How to Handle DATABASES in M&A Transactions

Legal news

Mergers and acquisitions (M&A) inevitably involve the transfer of valuable corporate assets—and among the most sensitive of these are databases containing personal data. Whether these datasets relate to healthcare professionals, employees, customers, suppliers, or business partners, their transfer raises questions under data protection law.

What is the role of consent in data transfers during M&A? What are the data protection obligations when data changes hands?

1. Consent in M&A: Is It Always Necessary?

A common concern in M&A transactions is whether companies must obtain fresh consent from data subjects when personal data is transferred to the acquiring entity. In many cases under Italian and EU law, the answer is no, thanks to the principle of continuity of processing.

The Italian Data Protection Authority (the Garante per la protezione dei dati personali) has clarified this position in several decisions, including Decision No. 97/2015. According to the Garante, when an M&A transaction involves a transfer of a business or business unit, the applicable provisions of the Italian Civil Code—specifically Articles 2558, 2559, 2560, and 2112—establish a legal succession framework.

Under this framework:

  • The acquiring company automatically steps into the legal position of the seller.
  • All contractual relationships, rights, and obligations transfer seamlessly.
  • This includes data processing activities connected to those relationships.

As a result, the transfer of personal data does not require new consent, provided that:

  • The data continues to be used for the same purposes for which it was originally collected.
  • The processing remains within the expectations of the data subjects.

This principle reflects a pragmatic balance between business continuity and data protection, avoiding unnecessary disruption to commercial operations.

2. Privacy Notice Obligations: the Role of Article 14 GDPR

Even when consent is not required, the GDPR imposes strict transparency obligations.

When personal data is not collected directly from the data subject—as is typically the case in M&A transactions—the acquiring company must provide a privacy notice pursuant to Article 14 GDPR.

This obligation has been reinforced by the Garante in Decision No. 285/2022 and earlier guidance, including the 2009 guidelines on mergers and demergers.

3. How to Provide a Privacy Notice: Simplified Approaches

Given the potentially large number of individuals involved, providing individual notices can be challenging. Fortunately, the Garante has recognized simplified methods of compliance, including:

  • Publication of the privacy notice on the websites of both the transferring and acquiring companies.
  • Deferred individual communication, such as sending an email at the first available opportunity.

These approaches, confirmed in Decisions No. 664/2015 and No. 97/2015, strike a balance between practicality and transparency, especially in large-scale transactions.

4. Key Takeaways for M&A Practitioners

To ensure compliance when transferring databases in an M&A context, companies should:

·         Rely on the principle of continuity of processing, where applicable. This avoids unnecessary consent collection if legal succession applies.

·         Provide Article 14 GDPR privacy notices to affected individuals. Simplified communication methods when dealing with large datasets can be used.

Text and Data Mining, Copyright and M&A: Legal Risks in Acquiring AI Companies

Legal news, , , , , ,

Every time an AI model generates a text, an image or a melody, a powerful process has taken place behind the scenes: Text and Data Mining (“TDM“), any automated technique aimed at analysing large quantities of texts, sounds, images, data or metadata in digital format to generate information. Billions of web pages, photographs and musical works are ingested by algorithms, often without the authors’ knowledge. As AI companies become attractive acquisition targets, understanding the copyright risks in their training practices is essential for M&A practitioners. This article examines the Italian legal framework governing AI and copyright, from the TDM exceptions under the copyright act to the EU AI Act, and their M&A implications.

1. Regulatory Framework. Directive (EU) 2019/790 on copyright in the Digital Single Market Directive (“DSM“) was transposed into Italian law by Legislative Decree No. 177/2021, which amended Law No. 633/1941 (the “Italian Copyright Law“) by introducing two key TDM provisions: Articles 70-ter and 70-quater.

2. The TDM Exceptions. The two TDM provisions transposed into the Italian Copyright Act establish distinct regimes, each with its own scope, conditions and limitations. The distinction is critical in M&A, as it determines whether a target’s data acquisition practices are lawful and, consequently, the transaction’s risk profile:

2.1. Art. 70-ter LDA: TDM for Scientific Research (Art. 3 DSM). Art. 70-ter introduces a mandatory, non-derogable exception allowing research organisations and cultural heritage institutions to reproduce works or materials to which they have lawful access, for text and data extraction for scientific research. Copies must be stored securely and retained only for research purposes, including verification of results. Rightholders may apply proportionate security measures. Conflicting contractual terms are null and void.

