Privacy vs. freedom of the press: 3 Italian cases you need to know about

2026 kicked off with three significant decisions by Italian authorities that shed light on where journalism ends and privacy begins. Here’s what you need to know. The common thread?Private information can only be shared when there’s a genuine public interest at stake.

SANGIULIANO CASE. On January 22, 2026, the Court of Rome threw out a Euro 150,000 fine that the Italian Data Protection Authority had slapped on public broadcaster RAI. The offense? Airing a private phone call between former Culture Minister Sangiuliano and his wife on the investigative show “Report”. The call touched on the Minister’s alleged affair and his wife’s demand to revoke institutional appointments supposedly given to the other woman.

The Court’s verdict? The broadcast served a legitimate public interest. Yes, the content was personal, but it raised serious questions about whether top government appointments were being handed out based on personal relationships rather than merit. In the Court’s own words, the conversations touched upon “a topic which is certainly of public interest, relating to the possibility that the assignment of high institutional positions may be influenced by matters of a purely personal nature”.

SIGNORINI CASE. Just four days later, on January 26, 2026, the Court of Milan took swift action against Mr. Corona, ordering the immediate takedown of all defamatory content he had posted about Mr. Signorini on his podcast “Falsissimo“. This included private conversations, intimate photos, and sexually explicit material. The Court also prohibited any further dissemination.

The Court expressly excluded the applicability of the right to privacy under Article 21 of the Italian Constitution, finding that no public interest existed that was capable of justifying such a serious intrusion into personal privacy. It emphasized that the disseminated material concerned exclusively Mr. Signorini’s sexual preferences and habits, which, in themselves, do not constitute matters of public concern. Moreover, the Court did not find sufficient evidence supporting Mr. Corona’s claim that the disclosures revealed a system of sexual blackmail within the entertainment industry. Lastly, the Court noted that Mr. Corona is not a journalist and therefore cannot benefit from the constitutional safeguards afforded to the press.

GARLASCO CASE. On January 30, 2026, the Italian Data Protection Authority issued a formal measure addressed to journalists, warning against the disclosure of names and personal details in media reconstructions of the Garlasco case that go beyond what is strictly necessary for informational purposes. The Authority noted that the level of detail in some articles and TV coverage was turning legitimate news into a “morbid spectacle.” This kind of reporting, they warned, violates the principle of essentiality of information and breaches both data protection laws and journalistic ethics.

Despite their different facts, all three decisions reaffirm a core principle of Italian case law: privacy is constitutionally protected, but it’s not absolute. Courts must always balance it against other fundamental rights, especially press freedom.

The bottom line? Sharing private information is only acceptable when there’s a concrete and legitimate public interest.

A More Volatile World: The Digital Omnibus

On November 19, 2025, the European Commission unveiled a landmark proposal: the Digital Omnibus Regulation. This initiative is not just another legislative tweak – it signals a philosophical shift in how Europe approaches digital regulation. In a world increasingly defined by volatility, complexity, and rapid technological change, the Commission seems to be saying: “We’ve heard you – let’s regulate, but let’s make it easier to comply.”

Why Now? The Context Behind the ‘Digital Omnibus’

The proposal comes against a backdrop of mounting pressure on Europe’s competitiveness. In his now-famous “Please, do something” speech to the European Parliament, Mario Draghi urged EU institutions to act decisively to restore Europe’s ability to innovate and compete globally. Could the Digital Omnibus be seen as a response to this heartfelt appeal?

For years, the EU has been a global pioneer in digital regulation – think GDPR, AI Act, Data Act, Digital Services Act (DSA), Digital Markets Act (DMA), NIS2, and more. But this success has come at a cost: fragmentation, complexity, and heavy compliance burdens. Businesses have struggled to navigate overlapping obligations. The Digital Omnibus is designed to change that. In the “explanatory memorandum” to the Digital Omnibus, the Commission emblematically acknowledges, for instance, that “some entities, especially smaller companies and associations with a low number of non-intensive, often low-risk data processing operations, expressed concerns regarding the application of some obligations of the GDPR”.

