autonomy pursuant to Law No. 241 of 7 August 1990, as amended, and Legislative Decree No. 165 of 30 March 2001, as amended, the Guarantor's Office shall be governed by the principles concerning the identification and functions of the person in charge of the procedure, as well as those relating to the distinction between the functions of guidance and control, attributed to the top management bodies, and the management functions attributed to the managers. The provisions of the same Legislative Decree no. 165 of 2001 expressly referred to in this code shall also apply.

(1) Heading replaced by Article 14, paragraph 1, letter e), Legislative Decree No. 101 of 10 August 2018.

Art. 156
Organic and personnel role (1)

1. The Office of the Guarantor is headed by a Secretary General, appointed from among persons of high and proven professional qualification with respect to the role and objectives to be achieved, also chosen from among ordinary, administrative and accounting magistrates, State lawyers, tenured university professors in legal and economic matters, as well as first-tier managers of the State.

2. As of 1 January 2022, the staff list of employees shall be set at a limit of two hundred units. The organic role of the Guarantor is accessed exclusively through a public competition. In cases where it is deemed useful in order to ensure the cost-effectiveness and efficiency of administrative action, as well as to encourage the recruitment of staff with greater experience in the context of the competition procedures referred to in the second sentence, the Garante may reserve a quota not exceeding fifty per cent of the posts advertised for tenured staff of public administrations who have been hired through a public competition and have gained at least three years' experience in the respective organic role. The provision of Article 30 of Legislative Decree No. 165 of 30 March 2001 applies exclusively to the permanent staff of the independent administrative authorities referred to in Article 22, paragraph 1, of Decree-Law No. 90 of 24 June 2014, converted, with amendments, by Law No. 114 of 11 August 2014. Evaluaciones (2)

3. By means of its regulations published in the Official Gazette of the Italian Republic, the Garante shall define:a) the organisation and functioning of the Office, including for the purpose of carrying out the tasks and exercising the powers referred to in Articles 154, 154-bis, 160, and Article 57(1) of the Regulation; b) the organisation of careers and the methods of recruitment of personnel according to the principles and procedures referred to in Articles 1, 35 and 36 of Legislative Decree No. 165 of 2001; c) the distribution of the workforce between the different areas and qualifications; d) the legal and economic treatment of personnel, according to the criteria provided for by Law no. 249 of 31 July 1997, and, for managerial positions, by articles 19, paragraph 6, and 23-bis of Legislative Decree no. 165 of 30 March 2001, taking into account the specific functional and organisational needs. Pending the more general rationalisation of the remuneration of independent administrative authorities, the staff shall be assigned the remuneration of the staff of the Communications Authority; (3)e) administrative management and accounting, also in derogation from the rules on general accounting of the State.

4. The Office may avail itself, for justified needs, of employees of the State or of other public administrations or public bodies placed in a position of non-tenure or equivalent in the forms provided for by their respective legal systems, or on leave pursuant to Article 13 of Presidential Decree No. 382 of 11 July 1980, in a total number not exceeding thirty units and for no more than twenty per cent of the managerial qualifications, leaving a corresponding number of tenured positions unfilled. Evaluaciones (4)

5. In addition to the permanent staff, the Office may recruit employees with fixed-term contracts or make use of consultants appointed pursuant to Article 7, paragraph 6, of Legislative Decree no. 165 of 2001, to an extent not exceeding thirty units in total. In any case, compliance with Article 36 of Legislative Decree No. 165 of 2001 remains unchanged for fixed-term contracts. Evaluaciones (5)

6. The staff assigned to the Office of the Garante and the consultants are bound, both during and after the mandate, to secrecy as to what they have become aware of, in the performance of their duties, with regard to information that must remain secret.

7. The staff of the Office of the Garante responsible for the investigations referred to in Articles 158 and 57(1)(h), 58(1)(b) and 62 of the Regulation shall, within the limits of the service to which they are assigned and in accordance with their respective duties, have the status of officers or agents of the judicial police.

8. The operating expenses of the Garante, in compliance with Article 52, paragraph 4, of the Regulation, including those necessary to ensure its participation in the cooperation procedures and the coherence mechanism introduced by the Regulation, as well as those related to the human, technical and financial resources, premises and infrastructures necessary for the effective performance of its tasks and the exercise of its powers, they are charged to a fund allocated for this purpose in the State budget and entered in a specific mission and expenditure programme of the Ministry of Economy and Finance. The financial management report is subject to audit by the Court of Auditors. The Garante may require the data controller to pay secretarial fees in relation to particular procedures.

(1) Article replaced by Article 14, paragraph 1, letter f), Legislative Decree No. 101 of 10 August 2018. (2) Paragraph as amended by art. 9, paragraph 1, letter l), no. 1), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021. 3) Letter as amended by art. 9, paragraph 1, letter l), no. 2), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021. 4) Paragraph as amended by art. 9, paragraph 1, letter l), no. 3), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021. 5) Paragraph as amended by art. 9, paragraph 1, letter l), no. 4), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

Chapter III

Checks and controls

Art. 157
Request for information and production of documents (1)

1. Within the scope of the powers referred to in Article 58 of the Regulation, and in order to carry out its duties, the Garante may request the data controller, the data processor, the representative of the data controller or processor, the data subject or even third parties to provide information and to produce documents also with reference to the content of databases.

(1) Article replaced by Article 14, paragraph 1, letter g), Legislative Decree No. 101 of 10 August 2018.

Art. 158
Investigations (1)

1. The Garante may order access to databases, archives or other inspections and checks in the places where the processing takes place or in which it is necessary to carry out surveys that are in any case useful for monitoring compliance with the regulations on the processing of personal data.

2. The checks referred to in paragraph 1, as well as those carried out pursuant to Article 62 of the Regulation, shall be carried out by staff of the Office, with the participation, where appropriate, of members or staff of supervisory authorities of other Member States of the European Union.

3. The Garante shall also avail itself, where necessary, of the collaboration of other State bodies for the performance of its institutional duties.

4. The inspections referred to in paragraphs 1 and 2, if carried out in a home or other place of private residence or in the relevant belongings, shall be carried out with the informed consent of the owner or the person in charge, or with the authorisation of the president of the court with territorial jurisdiction in relation to the place of the inspection, who shall act by reasoned decree without delay, at the latest within three days of receipt of the Authority's request when the non-deferrability of the assessment is documented.

5. With the guarantees referred to in paragraph 4, the inspections carried out in the places referred to in the same paragraph may also concern communication networks accessible to the public, since data and information can be acquired online. To this end, a special report is drawn up in consultation with the parties if the assessment is carried out at the data controller.

(1) Article replaced by Article 14, paragraph 1, letter h), Legislative Decree No. 101 of 10 August 2018.

