Italy has offically transposed the provisions of the EU regulation no. 679/2016

​published on October 16, 2018 / reading time approx.: 1 minutes

Italy, with the Legislative Decree no. 101 of 10 August 2018, published in the Official Journal on 4 September, has officially transposed the provisions of the EU Regulation no. 679/2016 (better known as “GDPR”): the new rules for data processing will enter into force on the 19 September 2

018.

The main amendments affect the consent expressed by minors for processing carried out in the context of the information society that is lowered to fourteen years, the adoption of security measures for the protection of health data such as encryption and pseudonymization techniques, the possibility of using biometric data for physical and logical access to data by authorized subjects and the promotion of simplified methods of fulfilling the obligations in the field of data protection for micro, small and medium-sized enterprises.

The Codes of Conduct (excluding those concerning information services and processing of data for marketing purposes for which a different approval procedure is provided) and the general authorizations from the Data Protection Authority, relating to specific processing operations identified by the Legislative Authority, will apply only for a transitional period of ninety days from the entry into force of the Decree, whilst the provisions adopted by the Data Protection Authority remain in force insofar as they are compliant with both the Regulation and the new Decree.

Lastly, the offences of unlawful communication and disclosure of personal data subject to a largescale processing and fraudulent acquisition of personal data subject to processing on a large scale are introduced.