The ‘Digital Omnibus’ Proposal

The proposal introduces technical amendments and structural simplifications across a wide range of legislation, including:

  • General Data Protection Regulation (GDPR)
  • AI Act
  • Data Act
  • ePrivacy Directive
  • NIS2 Directive
  • Data Governance Act
  • Free Flow of Non-Personal Data Regulation
  • Platform-to-Business (P2B) Regulation (to be repealed

Key Highlights

  • GDPR Simplification:
    • Clarifies the definition of personal data
    • Supports controllers with respect to the criteria and means to determine whether data resulting from pseudonymization does not constitute personal data
    • Introduces flexibility for AI development: processing personal data for AI training under “legitimate interest,” with safeguards.
    • Modernizes cookie consent rules – centralized browser settings to end “cookie fatigue.”
  • AI Act Adjustments:
    • Expands regulatory sandboxes and simplifies compliance for SMEs and mid-cap companies.
    • Clarifies the interplay between the AI Act and other EU legislation
    • Introduces an obligation on the Commission and Member States to foster AI literacy
  • Incident Reporting:
    • Creates a single-entry point for incident notifications under GDPR, NIS2, DORA, and CER – ending duplicative reporting.

A New Philosophy?

There are strong indications that the “Digital Omnibus” is more than a mere technical adjustment and may represents a strategic shift in EU “digital law”. The proposals will now proceed to the European Parliament and the Council for deliberation. It remains to be seen whether words will be turned into action.

Italy’s New AI Law: A Boost for Healthcare Research?


Italy has recently enacted its own “Artificial Intelligence Act”, set to take effect on October 10, 2025.

You might be wondering: Did we really need another layer of AI regulation? That was our initial reaction, too. But a closer look reveals that the Italian AI Law introduces several interesting provisions, especially in the healthcare sector, that could facilitate research for both public and private entities. Here are some highlights:

1. Healthcare Data Processing as Based on Public Interest

The law explicitly recognizes that the processing of health-related personal data by:

  • Public or private non-profit entities,
  • Research hospitals (IRCCS),
  • Private entities collaborating with the above for healthcare research,

is of “substantial public interest.” This significantly expands the scope of Article 9(2)(g) of the GDPR, offering a clearer legal basis for processing sensitive data in research contexts.

2. Secondary Use of Data

The law introduces a simplified regime for the secondary use of personal data without direct identifiers. In particular:

  • No new consent required, as long as data subjects are informed (even via a website).
  • Automatic authorization unless blocked by the Data Protection Authority within 30 days of notification.

This provision applies only to the entities mentioned above so it is limited in scope, but in any case significantly strengthens the framework for nonprofit research projects.

3. Freedom to Anonymize, Pseudonymize and Synthesize

Under Article 8(4) of the AI Law, processing data for anonymization, pseudonymization, or synthesization is always permitted, provided the data subject is informed. This is a major step forward in enabling privacy-preserving AI research.

4. Guidelines and Governance

The law delegates the creation of technical guidelines to:

  • AGENAS – for anonymization and synthetic data generation.
  • Ministry of Health – for processing health data in research, including AI applications.

It also establishes a national AI platform at AGENAS, which will act as the data controller for personal data collected and generated within the platform.


Final Thoughts

While the GDPR aimed to support research, its implementation often created legal uncertainty and operational hurdles. Italy’s AI Law appears to address some of these gaps, offering a more pragmatic and enabling framework for healthcare research.

European Biotech Week 2025 Webinars

We hope you had a refreshing and inspiring summer! Hopefully you are fully recharged and ready to dive into the webinars we’ve organized for the European Biotech Week 2025 — a week dedicated to showcasing the power of biotech in improving lives, driving innovation, and shaping a sustainable future.

Curious about the interaction between the AI Act and the Medical Device Regulation? Join us and life sciences experts of the Alliance of European Life Sciences Law Firms for a lively discussion on September 30 (in English) https://www.linkedin.com/feed/update/urn:li:activity:7371220934059450368

Interested to hear how scientists view “biosolutions” and their impact on the future? https://www.womentech.eu/eventi/il-futuro-del-biotech-scienza-per-le-generazioni-che-verranno/ on October 1 is the place to be. This will be a fascinating 360-degree review (in Italian) of what biotech can achieve, and about obstacles to the adoption of biotech scientific solutions. Professors Gardossi and Abbracchio, along with biotech entrepreneur Elena Sgaravatti, will enlighten us.

Focused on life sciences legislation and worried that you may have missed anything new? Head to the hybrid event at our offices (Via Dante 9 – Milan) or online held by our team on October 2 (in Italian) that will tackle the pharma reform, shortages of pharma products, intelligent devices and a new decision on anonymized personal data: https://www.grplex.com/it/convegni/download/1537/life-sciences-tutte-le-novita-normative-del-2025

Hope to see you there!

WHAT’S NEW IN THE UPDATED GUIDELINES ON MEDICAL DEVICE ADVERTISING?

The Italian Ministry of Health has published new guidelines on advertising of medical devices (“Guidelines”), which replace all previous guidelines issued by the Ministry over the years.

