--- title: "Italy — Sectoral Watch | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/italy/sectoral-watch/ source_html: /jurisdictions/italy/sectoral-watch/index.html description: "Italy — Sectoral Watch: sectoral_watch Sectoral Watch 7 sub-modules 7 claims Amber ▾ # Sectoral overlays are well documented and enforced, but employment/telecoms marketing overlays show recurrent, material n" generated_at: 2026-10-25T04:46:50Z content_sha256: 347c945847633d23ba5c2d85055178f36bc5ba835ab7f4707b199815ec3f6f35 generator: "fe-fleet/md-twin@1.0" --- # Italy — Sectoral Watch | Data Protection Monitor ### D6Sectoral Watch7 sub-modules7 claimsAmber▾# Sectoral overlays are well documented and enforced, but employment/telecoms marketing overlays show recurrent, material non-compliance. Primary framework GDPR + Codice Privacy sectoral provisions (Artt.114, 122, 130) + Statuto dei Lavoratori (L.300/1970) + AI Act national implementing decree Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Sectoral overlays are well documented and enforced, but employment/telecoms marketing overlays show recurrent, material non-compliance. #### Sub-modules (7) #### Financial Sector OverlayGreen The Garante issues opinions to the Bank of Italy on personal-data processing in banking-complaint ('esposti') management, illustrating a financial-sector consultative overlay. Claims (1): - The Garante issued an opinion to the Bank of Italy on a draft regulation concerning personal-data processing in the management of banking complaints ('esposti'), illustrating its consultative role in the financial sector. #### Health Sector OverlayAmber Health-sector data processing (hospitals, telemedicine platforms, health registries) is a recurrent enforcement and guidance focus of the Garante. Claims (1): - The Garante's 2026 newsletter cycle reports continued sanctioning and guidance activity in the health sector, including a hospital-operator sanction and telemedicine-platform guidance. #### Telecoms And EprivacyAmber ePrivacy/telecoms overlay operates through Art.122 Codice cookie rules and Art.130 Codice / L.5-2018 telemarketing rules enforced via the Registro Pubblico delle Opposizioni, with fines up to EUR 20M or 4% of global turnover for opposition-right violations. Claims (1): - Violation of the opposition right under the Registro Pubblico delle Opposizioni regime (L.5/2018) attracts sanctions under GDPR Art.83(5), reaching up to EUR 20 million or 4% of total worldwide annual turnover of the preceding year, if higher. #### Employment DataAmber Employment-sector overlay (Art.4 L.300/1970, referenced by Art.114 Codice) constrains remote-monitoring technologies; the Garante ordered Amazon to stop record-keeping of workers' personal data including health, union activity and personal-life information. Claims (1): - The Garante ordered Amazon to stop record-keeping of workers' personal data, having found the company collected information on illnesses, union activity, and workers' personal and family lives. #### Credit And ScoringGreen The Garante confirmed a data subject's right to know the credit/energy score underlying a denied contract. Claims (1): - The Garante confirmed a data subject's right to be informed of the score underlying a denied energy-supply contract, as reported in the Authority's 2026 press releases. #### EducationGreen The Garante has issued favourable opinions on AI-based educational platforms and guidelines for AI introduction in schools, subject to conditions. Claims (1): - The Garante issued a favourable opinion on a Ministry of Education AI-based digital platform and accompanying guidelines for introducing AI in schools, subject to compliance observations. #### InsuranceGreen The AI Act national implementing decree introduces specific rules for the insurance sector alongside the financial sector. Claims (1): - Italy's AI Act national implementing decree introduces specific rules for the financial and insurance sectors alongside broader AI governance provisions. Category narrative 79 words Sector overlays include: healthcare (frequent Garante sanctions and guidance on health data and telemedicine); telecoms/eprivacy (Art.122 Codice cookie rules, Registro Pubblico delle Opposizioni for telemarketing); employment (Art.4 Statuto dei Lavoratori/L.300-1970 constraints on remote-control technologies referenced via Art.114 Codice, e.g. the Amazon worker-monitoring order); credit/scoring (2026 Garante position affirming a right to know the score underlying a denied energy contract); education (favourable Garante opinions on AI-based educational platforms); insurance (the 2026 AI Act implementing decree introduces sector rules for insurance). Periodic update · new data 2026-10-18 #### Sectoral Watch Under Article 29 of the EU Data Act, Regulation (EU) 2023/2854, charges for switching between cloud and data-processing services are capped at the provider's direct switching costs until 12 January 2027. From that date, such switching charges are prohibited outright. This is a directly applicable EU regulation, meaning it takes effect in Italy without requiring a separate national transposition statute, though Member States may still need to designate a national competent authority or data coordinator for enforcement purposes. Italy's national competent authority or data coordinator for the Data Act has not been confirmed as designated as of this cycle, and no Italy-specific implementing instrument has been identified. This provision is relevant to any cloud or data-processing service provider operating in or serving the Italian market, and to businesses relying on such services who may currently face switching costs that will become entirely prohibited from January 2027. The absence of a confirmed Italian national competent authority designation is itself a notable gap: enforcement mechanics for Italian customers of cloud-switching arrangements remain unclear pending that designation. #### Outlook The key date to track is 12 January 2027, when the switching-cost prohibition takes full effect across the EU including Italy. Separately, and arguably more immediately relevant for Italian market participants, is whether Italy designates a national competent authority or data coordinator for Data Act enforcement before that date; the absence of such a designation as of this cycle leaves an open question about which Italian authority, if any, will be responsible for enforcing the switching-cost prohibition domestically. 3 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Sectoral Watch The Garante issued two sectoral developments on 1 October 2026. First, it republished an updated edition of its practical guide, 'Privacy e recupero crediti', addressed to banks, finance companies, phone and energy companies engaged in debt-recovery activity. This is a routine guidance republication rather than a substantive rule change, but it signals continued regulatory attention to the debt-collection sector's data-protection practices across multiple industries. Second, and more substantively, the Garante expressed a favourable opinion, with observations, on the draft legislative decree transposing EU Directive 2024/2831 on platform work into Italian law. The Garante's observations specifically asked for greater attention to rider privacy in the transposition, a sector-specific concern given the extent of location, performance and activity-monitoring data typically generated by platform-based delivery and ride-hailing work. The opinion was favourable overall but conditioned on these observations being addressed as the decree proceeds, a posture consistent with the Garante's established practice of engaging with government transposition drafts ahead of their final adoption rather than only after the fact. #### Outlook The transposition decree for the EU Platform Work Directive is the clearer marker to watch here: whether the final adopted text incorporates the Garante's rider-privacy observations, and how the debt-recovery guidance republication is received across the banking, finance, telecommunications and energy sectors it addresses, are both worth tracking as this decree moves through the legislative process. Periodic update · new data 2026-09-28 #### Sectoral Watch The Garante's inspection plan for the second half of 2026 identifies at least 35 inspections to be conducted between August and December. The plan marks a deliberate shift in sectoral focus: AI-system checks, which had previously concentrated on the education sector and schools specifically, are being redirected toward municipalities, local health authorities (ASL), geomarketing, neuromarketing, dynamic pricing, and DPO-supplier relationships. This redirection signals that the Garante's sectoral enforcement priorities for the remainder of 2026 are moving away from education-sector AI deployments and toward public-administration bodies and commercial pricing/marketing-technology practices that involve algorithmic processing of consumer or citizen data. The inclusion of municipalities and local health authorities as inspection targets is notable because it extends the Garante's practical sectoral attention into public-sector bodies that increasingly deploy AI-assisted systems for service delivery and resource allocation, sectors that had not previously been named as a discrete inspection priority. Similarly, the explicit naming of geomarketing, neuromarketing and dynamic pricing as