On 8 August, a final version of the draft related to the Law Decree “standardising” the Privacy Code (Legislative Decree 196/03) with the European Regulation 679/2016 on the matter of personal data protection (GDPR) has been approved. More specifically, the Decree establishes that the rights of the interested party may be limited or excluded whenever they are in contrast with the needs established by the laws of the State, as in the case of anti-money laundering or whistleblowing. The Decree establishes some specific offences that would not fall under the ne bis in idem principle and would thus be established and penalised according to our regulations. Among others, these are: (i) unlawful processing of the data; (ii) the unlawful disclosure and dissemination of the data undergoing large scale processing; (iii) the fraudulent acquisition of personal data undergoing large scale processing; (iv) the breach of provisions governing remote supervision and employee’s opinion surveys. The draft includes, in addition, that the pending proceedings before the Data Protection Authority not closed at 25 May 2018, may be closed with the payment of two fifths of the minimum penalty within 60 days from the date in which the Decree enters into effect. Instead, concerning future disputes, the offender and the obligated party together may settle the dispute by accepting the ruling of the Data Protection Authority (if issued) and by paying an amount equal to half of the penalty ordered. In addition, the new draft lowers to 14 years old the age when a minor can provide his/her direct consent for activities on social networks or similar platforms (including for marketing and profiling purposes). Last but not least, is the fact that in the first eight months the Data Protection Authority shall keep into account, in order to apply the administrative fines and within the limitations compatible with the GDPR, the application difficulties that will occur in the first months. In the next few weeks the publication is expected on the Official Gazette: the entry into force of the Decree is expected to match the day of the publication.