Art. 159
Procedures

1. The operating personnel, in possession of an identification document, may be assisted where necessary by consultants who are bound to secrecy on what they have become aware of, in the exercise of their duties, with regard to information that must remain secret. In carrying out surveys and technical operations, it may also extract a copy of each deed, data and document, even on a sample basis and on computer support or electronically. A summary report of the investigations is drawn up in which any statements of those present are also noted. Evaluaciones (1)

2. The persons on whose the investigations are carried out shall be given a copy of the authorisation of the President of the Court, if issued. The same subjects are required to have them carried out and to provide the necessary collaboration for this purpose. In the event of refusal, the investigations are in any case carried out and the costs incurred in this case are charged to the holder with the measure that defines the proceedings, which for this part constitutes an enforceable title pursuant to Articles 474 and 475 of the Code of Civil Procedure.

3. Investigations, if carried out at the premises of the controller or processor or the representative of the controller or processor, shall be carried out by informing the latter or, if the latter is absent or not designated, the persons authorised to process personal data under the direct authority of the controller or processor pursuant to Article 2-quaterdecies. The checks may be attended by persons indicated by the owner or the manager. (2)

4. Unless otherwise provided for in the decree authorising the President of the Court, the investigation may not be commenced before seven o'clock and after twenty o'clock, and may also be carried out with notice when this may facilitate its execution.

5. The information, requests and measures referred to in this article and in articles 157 and 158 may also be transmitted by e-mail. (3)

6. Where indications of a criminal offence emerge, the provision of Article 220 of the Implementation, Coordination and Transitional Rules of the Code of Criminal Procedure, approved by Legislative Decree No 271 of 28 July 1989, shall be observed.

(1) Paragraph as amended by Article 14, paragraph 1, letter i), no. 1), Legislative Decree no. 101 of 10 August 2018. (2) Paragraph as amended by Article 14, paragraph 1, letter i), no. 2), Legislative Decree no. 101 of 10 August 2018. (3) Paragraph as amended by Article 14, paragraph 1, letter i), no. 3), Legislative Decree no. 101 of 10 August 2018.

Art. 160
Special investigations (1)

1. For the processing of personal data referred to in Article 58, the investigations shall be carried out through a member designated by the Garante.

2. If the processing does not comply with the provisions of the Regulation or with the provisions of the law or the Regulation, the Garante shall inform the data controller or processor of the necessary amendments and additions and verify their implementation. If the investigation has been requested by the person concerned, the latter shall in any case be provided with feedback on the outcome of the investigation, provided that this does not prejudice actions or operations to protect public order and security or to prevent and suppress crimes or for reasons of defence or security of the State.

3. Assessments may not be delegated. When it is necessary due to the specificity of the verification, the designated member may be assisted by specialized personnel who are bound to secrecy on what they have become aware of with regard to information that must remain secret. The records and documents acquired shall be kept in such a way as to ensure their secrecy and shall be known to the President and members of the Garante and, if necessary for the performance of the functions of the body, by a limited number of Office employees identified by the Garante on the basis of criteria defined by the Regulation referred to in Article 156, paragraph 3, letter a).

4. For the investigations referred to in paragraph 3 relating to intelligence and security bodies and data covered by State secrecy, the designated member shall inspect the relevant acts and documents and report orally to the meetings of the Garante. (2)

(1) Article replaced by Article 14, paragraph 1, letter l), Legislative Decree No. 101 of 10 August 2018. (2) On the applicability of the provision of this paragraph, see Article 22, paragraph 10, Legislative Decree no. 101 of 10 August 2018.

Art. 160-bisValidity, effectiveness and usability in judicial proceedings of acts, documents and measures based on the processing of personal data that does not comply with the provisions of the law or the Regulation (1)

1. The validity, effectiveness and usability in judicial proceedings of acts, documents and measures based on the processing of personal data that does not comply with legal provisions or regulations shall remain governed by the relevant procedural provisions.

(1) Article inserted by Article 14, paragraph 1, letter m), Legislative Decree No. 101 of 10 August 2018.