2.2. Art. 70-quater LDA: TDM for Any Purpose (Art. 4 DSM). Art. 70-quater permits reproductions and extractions from works or materials to which the user has lawful access, for TDM purposes without limitation as to identity or purpose, including commercial use. However, TDM is only permitted where the use has not been expressly reserved by the relevant rightholders. Copies may only be retained as long as necessary for the TDM process, with security levels no lower than those under Art. 70-ter. This opt-out mechanism raises several concerns: (i) whether an opt-out can be enforced retroactively against prior scraping; (ii) whether rightholders may reserve only certain works or must cover their entire online corpus; (iii) the technical reliability of machine-readable reservations (robots.txt, metadata); and (iv) the unclear regime for works from physical archives or offline databases. Each open question may give rise to contingent liabilities for M&A investors.

These two TDM exceptions are particularly relevant to generative AI, as training such models typically involves mass reproduction of protected works. Art. 70-ter applies to research organisations for scientific purposes, with no opt-out. For commercial entities, Art. 70-quater applies only if rightholders have not expressly reserved their content. In M&A, identifying the applicable regime is a key question in IP due diligence.

3. AI-Generated Output and Copyright. Neither the DSM Directive nor its Italian transposition addresses the copyrightability of AI-generated output. Art. 1 of the Italian Copyright Act requires human creativity for protection; the prevailing view is that purely AI-generated works are not eligible for copyright, while the status of “AI-assisted works” remains debated. This uncertainty bears directly on M&A valuation: if a target’s core IP consists largely of AI-generated content, the enforceability and value of those assets may be materially lower than assumed.

4. Compliance with the EU AI Act. The EU AI Act (Regulation (EU) 2024/1689) requires providers of general-purpose AI models to publish a summary of training data used, including categories and sources, with particular regard to TDM compliance and any opt-out by rightholders (Art. 53(1)(d)). For M&A investors, non-compliance may expose the target to sanctions, while the required disclosures may reveal underlying IP vulnerabilities.

5. Implications on M&A Deals. The foregoing reflections raise a few red flags when a target develops or deploys AI systems. The lawfulness of the target’s data acquisition and training practices (including compliance with Articles 70-ter and 70-quater of the Italian Copyright Law, opt-out reservations, and the origin of training datasets. Equally, M&A investors should assess the enforceability of IP rights over AI-generated or AI-assisted output, given that purely AI-generated works are unlikely to qualify for copyright under the Italian Copyright Law. Overvaluation of such assets may result in a misalignment between the purchase price and the rights actually acquired. Representations, warranties and indemnities covering TDM compliance, IP ownership and AI Act obligations certainly help, but a rigorous IP due diligence remains essential to identifying risks.

Italy Moves to Regulate AI: New Rules on Civil and Criminal Liability

Legal news, , , , , , , , , ,

On 10 June 2026, the Italian Council of Ministers approved, in preliminary examination, two draft legislative decrees implementing Law No. 132/2025 and aligning the national framework with Regulation (EU) 2024/1689 (“AI Act”).

This is not the first legislative step taken by the Italian Government on AI. The two decrees follow Bill No. 1146/2024, which later became Law No. 132/2025 and set out the general national framework in the field of artificial intelligence.

The texts are not final yet: they will still be reviewed by the parliamentary committees, the State-Regions Conference and the competent authorities, including the Italian Data Protection Authority. Still, the direction is already clear. For businesses developing, placing on the market or deploying high-risk AI systems, the most relevant developments concern civil, criminal and corporate liability.

Two Decrees, in Brief

The first decree focuses on AI literacy, education and training, as well as on the national competent authorities. It regulates AI in school, university, professional and public administration training, and confirms the prohibition on purely automated decisions concerning hiring, dismissal, changes to the employment relationship and disciplinary sanctions. On governance, the framework is built around AgID, as notifying authority, and ACN, as market surveillance authority and single point of contact with the EU.

