--- title: "Italy — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/italy/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/italy/algorithmic-biometric-and-surveillance-governance/index.html description: "Italy — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 5 claims Amber ▾ # Governance architecture is advanced and the Gara" generated_at: 2026-10-25T04:46:50Z content_sha256: 18ad2dca829b79d716437efa3f4f432d2e587eb50a77b46046b7a17b6087edb5 generator: "fe-fleet/md-twin@1.0" --- # Italy — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules5 claimsAmber▾# Governance architecture is advanced and the Garante has secured a central supervisory role, but the AI Act implementing framework remains partly in legislative process and biometric safeguards are still being strengthened per the Garante's own July 2026 comments. Primary framework GDPR Art.22 + EU AI Act (Regulation (EU) 2024/1689) + Italian AI Law (L.132/2025) + national AI Act implementing decree Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Governance architecture is advanced and the Garante has secured a central supervisory role, but the AI Act implementing framework remains partly in legislative process and biometric safeguards are still being strengthened per the Garante's own July 2026 comments. #### Sub-modules (6) #### Profiling RestrictionsAmber The Garante fined a Glovo-group platform EUR 2.6 million for using discriminatory rider-management algorithms. Claims (1): - The Garante fined a platform in the Glovo group EUR 2.6 million for using algorithms that caused discrimination among riders. #### Automated Decision Making TransparencyAmber Character.AI was found to have provided insufficient information about processing operations and to have prepared its DPIA and EU-representative designation belatedly. Claims (1): - In fining Character Technologies Inc. EUR 158,000, the Garante found deficiencies in the information provided to users and that the DPIA and EU-representative designation were carried out belatedly. #### Ai Risk AssessmentsGreen Italy's draft AI Act implementing decree designates the Garante as market-surveillance authority for high-risk AI systems in justice, law enforcement, immigration, border management and democratic processes. Claims (1): - Italy's AI Act implementing decree designates the Garante as the market-surveillance authority for high-risk AI systems used in justice, law-enforcement, immigration, border-management and democratic-process contexts. #### Biometric RegimeAmber The Garante fined Clearview AI EUR 20 million and banned its use of biometric data and monitoring of Italian data subjects; a separate police-AI decree limits real-time remote biometric identification to specific serious-threat scenarios, though the Garante has urged strengthening biometric-database quality safeguards. Claims (2): - The Garante fined Clearview AI EUR 20 million and banned its use of biometric data and monitoring of Italian data subjects. - Italy's draft police-use-of-AI decree permits real-time remote biometric identification only to confirm identity or conduct a targeted search for specifically identified or identifiable persons in relation to the threat to be prevented or the search to be conducted, consistent with AI Act Art.5(1)(h) and (2); the Garante has requested strengthened guarantees on biometric database quality. #### Genetic DataGreen Genetic data receives heightened Art.9 GDPR/Art.2-septies Codice protection; no Italy-specific 2026 enforcement case was located in this cycle. Absence provenance: No 2026 genetic-data-specific enforcement decision surfaced; general Art.9 GDPR/Art.2-septies Codice protection applies.. Searched: Garante dati genetici sanzione 2026. #### State Surveillance CarveoutsAmber Italy's police-AI decree permits real-time remote biometric identification only to confirm identity or locate specifically identified/identifiable individuals in relation to serious threats or missing-persons searches, per the AI Act (Art.5) framework. Claims (1): - Italy's draft police-use-of-AI decree permits real-time remote biometric identification only to confirm identity or conduct a targeted search for specifically identified or identifiable persons in relation to the threat to be prevented or the search to be conducted, consistent with AI Act Art.5(1)(h) and (2); the Garante has requested strengthened guarantees on biometric database quality. #### Key findings (1) - Court of Rome annulled the Garante's EUR 15M OpenAI fine on 18 March 2026. — source on file Category narrative 71 words The Garante has been designated national market-surveillance authority for high-risk AI systems in justice, law enforcement, immigration, border management and democratic processes under Italy's AI Act implementing decree, while retaining full GDPR competence over any AI activity processing personal data. Enforcement precedent spans algorithmic-discrimination (Glovo riders), biometric/facial-recognition bans (Clearview AI), and transparency/DPIA failures in generative-AI chatbots (Character.AI). A separate police-use-of-AI decree restricts real-time remote biometric identification to narrowly defined serious-threat/missing-person scenarios. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance This is the most significant module for Italy this cycle, carrying four distinct developments that together indicate an escalating pattern of Garante engagement with algorithmic and AI-adjacent governance ahead of, and independent of, the formal enactment of Italy's AI Act implementing legislation. The most material of these developments is the Garante's favourable opinion on Italy's draft legislative decree implementing the EU AI Act. The draft decree, as reviewed by the Garante, would designate the Garante itself as the market-surveillance authority for high-risk AI systems deployed in four sensitive contexts: justice administration, law enforcement, immigration and border management, and processes touching the democratic process. This is a substantial expansion of the Garante's institutional remit beyond its existing GDPR-based mandate, and it reflects a deliberate legislative choice to route AI Act market-surveillance responsibility for these particularly sensitive domains through the existing data-protection authority rather than creating a wholly new oversight body. As of this cycle, the decree remains at the proposed