Title IIIPopulent Sanctions Chapter IVomancipatory Actions Art. 161
Omitted or inadequate information to the data subject (1)[1. Violation of the provisions of Article 13 shall be punished by an administrative fine of between six thousand and thirty-six thousand euros.] (1) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.Art. 162Other cases (1) (5)[1. The transfer of data in violation of the provisions of Article 16, paragraph 1, letter b), or other provisions governing the processing of personal data is punished with an administrative sanction of the payment of a sum from ten thousand euros to sixty thousand euros.2. The violation of the provision referred to in Article 84, paragraph 1, is punished with the administrative sanction of the payment of a sum from one thousand euros to six thousand euros.2-bis. In the event of processing of personal data carried out in violation of the measures indicated in Article 33 or the provisions indicated in Article 167, the sanction of payment of a sum of between ten thousand euros and one hundred and twenty thousand euros shall also be applied in administrative proceedings. In the cases referred to in Article 33, payment in a reduced amount shall be excluded. (2)2-ter. In the event of non-compliance with the provisions of prescription of necessary measures or prohibition referred to, respectively, in Article 154, paragraph 1, letters c) and d), the sanction of payment of a sum from thirty thousand euros to one hundred and eighty thousand euros shall also be applied in administrative proceedings, in any case. (3)2-quarter. Violation of the right to object in the forms provided for in Article 130, paragraph 3-bis, and the related regulation shall be sanctioned pursuant to paragraph 2-bis of this article. (4)] (1) The article which reads as follows: "1. The transfer of data in violation of the provisions of Article 16, paragraph 1, letter b), or other provisions governing the processing of personal data is punished with an administrative sanction of the payment of a sum ranging from five thousand euros to thirty thousand euros.2 The violation of the provision referred to in Article 84, paragraph 1, is punished with the administrative sanction of the payment of a sum from five hundred euros to three thousand euros." was thus amended by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (2) Paragraph added by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009 and subsequently amended by art. 20-bis, Legislative Decree no. 135 of 25 September 2009, converted into Law no. 166 of 20 November 2009. (3) Paragraph added by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (4) Paragraph added by art. 20-bis, Legislative Decree no. 135 of 25 September 2009, converted into Law no. 166 of 20 November 2009. (5) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Article 162-bisPenalties for the retention of traffic data (1) (2)[1. Unless the act constitutes a criminal offence and without prejudice to the provisions of Article 5, paragraph 2, of the Legislative Decree transposing Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006, in the event of violation of the provisions of Art. 132, paragraphs 1 and 1-bis, the administrative fine from 10,000 euros to 50,000 euros is applied (1).] (1) Article added by art. 5, Legislative Decree no. 109 of 30 May 2008 and then amended by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (2) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.Article 162-ter
Penalties against providers of publicly available electronic communications services (1) (2)[1. Violation of the provisions of Article 32-bis, paragraph 1, shall be punished with an administrative sanction of payment of a sum ranging from twenty-five thousand euros to one hundred and fifty thousand euros.2. Violation of the provisions of Article 32-bis, paragraph 2, shall be punished with an administrative sanction of payment of a sum ranging from one hundred and fifty euros to one thousand euros for each contracting party or other person to whom the communication referred to in the same Article 32-bis, paragraph 2 is omitted or delayed. Article 8 of Law No. 689.3 of 24 November 1981 does not apply. The administrative penalty referred to in paragraph 2 may not be applied to an extent exceeding 5 per cent of the turnover achieved by the provider of publicly available electronic communications services in the last financial year closed prior to the notification of the complaint of the administrative violation, without prejudice to the provisions of Article 164-bis, paragraph 4.4. Violation of the provisions of Article 32-bis, paragraph 7, shall be punished with an administrative sanction of payment of a sum ranging from twenty thousand euros to one hundred and twenty thousand euros.5. The same penalties referred to in this article shall apply to the entities to which the provider of publicly available electronic communications services has entrusted the provision of the aforementioned services, if such entities have not communicated to the provider, without undue delay, pursuant to Article 32-bis, paragraph 8, the information necessary for the purposes of fulfilling the obligations referred to in Article 32-bis.] (1) Article added by art. 1, Legislative Decree no. 69 of 28 May 2012, with effect from 1 June 2012.
(2) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Art. 163Omitted or incomplete notification (1) (2)[1. Anyone who, being required to do so, fails to provide timely notification pursuant to Articles 37 and 38, or indicates incomplete information in it, shall be punished with an administrative sanction of the payment of a sum of between twenty thousand euros and one hundred and twenty thousand euros.] (1) The article that reads as follows: "1. Anyone who, being required to do so, fails to provide timely notification pursuant to Articles 37 and 38, or indicates incomplete information in it, shall be punished with the administrative sanction of the payment of a sum ranging from ten thousand euros to sixty thousand euros and with the ancillary administrative sanction of the publication of the order-injunction, in full or in extract, in one or more newspapers indicated in the measure applying it." it was thus replaced by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (2) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Art. 164Failure to inform or show the Garante (1) (2)[1. Anyone who fails to provide the information or to produce the documents requested by the Garante pursuant to Articles 150, paragraph 2, and 157 shall be punished with an administrative fine of between ten thousand euros and sixty thousand euros.] (1) The article that reads as follows: "1. Anyone who fails to provide the information or to produce the documents requested by the Guarantor pursuant to articles 150, paragraph 2, and 157 shall be punished with an administrative sanction of payment of a sum ranging from four thousand euros to twenty-four thousand euros." was thus replaced by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law of 27 February 2009, No. 14. (2) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Article 164-bis
Cases of lesser seriousness and aggravated cases (1) (3)[1. If any of the violations referred to in Articles 161, 162, 162-ter, (2), 163 and 164 are of lesser gravity, also taking into account the economic or social nature of the activity carried out, the minimum and maximum limits established by the same articles shall be applied to an extent equal to two fifths.2. In the event of several violations of a single or more provisions of this Chapter, with the exception of those provided for in Articles 162, paragraph 2, 162-bis and 164, committed even at different times in relation to databases of particular importance or size, the administrative sanction of the payment of a sum from fifty thousand euros to three hundred thousand euros shall be applied. Reduced payment is not permitted.3. In other cases of greater seriousness and, in particular, of greater significance of the prejudice to one or more data subjects, or when the violation involves numerous data subjects, the minimum and maximum limits of the penalties referred to in this Chapter shall be applied to a double extent.4. The penalties referred to in this Chapter may be increased by up to four times when they may be ineffective due to the economic conditions of the offender.] (1) Article inserted by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (2) The words: "art. 162-ter" were added by art. 1, Legislative Decree no. 69 of 28 May 2012, with effect from 1 June 2012. (3) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Art. 165Publication of the Garante's decision (1) (2)[1. In the cases referred to in the articles of this Chapter, the ancillary administrative sanction of the publication of the order-injunction, in full or in extract, may be applied in one or more newspapers indicated in the measure applying it. Publication shall be carried out at the expense of the offender.] (1) The article that reads as follows: "1. In the cases referred to in articles 161, 162 and 164, the ancillary administrative sanction of the publication of the order-injunction, in full or in extract, in one or more newspapers indicated in the measure applying it, may be applied." it was thus replaced by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009.
(2) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Article 166
Criteria for the application of administrative fines and procedure for the adoption of corrective and sanctioning measures (1)1. Violations of the provisions of Articles 2-quinquies, paragraph 2, 92, paragraph 1, 93, paragraph 1, 1, 123, paragraph 4, 128, 129, paragraph 2, and 132-ter are subject to the administrative sanction referred to in Article 83, paragraph 4, of the Regulation. The same administrative sanction shall be imposed on those who do not carry out the impact assessment referred to in the first sentence of Article 110(1) or submit the research programme to prior consultation with the Garante pursuant to the third sentence of the aforementioned paragraph. Evaluaciones (2)