The second decree deals with more sensitive uses of AI, including policing, protection of injured parties and liability for high-risk systems. Its approach is to allow AI as a supporting tool, but within a perimeter based on human control, proportionality, traceability and protection of fundamental rights. This post focuses on its civil, criminal and corporate liability provisions.

Civil Liability: Levelling the Playing Field

The second decree strengthens the position of individuals harmed by an AI system. The main issue is informational asymmetry: a claimant will often be unable to reconstruct how the system worked or to prove the causal link between the AI output and the damage suffered.

The proposed response is mainly procedural. It includes access to the system’s technical documentation, a presumption of causation, an alternative venue close to the injured individual’s residence, and the possibility of acting directly against the insurer. Rather than introducing a broad new set of substantive obligations for businesses, the decree appears aimed at making compensation claims more effective, while leaving existing rules on data protection and product liability in place.

Criminal Liability: The New Article 437-bis

On the criminal side, the decree introduces a new Article 437-bis of the Criminal Code, concerning the failure to adopt security measures in high-risk AI systems and their unlawful alteration.

This offence does not punish the use of artificial intelligence as such. It targets human and organisational conduct that makes high-risk AI systems concretely dangerous. In particular, it covers omissions or alterations which, in the design, placing into service or use of such systems, create a concrete danger to primary interests such as life, public safety or State security.

Criminal liability is limited to the most serious cases. Not every technical error or malfunction would be criminally relevant: the conduct must be capable of generating a concrete danger. For the negligent form of the offence, gross negligence is required, which suggests an attempt to avoid over-criminalising technological innovation.

Corporate Liability Under Legislative Decree 231/2001

A further important point concerns the potential extension of liability to entities under Legislative Decree No. 231/2001. The available materials indicate that the new Article 437-bis may also have consequences under the 231 framework, so that liability would not fall only on individuals, but could also involve the organisation benefiting from the development, placing into service or use of a high-risk AI system.

This point should be verified against the final text, particularly as to whether and how Article 437-bis will be included among the predicate offences under Legislative Decree No. 231/2001. In any event, for companies operating with high-risk AI systems, the direction is significant: existing 231 models and internal protocols may need to be reviewed in light of AI-related risks.

In practice, this would mean assessing whether the organisation has adequate safeguards around system security, traceability, human oversight, risk management, incident escalation and controls across the AI lifecycle. As in other areas of 231 liability, the adequacy and effective implementation of the compliance model would be central to mitigating the entity’s exposure.

Why It Matters

The texts may still change before final approval, but the signal for companies is already clear. Businesses should start mapping where high-risk AI systems are developed or deployed, assessing whether existing compliance frameworks adequately cover AI-related risks, and strengthening documentation, oversight and risk management mechanisms.

These steps will be important not only to mitigate potential criminal and corporate liability, but also to respond effectively to civil claims arising from the use of AI systems.

Contributed by Francesco Stagno D’Alcontres

Disclosure Day: Drones in the EU – What’s Flying Above Us (and No, It’s Not Aliens)

Legal news, , , , , ,


With the recent wave of U.S. government declassifications of UFO files – officially referred to as UAPs (Unidentified Aerial Phenomena) – and a new Spielberg film tapping into our fascination with the unknown, the skies have never felt more mysterious. Yet, before looking up in wonder, a more grounded reality emerges: most of what we see overhead is far more explainable. Drones, for instance, are quietly reshaping our airspace – and the European Union has already put in place a comprehensive regulatory framework to govern them.

The Regulatory Framework: Two Regulations, One Clear Sky

Since 2019, two EU regulations have governed the production and operation of Unmanned Aircraft Systems (UAS) across all Member States, ending years of fragmented national rules.