inspection targets reflects a sectoral focus on commercial practices that use behavioural or location data to shape consumer-facing pricing or marketing decisions, an area where AI-driven personalisation techniques raise the kind of profiling and transparency questions the Garante has flagged in other contexts this cycle. This sectoral shift should be read alongside the broader enforcement-and-redress picture for the cycle, in which two concrete sanctions (Poste Italiane/PostePay and Altroconsumo Edizioni) were already recorded; the expanded inspection programme suggests the Garante intends to sustain, rather than taper, its practical enforcement tempo through the remainder of 2026, with AI systems and public-sector/commercial-marketing practices as the named sectoral targets. #### Outlook Operators in the named sectors, particularly municipalities, local health authorities, and providers of geomarketing, neuromarketing, or dynamic-pricing technology serving Italian consumers, should treat the August-December 2026 window as a period of elevated inspection risk. The DPO-supplier relationship focus also suggests that outsourced data-protection-officer arrangements will receive specific scrutiny during this period. No further detail on the specific inspection criteria or expected enforcement outcomes was available in the sources reviewed this cycle. Periodic update · new data 2026-09-21 #### Sectoral Watch Italy's telecoms and e-privacy sectoral overlay was confirmed applicable to a new use case this cycle: Codice Privacy Article 130(1) requires opt-in consent for automated calling systems, and this requirement is confirmed to extend to AI voice agents specifically. An opt-out mechanism such as the Registro delle Opposizioni (RPO) list is explicitly insufficient to satisfy this opt-in requirement, an Assessed-confidence finding sourced from the Garante's own Tier-1 guidance on artificial intelligence. This finding is significant because it closes a potential ambiguity as automated calling technology increasingly incorporates generative AI voice capabilities: the existing sectoral telecoms consent standard, rather than being displaced or superseded by AI-specific rules, is confirmed to continue applying in full to AI-driven calling systems. Businesses deploying AI voice agents for outbound calling in Italy therefore cannot rely on opt-out registration alone and must secure affirmative opt-in consent under the existing Article 130(1) standard. #### Outlook Watch for whether the Garante issues further sector-specific guidance applying existing telecoms and e-privacy standards to other AI-driven communication channels, and for any enforcement action testing compliance with the opt-in standard specifically in the context of AI voice agents. Evidence 7 Sources and claims (7) - Probableunavailable — The Garante issued an opinion to the Bank of Italy on a draft regulation concerning personal-data processing in the management of banking complaints ('esposti'), illustrating its consultative role in the financial sector. - Probable[Garante Privacy](https://www.garanteprivacy.it/home/-/asset_publisher/4e4H/rss) — The Garante's 2026 newsletter cycle reports continued sanctioning and guidance activity in the health sector, including a hospital-operator sanction and telemedicine-platform guidance.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/temi/telemarketing) — Violation of the opposition right under the Registro Pubblico delle Opposizioni regime (L.5/2018) attracts sanctions under GDPR Art.83(5), reaching up to EUR 20 million or 4% of total worldwide annual turnover of the preceding year, if higher.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/-/asset_publisher/4e4H/rss) — The Garante ordered Amazon to stop record-keeping of workers' personal data, having found the company collected information on illnesses, union activity, and workers' personal and family lives.observed 2026-08-03 - Probable[Garante Privacy](https://www.garanteprivacy.it/home/-/asset_publisher/4e4H/rss) — The Garante confirmed a data subject's right to be informed of the score underlying a denied energy-supply contract, as reported in the Authority's 2026 press releases.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10162698) — The Garante issued a favourable opinion on a Ministry of Education AI-based digital platform and accompanying guidelines for introducing AI in schools, subject to compliance observations.observed 2026-08-03 - Probable[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10275843) — Italy's AI Act national implementing decree introduces specific rules for the financial and insurance sectors alongside broader AI governance provisions.observed 2026-08-03