2. Violations of the provisions referred to in Articles 2-ter, 2-quinquies, paragraph 1, 2-sexies, 2-septies, paragraph 8, 2-octies, 2-terdecies, paragraphs 1, 2, 3 and 4, 52, paragraphs 4 and 5, 75, 78, 79, 80, 82, 92, paragraph 2, shall be subject to the administrative sanction referred to in Article 83, paragraph 5, of the Regulation. 93, paragraphs 2 and 3, 96, 99, 100, paragraphs 1, 2 and 4, 101, 105 paragraphs 1, 2 and 4, 110-bis, paragraphs 2 and 3, 111, 111-bis, 116, paragraph 1, 120, paragraph 2, 122, 123, paragraphs 1, 2, 3 and 5, 124, 125, 126, 130, paragraphs 1 to 5, 131, 132, 132-bis, paragraphs 2, 132-quarter, 157, as well as the guarantee measures, the deontological rules referred to in articles 2-septies and 2-quarter respectively.3. The Garante is the body competent to adopt the corrective measures referred to in Article 58, paragraph 2, of the Regulation, as well as to impose the sanctions referred to in Article 83 of the same Regulation and in paragraphs 1 and 2.4. The procedure for the adoption of the measures and sanctions referred to in paragraph 3 may be initiated against both private entities and public authorities and public bodies, following a complaint pursuant to Article 77 of the Regulation or an investigation on the initiative of the Guarantor, in the context of the exercise of the investigative powers referred to in Article 58(1). of the Regulation, as well as in relation to accesses, inspections and verifications carried out on the basis of autonomous powers of assessment, or delegated by the Guarantor.5. When the Office of the Garante considers that the information acquired in the course of the activities referred to in paragraph 4 constitutes one or more violations indicated in this title and in Article 83, paragraphs 4, 5 and 6, of the Regulation, it shall initiate the procedure for the adoption of the measures and sanctions referred to in paragraph 3, notifying the data controller or processor of the alleged violations, in compliance with the guarantees provided for by the Regulation referred to in paragraph 9, unless the prior notification of the dispute is incompatible with the nature and purpose of the measure to be adopted. With regard to the data controllers referred to in Articles 2-ter, paragraph 1-bis, and 58 of this Code and Article 1, paragraph 1, of Legislative Decree No. 51 of 18 May 2018, the aforementioned notification may be omitted only if the Garante has ascertained that the alleged violations have already caused and continue to cause an effective, concrete, current and significant prejudice to the data subjects, which the Garante is obliged to identify and indicate in the measure, punctually justifying the reasons for the failure to notify. In the absence of these conditions, the competent judge ascertains the ineffectiveness of the measure. (3) 6. Within thirty days of receipt of the communication referred to in paragraph 5, the offender may send the Guarantor defensive writings or documents and may request to be heard by the same authority.7. In the adoption of sanctioning measures in the cases referred to in paragraph 3, Articles 1 to 9, 18 to 22 and 24 to 28 of Law No. 689 of 24 November 1981 shall be observed, insofar as applicable; in the same cases, the ancillary administrative sanction of the publication of the order-injunction may be applied, in full or in extract, on the website of the Garante or the injunction to carry out institutional communication campaigns aimed at promoting awareness of the right to the protection of personal data, on the basis of projects previously approved by the Garante and which take into account the seriousness of the violation. In determining the sanction pursuant to Article 83, paragraph 2, of the Regulation, the Garante shall also take into account any institutional communication campaigns aimed at promoting awareness of the right to the protection of personal data, carried out by the offender prior to the commission of the violation. The proceeds of the sanctions, to the extent of fifty per cent of the annual total, shall be reallocated to the fund referred to in Article 156, paragraph 8, to be allocated to the specific awareness-raising and inspection activities as well as the implementation of the Regulation carried out by the Authority. Evaluaciones (4)

8. Within the time limit referred to in Article 10(3) of Legislative Decree No 150 of 2011 for bringing an action, the offender and those jointly and severally liable may settle the dispute in accordance with the provisions of the Garante, where imposed, and by paying an amount equal to half of the penalty imposed.9. In compliance with Article 58(4) of the Regulation, the Garante shall define the procedures for the procedure for the adoption of the measures and sanctions referred to in paragraph 3 and the related deadlines by means of its own regulations published in the Official Gazette of the Italian Republic, in accordance with the principles of full knowledge of the investigative acts, the adversarial procedure, the recording of minutes, as well as the distinction between investigative and decision-making functions with respect to the imposition of the of the sanction. 10. The provisions relating to administrative sanctions provided for in this Code and in Article 83 of the Regulation shall not apply in relation to processing operations carried out in judicial proceedings.

(1) Article replaced by Article 15, paragraph 1, letter a) of Legislative Decree No. 101 of 10 August 2018 and subsequently amended by a press release published in the Official Gazette No. 212 of 12-9-2018. (2) Paragraph as amended by art. 9, paragraph 1, letter m), no. 1), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021. 3) Paragraph as amended by art. 9, paragraph 1, letter m), no. 2), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021. 4) Paragraph as amended by art. 9, paragraph 1, letter m), no. 3), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

Chapter IIIlicit criminal lawfulnessArt. 167
Unlawful processing of data (1)

1. Unless the act constitutes a more serious offence, any person who, in order to gain profit for himself or for others or to cause damage to the person concerned, acting in breach of the provisions of Articles 123, 126 and 130 or of the measure referred to in Article 129, causes harm to the person concerned, shall be punished with imprisonment from six months to one year and six months.2. Unless the fact constitutes a more serious offence, any person who, in order to gain for himself or for others or to cause damage to the data subject, proceeding with the processing of personal data referred to in Articles 9 and 10 of the Regulation in violation of the provisions of Articles 2-sexies and 2-octies, or of the guarantee measures referred to in Article 2-septies, causes harm to the data subject, is punishable by imprisonment from one to three years. Evaluaciones (2)

3. Unless the act constitutes a more serious offence, the penalty referred to in paragraph 2 shall also apply to any person who, in order to gain for himself or for others or to cause harm to the data subject, by transferring personal data to a third country or an international organisation outside the cases permitted pursuant to Article 45, 46 or 49 of the Regulation, causes harm to the person concerned.4. The Public Prosecutor, when he becomes aware of the offences referred to in paragraphs 1, 2 and 3, shall inform the Guarantor without delay.5. The Garante shall transmit to the public prosecutor, with a reasoned report, the documentation collected in the course of the investigation in the event that elements emerge that lead to the presumption of the existence of a crime. The documents shall be transmitted to the Public Prosecutor's Office at the latest at the end of the activity of ascertaining violations of the provisions of this decree.6. When, in accordance with this Code or the Regulation, an administrative fine has been imposed on the defendant or entity by the Garante for the same act and it has been collected, the penalty shall be reduced.

(1) Article replaced by Article 15, paragraph 1, letter b), Legislative Decree No. 101 of 10 August 2018. (2) Paragraph as amended by art. 9, paragraph 1, letter n), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

_________________Giurisprudenza

Disseminating the mobile phone number of others in erotic chats is a crime, Criminal Court of Cassation, section III, sentence 14 November 2019, no. 46376.
False profile on social media: crime of unlawful data processing is permanent, Criminal Court of Cassation, section III, sentence no. 42565 of 17 October 2019.
Spamming, is not a crime even after the GDPR, Criminal Court of Cassation, section III, sentence no. 41604 of 10 October 2019.

Article 167-bisUnlawful communication and dissemination of personal data subject to large-scale processing (1)

1. Unless the act constitutes a more serious criminal offence, any person communicates or disseminates, with a view to profiting for himself or others or with the aim of causing damage, an automated file or a substantial part thereof containing personal data subject to large-scale processing, in violation of Articles 2-ter, 2-sexies and 2-octies, shall be punished with imprisonment from one to six years.2. Unless the act constitutes a more serious offence, any person who, in order to profit for himself or others or to cause damage, communicates or disseminates, without consent, an automated file or a substantial part of it containing personal data subject to large-scale processing, shall be punished with imprisonment from one to six years, when the consent of the data subject is required for communication and dissemination operations.3. For the offences referred to in paragraphs 1 and 2, paragraphs 4, 5 and 6 of Article 167 shall apply.

(1) Article inserted by Article 15, paragraph 1, letter c), Legislative Decree No. 101 of 10 August 2018.