Regulation (EU) 2019/945 – Manufacturing and Market Requirements

This regulation sets out the technical requirements for drones placed on the EU market, introducing a classification system based on maximum take-off mass (MTOM) and operational characteristics:

  1. Class C0 – under 250g; minimal requirements, no Remote ID required
  2. Class C1 – 250g to 900g; Remote ID mandatory, restrictions near populated areas
  3. Class C2 – 900g to 4kg; Remote ID, low-speed mode, geofencing capability required
  4. Class C3 / C4 – up to 25kg; reserved for “Specific” category operations
  5. Class C5 / C6 – designed for advanced operations, including drone swarms and controlled BVLOS flights

All drones must carry CE marking confirming conformity with their class requirements. From Class C1 upwards, every drone must be equipped with Remote ID, i.e. a real-time digital identification system that continuously broadcasts the drone’s unique identifier, position, altitude, speed and the operator’s location. Think of it as a number plate for the sky.

Manufacturers not established in the EU must designate an authorised representative within the Union to ensure compliance.

Regulation (EU) 2019/947 – Operational Rules for Pilots and Operators

This regulation, developed by EASA (the European Union Aviation Safety Agency), governs how drones are actually flown, organising all operations into three categories based on risk level:

Open Category – low-risk flights requiring no prior authorisation. Operations must remain within visual line of sight (VLOS), below 120 metres, and away from gatherings of people. This category is further divided into three subcategories (A1, A2, A3) depending on the drone’s class and its proximity to uninvolved persons. Subcategory A2, for instance, requires pilots to pass a theoretical examination before operating a Class C2 drone near people.

Specific Category – medium-risk operations that generally require either an authorisation from the national competent authority or compliance with a pre-defined Standard Scenario (STS). Authorisations are based on the SORA methodology (Specific Operations Risk Assessment), which helps assess the level of risk involved and determine what safety measures are needed. Two Standard Scenarios are currently available – STS-01 (visual line of sight flights in populated areas) and STS-02 (beyond visual line of sight flights in unpopulated areas). Operators meeting all the conditions of an STS can fly under a simple declaration, without needing individual authorisation.

This category is also where BVLOS operations (Beyond Visual Line of Sight) come in – flights where the drone operates beyond the pilot’s direct visual contact. BVLOS is key to unlocking use cases like long-range infrastructure inspection, medical delivery, and large-scale surveying. These flights typically require either a SORA-based authorisation or compliance with STS-02, and the drone must be equipped with detect-and-avoid capabilities to ensure safe separation from other aircraft.

Certified Category – high-risk operations equivalent in complexity to conventional aviation. Requires full EASA certification of the drone, a formal operator approval, and a licensed pilot. Reserved for operations where a system failure could have catastrophic consequences.

Cross-Cutting Obligations

Regardless of category, all operators must:

  1. Register with their national competent authority (mandatory for drones over 250g or equipped with a camera)
  2. Respect UAS geographical zones defined by each Member State, covering restricted, prohibited, and conditional airspace
  3. Maintain flight logs for all Specific and Certified category operations
  4. Ensure adequate pilot training appropriate to the subcategory or category of operation

The U-Space: Managing the New Low-Altitude Frontier

The two regulations sit within a broader framework that includes the U-Space system, established by Regulation (EU) 2021/664. U-Space is the EU’s digital infrastructure for managing low-altitude air traffic in real time – essentially an air traffic management system for drones. It enables flight authorisation, conflict detection, real-time traffic monitoring and information sharing between operators, authorities, and conventional airspace managers.

U-Space is the critical enabler for large-scale BVLOS operations, and its progressive rollout across Member States is expected to unlock entirely new categories of drone deployment in the coming years.

Why It Matters

Together, these regulations created a single European drone market: harmonised, scalable, and built around safety. For anyone operating drones professionally in Europe, compliance is not optional – it is the foundation of lawful and sustainable operations.

So while the debate on UAPs continues across the Atlantic, Europe has already answered its own version of the question: what’s flying up there, and who’s in charge of it?

The answer, refreshingly, involves neither little green men nor government cover-ups – just well-drafted regulations and a lot of paperwork.

Email Tracking Pixels: New Guidelines

Legal news, , , , , , , , ,

On 17 April 2026, the Italian Data Protection Authority (the Garante) published Guidelines on the use of tracking pixels in email communications, aimed at strengthening transparency and giving users greater control over their personal data. These Guidelines apply to anyone who uses tracking pixels, regardless of their capacity or the purpose of their communications.