  • WHAT’S NEW?
  • Advertising aimed at healthcare professionals

When advertising is directed at HCPs, the following requirements must be met:

  • A disclaimer must be included stating that the content is intended exclusively for HCPs; but also
  • a “pop-up” message and/or similar technologies must be implemented to require users to confirm that they are HCPs before accessing the advertising content.
  • Content of the advertising message

Each advertising message must include the following wording: “It is a CE medical device (including the notified body number, if applicable). Read the warnings or instructions for use carefully. Ministerial Authorization of dd/mm/yyyyy”.

  • Expanding use of social networks – including TikTok

The list of approved social networks for medical devices advertising now includes TikTok. However, the following features must be disabled:

  1. Comment function;
  2. Duet function (which allows the user to post his/her video side-by-side with a video from another creator);
  3. Stitch function (which allows a user to crop and integrate scenes from another user’s video into his/her own video).
  • ANY ADVANTAGES FOR COMPANIES?
  • Simplified compliance. Companies now benefit from a single, consolidated regulatory framework gathering all the regulations concerning medical devices’ advertising.
  • Broader digital scope. The inclusion of platforms like TikTok increases the scope of digital channels where advertisement of medical devices is regulated. Regrettably, rules on LinkedIn are lacking.
  • Other marketing channels. The Ministry of Health may admit the use of additional social networks (beyond Facebook, Instagram, YouTube, and TikTok), subject to prior authorization.

Bottom line: a consolidated document is certainly helpful, but we do not understand the choice not to regulate LinkedIn, the channel where the boundary between corporate communication and advertisement of medical devices is more problematic.

What if hospitals don’t pay?

Many of our clients encounter challenging dilemmas when public hospitals fail to reimburse the supplies they provide. Our seminar, held yesterday in our auditorium, was designed to discuss risks and potential solutions.

We regret if you were unable to attend, particularly as it was followed by an enjoyable aperitivo. However, we have included the slides presented by our attorneys, Fabrizio Sardella, Damiano Pallottino, and Francesco Clerici, who offered an analysis of the topic from a criminal, administrative, and civil law perspective.

NIS2: new guidance for companies

On April 14, 2025, the National Cybersecurity Agency (“NCA”) published measure no. 164179 (“Measure”) to further implement the decree 138 of 2024 (“NIS2 Decree”).

  • What’s new?

With this Measure, the NCA has identified:

  • Security measures that companies must guarantee in case they are identified as an important subject (annex 1) or an essential subject (annex 2);
  • Types of significant incidents that companies must report, depending on whether they are classified as an important (annex 3) or essential subject (annex 4).
  • Since when?

The Measure will enter into force on 30 April 2025. However, companies will have:

  • 18 months from the communication of their inclusion on the NIS subject list to comply with these new security measures;
  • 9 months from the communication of inclusion on the NIS subject list to activate mechanisms to ensure the notification of incidents identified as significant.
  • As a company, what do you have to do now?
  • Wait for the NCA’s communication to verify if your company has been included in the NIS list;
  • In case of a positive answer, your company will be required to provide further information (such as member states where the service is carried out; name and contact details of a substitute for the point of contact) by May 31, 2025;
  • Implement, within 9 months from the communication of the inclusion on the NIS subject list, mechanisms for the notification of incidents expressly identified by NCA as “significant incidents”;
  • Implement, within 18 months from the communication of the inclusion on the NIS subject list, the security measures expressly identified by the NCA.

Understanding EDS: The Health Data Ecosystem Explained

On March 5, 2025 the Ministry of Health’s decree on “EDS” was finally published. What is EDS and why is it important for life sciences companies?

“EDS” stands for “ECOSISTEMA DATI SANITARI” (health data eco system), a system regarding health data that will be active by March 31, 2026. The new ministerial decree clarifies the architecture of EDS, its content and its necessary safety measures.

EDS will be populated with data deriving from the electronic health record (fascicolo sanitario elettronico). With regard to processing for cure, prevention and international prophylaxis purposes, personal health data will be processed on the basis of consent and subject to information to the patient. Only in case of emergency access to EDS will be temporarily possible to healthcare providers even in the absence of consent.

Anonymized health data included in EDS will be available for the purpose of study and scientific research in the medical, biomedical and epidemiological field.

What’s new? Private and public entities with an institutional research mission may request an extraction of anonymized data by submitting a description of the scientific research they intend to carry out that complies with data protection recommendations. Agenas will evaluate data requests and grant access to the anonymized data.