Article 167-terFraudulent acquisition of personal data subject to large-scale processing (1)

1. Unless the act constitutes a more serious criminal offence, any person who, in order to gain profit for himself or others or to cause damage, fraudulently acquires an automated file or a substantial part thereof containing personal data subject to large-scale processing shall be punished with imprisonment from one to four years.

2. For the offence referred to in paragraph 1, paragraphs 4, 5 and 6 of Article 167 shall apply.

(1) Article inserted by Article 15, paragraph 1, letter c), Legislative Decree No. 101 of 10 August 2018.

Art. 168
False declarations to the Garante and interruption of the performance of the tasks or exercise of the Garante's powers (1)

1. Unless the act constitutes a more serious offence, any person who, in proceedings or during investigations before the Garante, falsely declares or attests to information or circumstances or produces false acts or documents, shall be punished with imprisonment from six months to three years.2. Except in the cases referred to in paragraph 1, anyone who intentionally causes an interruption or disturbs the regularity of proceedings before the Garante or of the investigations carried out by the Garante shall be punished with imprisonment of up to one year.

(1) Article amended by Article 1, paragraph 11, Legislative Decree No. 69 of 28 May 2012, with effect from 1 June 2012, pursuant to the provisions of Article 3, paragraph 1, of the same Legislative Decree No. 69/2012. Subsequently, this article was replaced by Article 15, paragraph 1, letter d), Legislative Decree no. 101 of 10 August 2018.

Art. 169Security measures (3)1. Any person who, being obliged to do so, fails to take the minimum measures provided for in Article 33 shall be punished with imprisonment for up to two years.2. The offender, at the time of the investigation or, in complex cases, also with a subsequent act of the Guarantor, is given a prescription setting a deadline for regularization not exceeding the technically necessary period of time, extendable in the event of particular complexity or due to the objective difficulty of compliance and in any case not exceeding six months. Within sixty days following the expiry of the deadline, if the statute of limitations is fulfilled, the offender is allowed by the DPA to pay a sum equal to a quarter of the maximum penalty established for the administrative violation. (2) Compliance and payment extinguish the offence. The body issuing the prescription and the public prosecutor shall act in the manner provided for in Articles 21, 22, 23 and 24 of Legislative Decree No. 758 of 19 December 1994, as subsequently amended, in so far as they are applicable. (1) The words: "or with a fine from ten thousand euros to fifty thousand euros." were abolished by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (2) The words: "of the fine established for the contravention" have been replaced by art. 44, Legislative Decree no. 207 of 30 December 2008, converted into Law no. 14 of 27 February 2009. (3) Article repealed by Article 27, paragraph 1, letter c), no. 2), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Article 170Failure to comply with the provisions of the Garante (1)1. Any person who, by failing to comply with the measure adopted by the Garante pursuant to Articles 58(2)(f) of the Regulation, Article 2-septies(1), as well as the general measures referred to in Article 21(1) of the Legislative Decree implementing Article 13 of Law No. 163 of 25 October 2017, causes concrete harm to one or more subjects involved in the processing is punished, upon complaint by the injured party, with imprisonment from three months to two years. Evaluaciones (2)

(1) Article replaced by Article 15, paragraph 1, letter e), Legislative Decree No. 101 of 10 August 2018. (2) Paragraph as amended by art. 9, paragraph 1, letter o), Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021.

Article 171
Violations of the provisions on remote monitoring and surveys of workers' opinions (1)

1. Violation of the provisions of Articles 4(1) and (8) of Law No 300 of 20 May 1970 shall be punished by the penalties referred to in Article 38 of the same law.

(1) Article replaced by Article 23, paragraph 2, Legislative Decree No. 151 of 14 September 2015, with effect from 24 September 2015, pursuant to the provisions of Article 43, paragraph 1 of the same Legislative Decree No. 151/2015. Subsequently, this article was replaced by Article 15, paragraph 1, letter f), Legislative Decree no. 101 of 10 August 2018.

Art. 172
Additional penalties

1. Conviction for one of the offences provided for in this Code shall entail the publication of the judgment, pursuant to the second and third paragraphs of Article 36 of the Criminal Code. Evaluaciones (1)

(1) Paragraph as amended by Article 15, paragraph 1, letter g), Legislative Decree no. 101 of 10 August 2018.

Title IVDamending, repealing, transitional and final provisions Chapter IDamending provisionsArticle 173Convention implementing the Schengen Agreement (1)[1. Law No 388 of 30 September 1993, as amended, on the ratification and implementation of the protocols and agreements for accession to the Schengen Agreement and its implementing convention, is amended as follows:(a) paragraph 2 of Article 9 is replaced by the following:"2. Requests for access, rectification or cancellation, as well as verification, of which, Articles 109, 110 and 114(2) of the Convention respectively, shall be addressed to the authority referred to in paragraph 1."; b) paragraph 2 of Article 10 is deleted; (c) Article 11 is replaced by the following:"11. 1. The supervisory authority referred to in Article 114 of the Convention shall be the Guarantor for the protection of personal data. In the exercise of the tasks assigned to it by law, the Garante exercises control over the processing of data in application of the Convention and carries out the checks provided for in the same Article 114, including on the basis of a report or complaint by the data subject as a result of an inadequate response to the request made pursuant to Article 9, paragraph 2, when it is not possible to provide the same data subject with a response on the basis of the information provided by the authority referred to in Article 9, paragraph 1.2. The provisions of Article 10(5) of Law No 121 of 1 April 1981, as amended, shall apply."; (d) Article 12 is repealed.]