Tracking pixels are tiny, virtually invisible images inserted into emails through HTML code and loaded from remote servers when a recipient opens a message. Without the user’s full awareness, this process automatically sends a request to the sender’s server, allowing the sender — or its partners — to collect data such as whether the email was opened, the type of device used, the time spent consulting the message, and the number of times it was opened. Importantly, the Garante clarifies that tracking pixels do not directly access or analyse the substantive content of the email; rather, they monitor the event of the email being opened and consulted. Their intrusiveness therefore stems primarily from their hidden nature and the recipient’s lack of awareness, as well as from the behavioural inferences that may subsequently be drawn from their use. While tracking pixels may serve a range of legitimate purposes — including improving email deliverability, measuring audience engagement, combating spam, and detecting phishing — their covert nature raises significant data protection concerns.

Under the Guidelines, the use of tracking pixels must always be disclosed to recipients in advance accordance with the principles of lawfulness, fairness and transparency under Article 5(1)(a) GDPR and the Italian Personal Data Protection Code. The Garante also clarifies that the use of tracking pixels falls within the scope of Article 122 of the Italian Personal Data Protection Code, as it involves the storage of information in the user’s terminal equipment and/or access to information already stored therein. Accordingly, where no exemption under Article 122 applies, data controllers must obtain the recipient’s prior, informed, free, specific and unambiguous consent before deploying tracking pixels. Such exemptions may apply, for instance, where pixels are used solely for aggregate statistical counts subject to appropriate anonymisation measures, for security and authentication purposes, or where institutional, service-related or legally mandated communications make it necessary to verify that the recipient has actually become aware of the message.

Where consent is required, it must be collected when the email address is obtained and must be easily revocable by the user. For processing already underway at the time the Guidelines come into force, data controllers must promptly fulfil their information obligations and implement a clearly visible and user-friendly consent withdrawal mechanism. All parties concerned have six months from the Guidelines’ publication in the Official Gazette to ensure full compliance.

Pseudonymisation Under the GDPR: Where We Are, What May change Under the Digital Omnibus, and What Regulators think

Legal news

Pseudonymisation has long been a key safeguard under the GDPR. A new “Digital Omnibus” proposal aims to clarify when pseudonymised data may fall outside the scope of personal data – an idea the EDPB and EDPS have pushed back on. Here’s a quick overview of the landscape and what to watch.

1) Pseudonymisation under the GDPR today

Definition (Article 4(5))
Pseudonymisation is any processing of personal data that prevents attribution to a specific data subject without additional information, provided that such information is kept separately and protected by appropriate technical and organisational measures.

Where it matters in practice

  • Purpose compatibility (Article 6): When assessing whether further processing is compatible with the original purpose, controllers should consider safeguards like pseudonymisation or encryption.
  • Privacy by design/default (Article 25): Controllers must implement suitable measures – including pseudonymization – to embed data protection principles (e.g., minimisation) into processing activities.
  • Security (Article 32): Pseudonymisation is listed among the measures that can ensure a level of security appropriate to risk.
  • Research & statistics (Article 89): For archiving in the public interest, scientific or historical research, or statistical purposes, controllers must adopt safeguards to uphold data minimisation; pseudonymisation may be used where it allows achieving those purposes. If purposes can be achieved without identifying individuals, processing should proceed in that non‑identifying way.

Bottom line today:
Pseudonymisation reduces risk and supports compliance, but does not remove data from the GDPR’s scope; the data remain personal unless it is no longer reasonably identifiable.

2) The Digital Omnibus proposal: clarifying pseudonymisation and its boundary with personal data

The Commission’s Digital Omnibus proposal seeks to simplify and harmonise the digital legislative framework. In the GDPR context, it also aims to:

  • Clarify key definitions, including personal data and pseudonymisation;
  • Facilitate compliance by supporting controllers with criteria and means to determine when data resulting from pseudonymisation do not constitute personal data (e.g., considering state of the art techniques and re‑identification risks);

New Article 41a (proposed)
The proposal would add Article 41a to the GDPR empowering the Commission to adopt implementing acts that:

  • Specify means and criteria to assess whether pseudonymised data no longer constitute personal data for certain entities;
  • Take into account the state of the art and risk of re‑identification for typical recipients;
  • Involve the EDPB closely; the EDPB would issue an opinion within 8 weeks on draft implementing acts;
  • Allow controllers to use those means/criteria as an element of proof that data cannot lead to re‑identification.

