Italy: Sectoral Watch

Sectoral Watch

The Garante issued two sectoral developments on 1 October 2026. First, it republished an updated edition of its practical guide, 'Privacy e recupero crediti', addressed to banks, finance companies, phone and energy companies engaged in debt-recovery activity. This is a routine guidance republication rather than a substantive rule change, but it signals continued regulatory attention to the debt-collection sector's data-protection practices across multiple industries.

Second, and more substantively, the Garante expressed a favourable opinion, with observations, on the draft legislative decree transposing EU Directive 2024/2831 on platform work into Italian law. The Garante's observations specifically asked for greater attention to rider privacy in the transposition, a sector-specific concern given the extent of location, performance and activity-monitoring data typically generated by platform-based delivery and ride-hailing work. The opinion was favourable overall but conditioned on these observations being addressed as the decree proceeds, a posture consistent with the Garante's established practice of engaging with government transposition drafts ahead of their final adoption rather than only after the fact.

Outlook

The transposition decree for the EU Platform Work Directive is the clearer marker to watch here: whether the final adopted text incorporates the Garante's rider-privacy observations, and how the debt-recovery guidance republication is received across the banking, finance, telecommunications and energy sectors it addresses, are both worth tracking as this decree moves through the legislative process.

Sectoral Watch

The Garante's inspection plan for the second half of 2026 identifies at least 35 inspections to be conducted between August and December. The plan marks a deliberate shift in sectoral focus: AI-system checks, which had previously concentrated on the education sector and schools specifically, are being redirected toward municipalities, local health authorities (ASL), geomarketing, neuromarketing, dynamic pricing, and DPO-supplier relationships. This redirection signals that the Garante's sectoral enforcement priorities for the remainder of 2026 are moving away from education-sector AI deployments and toward public-administration bodies and commercial pricing/marketing-technology practices that involve algorithmic processing of consumer or citizen data.

The inclusion of municipalities and local health authorities as inspection targets is notable because it extends the Garante's practical sectoral attention into public-sector bodies that increasingly deploy AI-assisted systems for service delivery and resource allocation, sectors that had not previously been named as a discrete inspection priority. Similarly, the explicit naming of geomarketing, neuromarketing and dynamic pricing as inspection targets reflects a sectoral focus on commercial practices that use behavioural or location data to shape consumer-facing pricing or marketing decisions, an area where AI-driven personalisation techniques raise the kind of profiling and transparency questions the Garante has flagged in other contexts this cycle.

This sectoral shift should be read alongside the broader enforcement-and-redress picture for the cycle, in which two concrete sanctions (Poste Italiane/PostePay and Altroconsumo Edizioni) were already recorded; the expanded inspection programme suggests the Garante intends to sustain, rather than taper, its practical enforcement tempo through the remainder of 2026, with AI systems and public-sector/commercial-marketing practices as the named sectoral targets.

Outlook

Operators in the named sectors, particularly municipalities, local health authorities, and providers of geomarketing, neuromarketing, or dynamic-pricing technology serving Italian consumers, should treat the August-December 2026 window as a period of elevated inspection risk. The DPO-supplier relationship focus also suggests that outsourced data-protection-officer arrangements will receive specific scrutiny during this period. No further detail on the specific inspection criteria or expected enforcement outcomes was available in the sources reviewed this cycle.

Sectoral Watch

Italy's telecoms and e-privacy sectoral overlay was confirmed applicable to a new use case this cycle: Codice Privacy Article 130(1) requires opt-in consent for automated calling systems, and this requirement is confirmed to extend to AI voice agents specifically. An opt-out mechanism such as the Registro delle Opposizioni (RPO) list is explicitly insufficient to satisfy this opt-in requirement, an Assessed-confidence finding sourced from the Garante's own Tier-1 guidance on artificial intelligence.

This finding is significant because it closes a potential ambiguity as automated calling technology increasingly incorporates generative AI voice capabilities: the existing sectoral telecoms consent standard, rather than being displaced or superseded by AI-specific rules, is confirmed to continue applying in full to AI-driven calling systems. Businesses deploying AI voice agents for outbound calling in Italy therefore cannot rely on opt-out registration alone and must secure affirmative opt-in consent under the existing Article 130(1) standard.

Outlook

Watch for whether the Garante issues further sector-specific guidance applying existing telecoms and e-privacy standards to other AI-driven communication channels, and for any enforcement action testing compliance with the opt-in standard specifically in the context of AI voice agents.