(1) Article repealed by Article 27, paragraph 1, letter c), no. 3), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Art. 174Service of documents and judicial sales (1)1. In Article 137 of the Code of Civil Procedure, after the second paragraph, the following are inserted:"If service cannot be effected in the addressee's own hands, except in the case provided for in the second paragraph of Article 143, the bailiff shall deliver or deposit a copy of the document to be served in an envelope which he seals and on which he transcribes the chronological number of service, acknowledging it in the report at the bottom of the original and a copy of the deed itself. No signs or indications are affixed to the envelope from which the content of the document can be deduced. The provisions referred to in the third paragraph shall also apply to communications made by means of a court ticket pursuant to Articles 133 and 136.". 2. In the first paragraph of Article 138 of the Code of Civil Procedure, the words from "may always execute" to "addressee" shall be replaced by the following: "shall normally carry out service by delivering the copy to the addressee's own hands, at his or her home or, if this is not possible,".3. In the fourth paragraph of Article 139 of the Code of Civil Procedure, the word "the original" is replaced by the following: "a receipt".4. In Article 140 of the Code of Civil Procedure, after the words: "affixes notice of deposit", the following words are inserted: "in a closed and sealed envelope".5. The following amendments shall be made to Article 142 of the Code of Civil Procedure:(a) the first and second paragraphs shall be replaced by the following: "Without prejudice to the provisions of the second paragraph, if the addressee does not have his residence, abode or domicile in the State and has not elected an address for service there or appointed an attorney in accordance with Article 77, the document shall be served on the addressee by registered post and by delivery of another copy to the public the Ministry that is responsible for transmitting it to the Ministry of Foreign Affairs for delivery to the person to whom it is addressed."; (b) in the last paragraph, the words: "in the preceding paragraphs" shall be replaced by the following: "in the first paragraph".6. In the first paragraph of Article 143 of the Code of Civil Procedure, the words from: ", and by" to the end of the sentence shall be deleted.7. In the first paragraph of Article 151 of the Code of Civil Procedure, the following shall be added after the words "greater speed": "of confidentiality or protection of dignity".8. In Article 250 of the Code of Civil Procedure, the following is added after the first paragraph: "The summons referred to in the first paragraph, if it is not carried out in the hands of the addressee or by postal service, shall be made in a sealed envelope.". 9. The following sentence shall be added at the end of the third paragraph of Article 490 of the Code of Civil Procedure: "The notice shall omit the indication of the debtor".10. In the first paragraph of Article 570 of the Code of Civil Procedure, the words "of the debtor" shall be deleted and the words from "information" to the end shall be replaced by the following: "information, including information relating to the debtor's personal details, may be provided by the court registry to any person who has an interest in it".11. The following sentence is added at the end of the fourth paragraph of Article 14 of Law No 689 of 24 November 1981, as amended: "Where service cannot be effected in the hands of the addressee, the procedures laid down in the third paragraph of Article 137 of the same Code shall be observed. ". 12. The following shall be inserted after Article 15 of Presidential Decree No 445 of 28 December 2000:"Article 15-bis. (Service of acts and documents, communications and notices) 1. The provisions contained in the third paragraph of Article 137 of the Code of Civil Procedure shall apply to the service of acts and documents by bodies of public administrations to persons other than the interested parties or persons delegated by them, as well as to communications and notices of their content. Tickets and invitations to present shall include the information strictly necessary for this purpose.". 13. The following amendments shall be made to Article 148 of the Code of Criminal Procedure:(a) paragraph 3 shall be replaced by the following:"3. The document shall be served in its entirety, unless otherwise provided by law, as a general rule by delivery of a copy to the addressee or, if this is not possible, to the persons referred to in this title. Where service cannot be effected in the addressee's own hands, the bailiff or the judicial police shall deliver the copy of the document to be served, except in the case of service to the defence counsel or person authorised to accept service, after placing it in an envelope which they shall seal by transcribing the chronological number of service and noting it in the report at the end of the original and the copy of the document."; b) the following is added after paragraph 5:"5-bis. Communications, notices and any other note or invitation delivered not in a sealed envelope to a person other than the addressee shall bear the strictly necessary information.". 14. In Article 157(6) of the Code of Criminal Procedure, the words: "shall be written on the outside of the envelope itself" shall be replaced by the following: "shall be carried out in the manner provided for in Article 148(3)".15. In art. 80 of the implementing provisions of the Code of Criminal Procedure, approved by Legislative Decree No 271 of 28 July 1989, paragraph 1 shall be replaced by the following:"1. If a copy of the local search warrant is delivered to the doorman or to the person acting on his behalf, the provision of Article 148(3) shall apply, of the Code.". 16. The following amendments shall be made to Law No 890 of 20 November 1982:(a) in the first paragraph of Article 2, the following sentence shall be added at the end: "No signs or indications shall be affixed to the envelopes from which the content of the document can be inferred."; (b) in the second sentence of the second paragraph of Article 8, after the words: "The postal agent shall issue notice", the following shall be inserted: "in a sealed envelope, of the deposit".

Art. 175Police forces[1. The processing carried out for the provision of information acquired in the course of administrative activities pursuant to Article 21, paragraph 1, of Law No. 128 of 26 March 2001, and for the connections referred to in paragraph 3 of the same article is subject to communication to the Garante pursuant to Article 39, paragraphs 2 and 3.] (1) [2. Personal data processed by the police, public security bodies and other subjects referred to in Article 53, paragraph 1, without the aid of electronic tools prior to the date of entry into force of this Code, may be further processed when applying this Code if their accuracy, completeness and updating have been verified pursuant to Article 11.] (1) 3. Article 10 of Law No 121 of 1 April 1981, as amended, shall be replaced by the following:"Article 10 (Controls)1. Control over the Data Processing Centre is exercised by the Guarantor for the protection of personal data, in the manner provided for by law and regulations.2. The data and information stored in the Centre's archives may be used in judicial or administrative proceedings only through the acquisition of the original sources indicated in the first paragraph of Article 7, without prejudice to the provisions of Article 240 of the Code of Criminal Procedure. When, in the course of judicial or administrative proceedings, the erroneousness or incompleteness of the data and information, or the unlawfulness of their processing, is found, the previous authority shall notify the Guarantor for the protection of personal data.3. The person to whom the data refer may ask the office referred to in letter a) of the first paragraph of Article 5 to confirm the existence of personal data concerning him/her, their communication in intelligible form and, if the data are processed in violation of current legal provisions or regulations, their cancellation or transformation into anonymous form.4. Once the necessary investigations have been carried out, the office shall notify the applicant, no later than thirty days from the request, of the decisions adopted. The office may fail to act on the request if this may jeopardise actions or operations to protect public order and security or to prevent and suppress crime, informing the Guarantor for the protection of personal data.5. Anyone who becomes aware of the existence of personal data concerning him/her, also processed in non-automated form in violation of legal provisions or regulations, may ask the court of the place where the data controller resides to carry out the necessary investigations and to order the rectification, integration, cancellation or transformation into anonymous form of the same data.

(1) Paragraph repealed by Article 27, paragraph 1, letter c), no. 3), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Art. 176Public entities (1)[1. In Article 24, paragraph 3, of Law no. 241 of 7 August 1990, after the words: "by means of IT tools" the following are inserted: "except in cases of access to personal data by the person to whom the data refer, ".2. In Article 2 of Legislative Decree no. 165 of 30 March 2001, on the organisation of employment in public administrations, the following is inserted after paragraph 1:"1-bis. The organisational criteria referred to in this article shall be implemented in compliance with the regulations on the processing of personal data.". 3. Article 4(1) of Legislative Decree No 39 of 12 February 1993, as amended, shall be replaced by the following: "1. The National Centre for Information Technology in Public Administration is hereby established, which shall operate at the Presidency of the Council of Ministers for the implementation of the policies of the Minister for Innovation and Technology, with technical, functional and administrative autonomy, accounting and financial and with independence of judgment.". 4. Article 6 of Legislative Decree No 39 of 12 February 1993 shall continue to apply to the National Centre for Information Technology in the Public Administration, as shall the current financing arrangements within the framework of the estimates of the Ministry of the Economy and Finance.5. Article 5(1) of Legislative Decree No 39 of 1993, as amended, shall be replaced by the following: "1. The National Centre shall propose to the President of the Council of Ministers the adoption of regulations concerning its organisation, its operation, the administration of personnel, the organisation of careers and the management of expenditure within the limits provided for in this decree.". 6. The name: "Authority for Information Technology in the Public Administration" contained in the legislation in force shall be replaced by the following: "National Centre for Information Technology in the Public Administration".]

