All posts by Paola Sangiovanni

Unknown's avatar

About Paola Sangiovanni

Partner of GITTI and Partners. Seasoned transactional and regulatory legal counsel with a thorough understanding of the life sciences industry.

231 Liability: A Proposed Reform

Legal news, , , , , ,

We held a seminar/webinar yesterday on the proposed reform of Legislative Decree 231 of 2001, which aims at reshaping key aspects of criminal liability of corporate entities. Basics on 231 liability can be found here.

The speakers, Fabrizio Sardella, Gaia Zunino and myself, highlighted the following key points:

(i) The preventive nature of the 231 system is going to be strengthened through the elevation of “organizational fault” (colpa di organizzazione) to a core element of 231 corporate liability.

(ii) The public prosecutor would be required to identify the specific organizational shortcomings underlying the alleged 231 liability.

(iv) The current burden of proof on corporate entities for any offences committed by senior managers will be shifted to the public prosecutor.

(iii) In case of negligent offences, the company’s “interest or advantage” would exist in case of significant cost saving or production increase.

Lastly, the speakers stressed that the reform remains a draft bill and has not yet entered into force. Nevertheless, the direction is clear: companies will increasingly be assessed on the effectiveness of their compliance frameworks rather than on formal adherence alone.

Organizations that proactively review and strengthen their governance, internal controls, training, whistleblowing procedures, and 231 Models today will be better positioned to adapt to the final version of the reform and demonstrate a genuine culture of compliance.

GOODBYE “GOLDEN POWER” LEGISLATION. IN COMES THE EU’S NEW FOREIGN INVESTMENT SCREENING REGULATION.

Legal news

On June 17, 2026, the European Parliament and the Council adopted Regulation (EU) 2026/1386 on the screening of foreign investments in the European Union, repealing and replacing the previous framework under Regulation (EU) 2019/452. The new Regulation, which will enter into force in January 2028, marks a significant step forward in the EU’s approach to protecting its economic security and strategic interests.

Why a new Regulation?  The 2019 framework was the EU’s first attempt at coordinating foreign investment screening across Member States. However, it was widely seen as insufficient: it was voluntary in nature, covered only direct investments from third countries, and left significant gaps where Member States lacked any screening mechanism at all. Since then, escalating geopolitical tensions, and lessons learned from the pandemic and energy crises have prompted a fundamental rethink. The new Regulation responds to these challenges by making screening mandatory, extending its reach, and creating a more harmonized procedural framework across the EU.

KEY CHANGES AT A GLANCE

1. Intra-EU investments now in scope.  Under the previous regime, only direct investments by third-country investors were covered. The new Regulation captures investments made by foreign investors through an EU-based subsidiary. This means that, for example, a Chinese investor operating through a Dutch holding company will now fall within the screening perimeter of the target’s home Member State.

2. Mandatory prior authorization in sensitive sectors.  All Member States must require prior authorization for foreign investments in companies active in designated sensitive sectors. These include: dual-use items and military goods/technologies; semiconductors, quantum technologies, and certain AI technologies; strategic raw materials (exploration, extraction, processing, recycling, recovery, or stockpiling); systemically important financial market infrastructures and entities (central counterparties, central securities depositories, regulated market operators, payment systems, financial messaging providers); and electoral registration databases, voting systems, and election management IT systems. Transport, energy, and digital infrastructure are also included, but only where the target company has been designated as critical following a risk-based assessment by the relevant Member State. Greenfield investments are excluded from the prior authorization requirement, although they remain within the Regulation’s general scope.

3. Harmonized review timeline.  The initial screening period is now capped at 45 calendar days from the date on which the filing is deemed complete. This provides greater predictability for deal timetables, particularly in cross-border transactions involving multiple Member States. A second phase may be opened if the initial screening period does not close with clearance of the investment.

4. Ex officio powers for non-notifiable investments.  For investments that are not subject to mandatory prior authorization, authorities may act ex officio from 15 months up to a maximum of five years after the completion of the transaction.

Corruption in Healthcare: What ANAC’s New Catalogue Means for Life Sciences Compliance

Legal news, , , , , , , , ,

Corruption in Healthcare. Corruption is a concrete, evolving compliance risk for life
sciences companies, not just a hypothetical risk. In my experience sitting on supervisory boards under Legislative Decree 231/2001 on corporate criminal liability, the risks in this space have grown more sophisticated and harder to detect over the years.

The numbers explain why. Italy’s National Anti-Corruption Authority (ANAC) recently noted
that roughly 25% of all public procurement spending in Italy flows to the healthcare sector, and
that 8% of whistleblowing reports concern that same sector. Those two figures alone justify
heightened scrutiny.