What this tries to achieve:
More legal certainty and practical guidance for controllers on when pseudonymised outputs can be treated as non‑personal, potentially easing compliance burdens – especially for smaller organisations – where re‑identification risk is demonstrably negligible.

3) The EDPB–EDPS joint opinion: concerns and a clear recommendation

In Joint Opinion 2/2026, the EDPB and EDPS express significant concerns with proposed Article 41a:

  1. Material scope of EU data protection law at stake
    Deciding whether information is personal data defines when the GDPR applies. Allowing the Commission – via implementing acts – to determine means and criteria for when pseudonymised data are no longer personal could de facto reshape the GDPR’s material scope “for whom and when,” which the authorities argue should be determined independently by supervisory authorities, under court control, with the EDPB ensuring consistent application.
  1. Legal certainty may not improve
    The draft says implementation of the Commission’s means/criteria “may be used as an element” to show non‑identifiability. The authorities find this ambiguous: Would it create a rebuttable presumption or merely one factor among others? Such uncertainty risks more complexity and confusion, contrary to the proposal’s simplification goals.

Regulatory ask:
The EDPB and EDPS recommend deleting Article 41a from the proposal.

What this means for organisations

  • Today’s steady state remains: Pseudonymised data are generally still personal data; pseudonymisation reduces risk and supports lawfulness, security, and privacy by design, but does not itself exclude GDPR applicability.
  • If Article 41a were adopted: There could be structured criteria (and potentially industry‑specific or recipient‑specific categories) to support assertions that certain pseudonymised datasets are non‑personal. However, the legal effect might be limited if criteria only serve as one evidentiary element rather than a presumption – leaving residual uncertainty.
  • Regulatory trajectory: Given the EDPB–EDPS stance, expect intense debate in the legislative process. Controllers should not plan on deregulatory outcomes; continue to treat pseudonymised data as personal unless robustly anonymised per existing standards.

The new information notice exemption: What businesses need to know

Legal news

The EU’s Digital Omnibus initiative aims to reshape GDPR, and one of its most practical changes for organizations is a new exemption from the obligation to provide information notices when collecting personal data. While this may sound technical, the effect is straightforward: reducing administrative burdens while maintaining strong data protection standards.

THE CURRENT LEGAL FRAMEWORK. According to Article 13 GDPR, controllers must provide data subjects with detailed information about how their personal data is processed, including:

  • Identity of the controller;
  • Purposes and legal basis of processing;
  • Retention periods;
  • Data subject rights.

Today, limited exemptions exist. Notably, Article 13, par. 4 GDPR states that controllers are not required to provide information if the data subject already has such information.

THE DIGITAL OMNIBUS REFORM: EXPANDING EXEMPTIONS. DigitalOmnibus seeks to expand this exemption by amending Article 13 GDPR. Under the proposed reform, controllers may be exempt from providing an information notice if:

  • The processing is unlikely to result in high risk (e.g., limited data and simple processing activities);
  • There are reasonable grounds to assume the data subject already possesses the relevant information.

Importantly, this exemption does not affect the data subject’s right to access their data under Article 15 GDPR.

The EDPB–EDPS JOINT OPINION. The European Data Protection Board (“EDPB”) and European Data Protection Supervisor(“EDPS”) have expressed support for the reform, noting that it could reduce unnecessary administrative burdens.

However, they also warn that the new wording of Article 13 GDPR may create legal uncertainty and divergent interpretations across Member States. To mitigate this, clear definitions outlining the scope of the exemption are essential.

Additionally, the EDPB and EDPS emphasize the need for controllers to provide full Article 13 information upon request of the data subject.

POTENTIAL BENEFITS FOR COMPANIES. If adopted, the reform may positively impact on companies. But how?

  • Reducing administrative burden: No need to draft or deliver notices where users already know the essential information;
  • Ensuring Cost-efficient compliance: Fewer internal approvals, less paperwork, and reduced content updates.