Art. 177Registry regulations, civil status and electoral rolls (1)1. The municipality may use the lists referred to in Article 34, paragraph 1, of Presidential Decree no. 223 of 30 May 1989, for exclusive use of public utility even in the event of application of the regulations on institutional communication.2. Paragraph 7 of Article 28 of Law No. 184 of 4 May 1983, as amended, is replaced by the following: "7. Access to information shall not be permitted in respect of a mother who has declared at birth that she does not wish to be named pursuant to Article 30, paragraph 1, of Presidential Decree No. 396 of 3 November 2000.".3. The issue of extracts from the civil status documents referred to in Article 107 of Presidential Decree No. 396 of 3 November 2000 is allowed only to the persons to whom the document refers, or upon a reasoned request proving the personal and concrete interest of the applicant for the purpose of protecting a legally relevant situation, or seventy years after the formation of the document.4. In the first paragraph of Article 5 of Presidential Decree No 223 of 20 March 1967, letters d) and e) shall be deleted.5. In Article 51 of Presidential Decree No 223 of 20 March 1967, the fifth paragraph is replaced by the following: "Copies of the electoral rolls may be issued for the purpose of applying the rules on active and passive voting, study, statistical, scientific or historical research, or social welfare or for the pursuit of a collective or widespread interest.".

Art. 178Provisions on health (1)[1. In Article 27, third and fifth paragraphs, of Law No 833 of 23 December 1978 on personal health records, the following shall be inserted after the words: "the National Health Council" and before the comma: "and the Guarantor for the protection of personal data".2. The following amendments are made to Article 5 of Law No. 135 of 5 June 1990 on AIDS and HIV infection:a) paragraph 1 is replaced by the following: "1. The health worker and any other person who becomes aware of a case of AIDS, or of a case of HIV infection, even if not accompanied by a morbid state, shall be required to provide the necessary assistance and to take all necessary measures or arrangements for the protection of the fundamental rights and freedoms of the person concerned, as well as his or her dignity."; b) in paragraph 2, the words: "decree of the Minister of Health" are replaced by the following: "decree of the Minister of Health, after consulting the Guarantor for the protection of personal data".3. In Article 5, paragraph 3, of Legislative Decree no. 539 of 30 December 1992, as amended, on medicinal products for human use, the following sentence is inserted at the end: "After this period, the pharmacist shall destroy the prescriptions in such a way as to exclude access by third parties to the data contained therein. ". 4. In Article 2(1) of the Decree of the Minister for Health of 11 February 1997, published in the Official Gazette No 72 of 27 March 1997, on the importation of medicinal products registered abroad, letters f) and h) shall be deleted.5. In paragraph 1, first sentence, of Article 5-bis of Decree-Law No. 23 of 17 February 1998, converted, with amendments, by Law No. 94 of 8 April 1998, the words from: "also concerns" until the end of the period are replaced by the following: "is acquired together with consent relating to the processing of personal data".]

Art. 179Other amendments (2)[1. In Article 6 of Law No 339 of 2 April 1958, the following words shall be deleted: "; maintain the necessary confidentiality for everything that refers to family life" and: "guarantee the worker respect for his personality and his moral freedom;". 2. In the first paragraph of Article 38 of Law No 300 of 20 May 1970, the words "4" and ",8" shall be deleted.3. In paragraph 3 of Article 12 of Legislative Decree No. 185 of 22 May 1999, on distance contracts, the following words are added at the end: "or, limited to the violation referred to in Article 10, to the Guarantor for the protection of personal data".] (...) (1) (1) Paragraph repealed by art. 184, Legislative Decree no. 42 of 22 January 2004, with effect from 1 May 2004.
(2) Article repealed by Article 27, paragraph 1, letter c), no. 3), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Chapter II (1)Transitional provisions

(1) Chapter repealed by Article 27, paragraph 1, letter c), no. 4), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Art. 180Security measures (2)[1. The minimum security measures referred to in Articles 33 to 35 and Annex B) which were not provided for by Presidential Decree No 318 of 28 July 1999 shall be adopted by 31 March 2006. (1) 2. A holder who, on the date of entry into force of this Code, has electronic tools which, for objective technical reasons, do not allow all or part of the immediate application of the minimum measures referred to in Article 34 and the corresponding technical procedures referred to in Annex B, shall describe the same reasons in a document with a certain date to be kept at his or her facility.3. In the case referred to in paragraph 2, the holder shall take all possible security measures in relation to the electronic instruments held in such a way as to avoid, also on the basis of appropriate organisational, logistical or procedural measures, an increase in the risks referred to in Article 31, adapting the same instruments by 30 June 2006 at the latest. (1)]

