Lighter Privacy Obligations for Italian Companies

• COMPANIES’ PERSONAL DATA: Italy was one of the very few EU countries extending the applicability of privacy laws also to personal data of companies. This decree has not clarified that companies’ data are not deemed to be “personal data” for the purposes of the Italian Privacy Code if processed for standard administrative and accounting purposes i.e. if processed for other purposes they will still fall under the umbrella of Italian privacy laws;
• INFRAGROUP TRANSFERS OF PERSONAL DATA: infragroup transfers of personal data have always been a major issue for groups with (in some cases) limited privacy risks and for this reason the decree prescrived that personal data of individuals which are processed for standard administrative and accounting purposes (with the exclusion of, for instance, marketing or profiling purposes) can be transferred by legal entities and associations to their holding, controlled or affiliate companies without the need of the prior consent of the relevant data subjects but under the condition that the latter are provided with a privacy information notice;
• SECURITY MEASURES: Italian privacy law requires companies to have in place a very detailed Data Security Document (the so called “Documento Programmatico sulla Sicurezza”) which needs to comply with specific requirements and has to be updated on a yearly basis. This obligation will no longer apply to entities processing either only non-sensitive data or sensitive data or judicial data relating only to their employees and consultants. In such case this obligation has been replaced by the obligation for the data controller to issue a self-declaration of the compliance with security measures.

Do you want to discuss the above? Feel free to contact me Giulio Coraggio.