CONCLUSION. The Digital Omnibus regulation, if approved, could significantly reform GDPR transparency obligations. Businesses should continue monitoring developments to understand how and when these changes will take effect.

The future of GDPR? Focus on Automated Decisions

Legal news, , , , , , ,

The Digital Omnibus Proposal.  The so called “Digital Omnibus” regulation proposal promises to lighten the burden of compliance with data protection legislation. Its aim is “to ensure that the rules continue to be fit for supporting innovation and growth”. Europe is not giving up on privacy, but it is willing to simplify it.

EDPB and EDPS Chime In.  The proposal, published in November 2025, has recently been the subject matter of a joint opinion by the European Data Protection Board and the European Data Protection Supervisor. While these two bodies are apparently in favor of facilitating GDPR compliance and strengthening consistency in its application, they express significant concerns regarding the impact of the changes on the fundamental rights and freedoms of individuals. They also fear that the proposal will create additional legal uncertainties.

The GDPR of the Future.  Gitti and Partners is embarking in a series of blog posts to explain what the GDPR may look like if the Digital Omnibus proposal becomes law. Today we focus on changes to the provision on automated decisions.

Automated Decisions: from Right to Prohibition.  Article 22 of the current GDPR regulates automated individual decision-making. The current language of the provision frames the rule as a “right”: a data subject is entitled not to be subject to a decision based solely on automated processing, unless certain conditions apply. The new proposal, instead, shapes a similar rule as a prohibition.

Conditions for Automated Decisions.  The new proposal reads (new language highlighted in yellow): “1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means. […]”

While – as before – the automated decision is legitimate if necessary to enter into or perform a contract with the data subject, the novelty is that the necessity of the automated decision can be assessed “regardless of whether the decision could be taken otherwise than by solely automated means”. Therefore:

  • An automated decision that does not produce any legal effects is fine.
  • An automated decision producing legal effects may be based on automated processing only if the decision is necessary to enter into or perform a contract with the data subject.
  • No automated decision is allowed unless it is necessary to enter or perform a contract with the data subject.
  • In order to add certainty to the interpretation of the requirement of “necessity”, the proposal clarifies that the decision may be regarded as necessary also if the decision could be made by a human. In the words of the EDPB/EDPS opinion, “the requirement of necessity does not mean that the mere fact that a decision could theoretically also be taken by a human should prevent the controller from taking the decision by solely automated means”.
  • In short, “The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing” (recital (38) of the Digital Omnibus proposal).

Bottom line: the data controller may choose a human decision process or an automated decision process so long as they are necessary to enter into or perform a contract with the data subject.

In conclusion, as shown in the “AI First” policy, the EU is now worried that AI may not be fully exploited. The above changes are supposed to encourage automated decisions even if such decisions could be taken by a human being.

Stay tuned for more angles of the Digital Omnibus.

Privacy vs. freedom of the press: 3 Italian cases you need to know about

Legal news, ,

2026 kicked off with three significant decisions by Italian authorities that shed light on where journalism ends and privacy begins. Here’s what you need to know. The common thread?Private information can only be shared when there’s a genuine public interest at stake.

SANGIULIANO CASE. On January 22, 2026, the Court of Rome threw out a Euro 150,000 fine that the Italian Data Protection Authority had slapped on public broadcaster RAI. The offense? Airing a private phone call between former Culture Minister Sangiuliano and his wife on the investigative show “Report”. The call touched on the Minister’s alleged affair and his wife’s demand to revoke institutional appointments supposedly given to the other woman.

The Court’s verdict? The broadcast served a legitimate public interest. Yes, the content was personal, but it raised serious questions about whether top government appointments were being handed out based on personal relationships rather than merit. In the Court’s own words, the conversations touched upon “a topic which is certainly of public interest, relating to the possibility that the assignment of high institutional positions may be influenced by matters of a purely personal nature”.

SIGNORINI CASE. Just four days later, on January 26, 2026, the Court of Milan took swift action against Mr. Corona, ordering the immediate takedown of all defamatory content he had posted about Mr. Signorini on his podcast “Falsissimo“. This included private conversations, intimate photos, and sexually explicit material. The Court also prohibited any further dissemination.