(1) Paragraph as last amended by art. 10, Legislative Decree no. 273 of 30 December 2005, converted into Law no. 51 of 23 February 2006. (2) Article repealed by Article 27, paragraph 1, letter c), no. 4), Legislative Decree no. 101 of 10 August 2018, which repealed the entire Chapter II. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Article 181Other transitional provisions (4)[1. For the processing of personal data initiated before 1 January 2004, at the time of the first application of this Code: a) the identification by means of a regulatory act of the types of data and operations pursuant to Articles 20, paragraphs 2 and 3, and 21, paragraph 2, shall be carried out, if missing, by 28 February 2007; (1)(b) the determination to be made known to the interested parties pursuant to Article 26(3)(a) and (4)(a) shall be adopted, if it is missing, by 30 June 2004; (c) the notifications provided for in Article 37 shall be made by 30 April 2004; d) the communications provided for in Article 39 shall be made by 30 June 2004; (...) (2)f) the use of the forms referred to in Article 87, paragraph 2, is mandatory as from 1 January 2005.2. The provisions of Article 21-bis of Presidential Decree No. 1409 of 30 September 1963, introduced by Article 9 of Legislative Decree No. 281 of 30 July 1999, shall remain in force until the date of entry into force of this Code.3. The identification of the processing operations and data controllers referred to in Articles 46 and 53, to be reported in Annex C), shall be carried out at the time of the first application of this Code by 30 June 2004.4. Any information material transferred to the Garante pursuant to Article 43, paragraph 1, of Law no. 675 of 31 December 1996, used for the appropriate checks, continues to be subsequently archived or destroyed in accordance with current legislation.5. The omission of the personal details and other identifying data of the data subject pursuant to Article 52, paragraph 4, shall be made on judgments or decisions pronounced or adopted before the entry into force of this Code only at the direct request of the data subject and limited to documents published by electronic communications network or on new products on paper or electronic support. The information systems used pursuant to Article 51, paragraph 1, shall be adapted to the same provision within twelve months of the date of entry into force of this Code.6. Religious denominations which, prior to the adoption of this Code, have determined and adopted within their respective legal system the guarantees referred to in Article 26, paragraph 3, letter a), may continue their processing activities in compliance with the same.6-bis. Until the date on which the measures and arrangements prescribed pursuant to Article 132(5) for the maintenance of telephone traffic become effective, the deadline referred to in Article 4(2) of Legislative Decree No 171 of 13 May 1998 shall be observed. (3)] (1) Letter as amended by Ministerial Decree no. 225 of 23 June 2004 and by art.1, Legislative Decree no. 173 of 12 May 2006, converted into Law no. 228 of 12 July 2006 and most recently by art. 6, paragraph 1, Legislative Decree no. 300 of 28 December 2006, converted, with amendments, by Law no. 17 of 26 February 2007. (2) The letter reads as follows: "e) the simplified procedures for information and the expression of consent, where necessary, may be used by the general practitioner, the paediatrician of free choice and by health bodies also on the occasion of the first further contact with the data subject, at the latest by 30 September 2004" was repealed by art. 2-quinquies, Legislative Decree no. 81 of 29 March 2004, converted into Law no. 138 of 26 May 2004. (3) Paragraph added by art. 4, Legislative Decree no. 354 of 24 December 2003, converted into Law no. 45 of 26 February 2004. (4) Article repealed by Article 27, paragraph 1, letter c), no. 4), Legislative Decree no. 101 of 10 August 2018, which repealed the entire Chapter II. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018. Article 182Office of the Guarantor (1)[1. In order to ensure the continuity of institutional activities, at the time of the first application of this Code and in any case no later than 31 March 2004, the Garante: a) may identify the conditions for the classification on a permanent basis, at the initial level of their respective qualifications and within the limits of the availability of staff, of staff belonging to public administrations or public bodies in service at the Office of the Garante in a position of non-tenure or equivalent on the date of publication of this code; b) may provide for reserves of posts in public competitions, only within the limit of thirty per cent of the available staff, for non-permanent staff in service at the Office of the Guarantor who have at least one year's work experience with the Guarantor.]

(1) Article repealed by Article 27, paragraph 1, letter c), no. 4), Legislative Decree no. 101 of 10 August 2018, which repealed the entire Chapter II. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Chapter IIIArepealArt. 183Repealed rules1. From the date of entry into force of this Code, the following shall be repealed:a) Law No. 675 of 31 December 1996; b) Law No. 325 of 3 November 2000; c) Legislative Decree No. 123 of 9 May 1997; d) Legislative Decree No. 255 of 28 July 1997; e) Article 1 of Legislative Decree No. 135 of 8 May 1998; (f) Legislative Decree No 171 of 13 May 1998, with the exception of Article 4(2), which shall be repealed on 1 January 2006; g) Legislative Decree No. 389 of 6 November 1998; h) Legislative Decree no. 51 of 26 February 1999; i) Legislative Decree No. 135 of 11 May 1999; (l) Legislative Decree No 281 of 30 July 1999, with the exception of Articles 8(1), 11 and 12 thereof; m) Legislative Decree No. 282 of 30 July 1999; n) Legislative Decree No. 467 of 28 December 2001; o) Decree of the President of the Republic no. 318.2 of 28 July 1999. From the date of entry into force of this Code, Articles 12, 13, 14, 15, 16, 17, 18, 19 and 20 of Presidential Decree No. 501.3 of 31 March 1998 shall be repealed. From the date of entry into force of this Code, the following are or will also remain repealed: a) art. 5, paragraph 9, of the Decree of the Minister of Health of 18 May 2001, no. 279, on rare diseases; b) Article 12 of Law No. 152 of 30 March 2001; c) Article 4, paragraph 3, of Law no. 52 of 6 March 2001, on bone marrow donors; d) Article 16, paragraphs 2 and 3, of Presidential Decree No. 445 of 28 December 2000 on certificates of assistance in childbirth; e) art. 2, paragraph 5, of the Decree of the Minister of Health of 27 October 2000, no. 380, on information flows on those discharged from hospitals; f) Article 2, paragraph 5-quarter1, second and third sentences, of Decree-Law No. 70 of 28 March 2000, converted, with amendments, by Law No. 137 of 26 May 2000, as amended, on the insurance claims database; g) Article 6, paragraph 4, of Legislative Decree no. 204 of 5 June 1998, on the dissemination of data for research and collaboration purposes in the scientific and technological field; h) Article 330-bis of Legislative Decree No. 297 of 16 April 1994 on the dissemination of data relating to students; (i) Article 8(4) and Article 9(4) of Law No 121.4 of 1 April 1981. From the date on which the provisions of the Code of Ethics and Good Conduct referred to in Article 118 become effective, the terms of retention of personal data identified pursuant to Article 119, which may be provided for by law or regulation, shall be complied with to the extent indicated by the same Code. Chapter IVNeminent Forms Art. 184Implementation of European Directives (1)[1. The provisions of this Code implement Directive 96/45/EC of the European Parliament and of the Council of 24 October 1995 and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002.2. When laws, regulations and other provisions refer to provisions included in Law no. 675 of 31 December 1996, and in other provisions repealed by this code, the reference shall be deemed to be made to the corresponding provisions of this code according to the table of correspondence shown in the annex.3. This is without prejudice to the provisions of law and regulations that establish prohibitions or more restrictive limits on the processing of certain personal data.]

(1) Article repealed by Article 27, paragraph 1, letter c), no. 5), Legislative Decree no. 101 of 10 August 2018. See also Article 22, paragraph 6, of the aforementioned Legislative Decree no. 101/2018.

Art. 185Attachment of codes of ethics and good conduct (1)1. Annex A) contains, in addition to the codes referred to in Article 12, paragraphs 1 and 4, those promoted pursuant to Articles 25 and 31 of Law No. 675 of 31 December 1996, and already published in the Official Gazette of the Italian Republic on the date of issue of this Code.

Art. 186Entry into force1. The provisions of this Code shall enter into force on 1 January 2004, with the exception of the provisions of Articles 156, 176(3), (4), (5) and (6) and 182, which shall enter into force on the day following the date of publication of this Code. From the same date, the time limits for appeals referred to in Articles 149(8) and 150(2.Il of this Code shall also be observed, bearing the seal of the State, shall be included in the Official Collection of Regulatory Acts of the Italian Republic. It is the obligation of whoever is responsible to observe it and to ensure that it is observed. Given at Rome, 30 June 2003