stage; the Garante's opinion is favourable but the decree has not yet been enacted, and its final text and effective date remain open questions. Separately, and demonstrating that the Garante is already applying AI Act principles operationally ahead of the implementing decree's enactment, the regulator issued a provvedimento dated 14 May 2026 addressing the use of AI systems in the workplace to analyse workers' emotional or psychological states. This provvedimento explicitly invoked the AI Act's prohibition on emotion-inference systems in the employment context, treating that prohibition as already operative guidance for employers deploying such systems on Italian workers, notwithstanding that the national implementing decree itself remains unenacted. A third development concerns biometric identification in the criminal-procedure context. The Garante has called for an express prohibition, to be incorporated within a pending reform introducing a new Article 359-ter biometric-identification framework into Italy's criminal-procedure law, on the use of databases obtained through indiscriminate scraping or otherwise assembled in violation of data-protection law. This is advocacy directed at a pending legislative reform rather than a completed instrument, but it signals the Garante's substantive position on how facial-recognition and biometric-identification databases used by law-enforcement bodies should be constrained. A fourth strand concerns generative AI directly. In a provvedimento dated 3 July 2026, the Garante examined the character.ai generative-AI companion service, noting specifically the existence of a dedicated version of the service for minor users, launched in November 2024. This examination sits at the intersection of algorithmic governance and the treatment of vulnerable users, and is addressed further under the children and vulnerable groups module. #### Outlook The enactment trajectory of the AI Act implementing decree is the central item to watch: a favourable Garante opinion is a meaningful procedural step but does not itself extend the Garante's market-surveillance remit until the decree is formally enacted. In the interim, the workplace-AI provvedimento and the biometric-scraping advocacy both demonstrate that the Garante is willing to apply AI Act-derived principles through its existing enforcement and policy powers, a pattern likely to continue as the decree moves through the remainder of the legislative process. 1 earlier distinct update(s) Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance This module carries the highest density of material developments in Italy's data-protection landscape this cycle, with four distinct threads escalating simultaneously. First, the Garante imposed a EUR 158,000 fine on Character Technologies Inc. on 9 July 2026 for GDPR violations concerning privacy notices and child-protection and age-verification failures, a Confirmed-confidence, Tier-1-sourced primary enforcement action. Second, the Garante's ruling under Provvedimento 10281021 holds that AI Act transparency obligations for manipulated content become applicable from 2 August 2026, while clarifying that deepfakes are not per se a prohibited practice under the AI Act; at the time of the ruling this obligation was enacted but not yet effective, and it is now understood to be in force given the 2 August 2026 applicability date has since passed. This is a Confirmed-confidence, Tier-1-sourced finding. Third, the Garante flagged AI Act incompatibilities in a proposed police facial-recognition decree, specifically objecting to a 7-day biometric-data retention period that would apply regardless of whether a crime actually occurred, and called for modifications ahead of a final Council of Ministers vote expected before October 2026. This is a Probable-confidence finding, sourced at Tier 3, and represents an active, unresolved dispute between the regulator and the government over a still-proposed instrument. Fourth, and most structurally significant, the Court of Rome annulled the Garante's own December 2024 EUR 15 million fine and media-campaign order against OpenAI on 18 March 2026, on one-stop-shop jurisdiction grounds. This is a Confirmed-confidence finding, though sourced at Tier 3, and it represents a significant judicial reversal of the regulator's own enforcement action. Read together, this annulment and the continuing aggressive enforcement against Character.AI signal a meaningful judicial check on Italy's AI-enforcement reach even as the regulator continues pursuing smaller generative-AI operators, an Assessed-confidence key judgment. #### Outlook Watch for the final Council of Ministers vote on the facial-recognition decree, expected before October 2026, and for whether the Garante appeals the Court of Rome's OpenAI annulment or adjusts its jurisdictional approach to future one-stop-shop cases in light of that ruling. Evidence 5 Sources and claims (5) - Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en/press-room) — The Garante fined a platform in the Glovo group EUR 2.6 million for using algorithms that caused discrimination among riders.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10269594) — In fining Character Technologies Inc. EUR 158,000, the Garante found deficiencies in the information provided to users and that the DPIA and EU-representative designation were carried out belatedly.observed 2026-08-03 - Probable[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10275843) — Italy's AI Act implementing decree designates the Garante as the market-surveillance authority for high-risk AI systems used in justice, law-enforcement, immigration, border-management and democratic-process contexts.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en/press-room) — The Garante fined Clearview AI EUR 20 million and banned its use of biometric data and monitoring of Italian data subjects.observed 2026-08-03 - Probable[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10275606) — Italy's draft police-use-of-AI decree permits real-time remote biometric identification only to confirm identity or conduct a targeted search for specifically identified or identifiable persons in relation to the threat to be prevented or the search to be conducted, consistent with AI Act Art.5(1)(h) and (2); the Garante has requested strengthened guarantees on biometric database quality.observed 2026-08-03