The Court expressly excluded the applicability of the right to privacy under Article 21 of the Italian Constitution, finding that no public interest existed that was capable of justifying such a serious intrusion into personal privacy. It emphasized that the disseminated material concerned exclusively Mr. Signorini’s sexual preferences and habits, which, in themselves, do not constitute matters of public concern. Moreover, the Court did not find sufficient evidence supporting Mr. Corona’s claim that the disclosures revealed a system of sexual blackmail within the entertainment industry. Lastly, the Court noted that Mr. Corona is not a journalist and therefore cannot benefit from the constitutional safeguards afforded to the press.

GARLASCO CASE. On January 30, 2026, the Italian Data Protection Authority issued a formal measure addressed to journalists, warning against the disclosure of names and personal details in media reconstructions of the Garlasco case that go beyond what is strictly necessary for informational purposes. The Authority noted that the level of detail in some articles and TV coverage was turning legitimate news into a “morbid spectacle.” This kind of reporting, they warned, violates the principle of essentiality of information and breaches both data protection laws and journalistic ethics.

Despite their different facts, all three decisions reaffirm a core principle of Italian case law: privacy is constitutionally protected, but it’s not absolute. Courts must always balance it against other fundamental rights, especially press freedom.

The bottom line? Sharing private information is only acceptable when there’s a concrete and legitimate public interest.

A More Volatile World: The Digital Omnibus

Legal news, , , , , , , ,

On November 19, 2025, the European Commission unveiled a landmark proposal: the Digital Omnibus Regulation. This initiative is not just another legislative tweak – it signals a philosophical shift in how Europe approaches digital regulation. In a world increasingly defined by volatility, complexity, and rapid technological change, the Commission seems to be saying: “We’ve heard you – let’s regulate, but let’s make it easier to comply.”

Why Now? The Context Behind the ‘Digital Omnibus’

The proposal comes against a backdrop of mounting pressure on Europe’s competitiveness. In his now-famous “Please, do something” speech to the European Parliament, Mario Draghi urged EU institutions to act decisively to restore Europe’s ability to innovate and compete globally. Could the Digital Omnibus be seen as a response to this heartfelt appeal?

For years, the EU has been a global pioneer in digital regulation – think GDPR, AI Act, Data Act, Digital Services Act (DSA), Digital Markets Act (DMA), NIS2, and more. But this success has come at a cost: fragmentation, complexity, and heavy compliance burdens. Businesses have struggled to navigate overlapping obligations. The Digital Omnibus is designed to change that. In the “explanatory memorandum” to the Digital Omnibus, the Commission emblematically acknowledges, for instance, that “some entities, especially smaller companies and associations with a low number of non-intensive, often low-risk data processing operations, expressed concerns regarding the application of some obligations of the GDPR”.

The ‘Digital Omnibus’ Proposal

The proposal introduces technical amendments and structural simplifications across a wide range of legislation, including:

  • General Data Protection Regulation (GDPR)
  • AI Act
  • Data Act
  • ePrivacy Directive
  • NIS2 Directive
  • Data Governance Act
  • Free Flow of Non-Personal Data Regulation
  • Platform-to-Business (P2B) Regulation (to be repealed

Key Highlights

  • GDPR Simplification:
    • Clarifies the definition of personal data
    • Supports controllers with respect to the criteria and means to determine whether data resulting from pseudonymization does not constitute personal data
    • Introduces flexibility for AI development: processing personal data for AI training under “legitimate interest,” with safeguards.
    • Modernizes cookie consent rules – centralized browser settings to end “cookie fatigue.”
  • AI Act Adjustments:
    • Expands regulatory sandboxes and simplifies compliance for SMEs and mid-cap companies.
    • Clarifies the interplay between the AI Act and other EU legislation
    • Introduces an obligation on the Commission and Member States to foster AI literacy
  • Incident Reporting:
    • Creates a single-entry point for incident notifications under GDPR, NIS2, DORA, and CER – ending duplicative reporting.

A New Philosophy?

There are strong indications that the “Digital Omnibus” is more than a mere technical adjustment and may represents a strategic shift in EU “digital law”. The proposals will now proceed to the European Parliament and the Council for deliberation. It remains to be seen whether words will be turned into action.