ANAC has been paying attention accordingly. It has adopted the “Catalogue of Corruption Risks
and Prevention Measures in the Healthcare Sector” (Catalogo dei rischi corruttivi e delle misure
di prevenzione nel settore sanitario), approved by ANAC’s Board with Resolution No. 318 of 29
July 2026. The Catalogue is meant to support National Health Service entities in drafting the “corruption risks and transparency” sub-section of their Integrated Activity and Organization Plan (PIAO), and it is a document worth reading well beyond that immediate audience.

The idea behind it is straightforward: healthcare is complex, the stakes are high, and the web of
relationships within the system calls for extra scrutiny, especially when public health is on the
line.

What the Catalogue Covers. The Catalogue maps new risks and new prevention measures across a wide range of areas: healthcare system regulation, biomedical research, pharmaceutical and medical-device marketing and promotion, public procurement, product distribution and storage, financial resource management, human resource management, and the actual delivery of healthcare services, including relations with accredited providers, oversight and inspection activity, and private practice and waiting lists.

For life sciences companies, the marketing and promotion chapter is the most direct point of
relevance: it is the clearest line connecting the Catalogue’s healthcare-system focus back to
industry conduct rather than treating it as a purely public-sector document.


Why This Matters. Healthcare is a perfect storm for integrity risk: high-stakes decisions, significant economic interests, constant public-private interaction, and pronounced information asymmetries. That mix can easily breed mismanagement, conflicts of interest, and outright corruption. ANAC’s own conclusion is that preventing corruption in healthcare takes a model built on transparency and impartiality, digitalization, independent controls, accountability, and the capacity to monitor the most exposed processes on an ongoing basis.

A Basis to Stress Test the Risk Map. Both public entities and private companies active in healthcare should take note of these risks and move to adopt measures that prevent them. For life sciences companies operating a Legislative Decree 231/2001 compliance model, the Catalogue is more than a general awareness exercise: it is a ready-made checklist against which to stress-test the existing risk map, refine the questions asked of management, and confirm that prevention measures keep pace with how these risks.

A New 231? Italy’s Proposed Reform of Corporate Criminal Liability

Legal news, , , , ,

On August 4, 2026, the Italian Council of Ministers has approved a draft bill overhauling the rules on the liability of legal entities under Legislative Decree No. 231 of 2001. Below is a summary of the main changes.

  • Organizational fault as the sole basis for liability
    • Organizational fault (“colpa in organizzazione”) becomes the exclusive subjective criterion for imputing liability to the entity. Crucially, this eliminates the current reversal of the burden of proof: the prosecutor, not the entity, must demonstrate organizational failings.
  • Unified liability test — no more “apical vs subordinate” distinction
    • The current two-track system — which treats offences committed by senior management differently from those committed by subordinates — is abolished. A single criterion applies: the entity is liable only where a causal link is established between the failure to adopt (or effectively implement) an adequate compliance model and the commission of the offence.
  • Presumption of corporate interest or benefit for offences based on negligence
    • For offences based on negligence, a rebuttable presumption of corporate interest or benefit is introduced where the breach of applicable rules has resulted in appreciable cost savings or increased output.
  • Clearer compliance model requirements
    • The reform defines the essential content, adoption procedure, and revision process for compliance models. Models that follow guidelines issued by representative trade associations are presumed adequate; a court departing from that presumption must give specific reasons. In the field of occupational health and safety, models based on the UNI ISO standard carry full exonerating effect.
  • Simplified procedures for SMEs
    • The Minister of Justice is tasked with issuing a decree setting out simplified procedures for small and medium-sized enterprises to adopt and implement effective compliance models.
  • Expanded grounds for extinguishing liability
    • A new ground to extinguish liability is added for entities that take post-offence remedial action to cure the compliance gaps identified by the public prosecutor. Specific extinction rules apply to environmental and tax offences (remediation and full payment, respectively). In addition, liability is extinguished where the entity eliminates the organizational failures identified in the certified assessment.
  • Strengthened procedural safeguards
    • The public prosecutor must specify the organizational failings both in applications for injunctive measures and when formally charging the entity; failure to do so renders the proceedings null. Pre-trial seizure is excluded where the entity offers adequate security. Plea-bargaining is now available to the entity regardless of the parallel proceedings against the individual. A time-bar mechanism is introduced: liability is extinguished five years after an injunctive sanction of up to one year (or two years after a pecuniary sanction only), provided no offence of the same kind is committed in the interim.
  • Government delegation on sanctions and crimes giving rise to liability
    • The Government is delegated to adopt, within 8 months of the law’s entry into force, a legislative decree revising the sanctions framework and the catalogue of crimes giving rise to 231 liability, which should limit such crimes to those with greater connection to corporate activities.

This reform represents a fundamental shift in Italy’s corporate liability regime: it places organizational fault at the center of the system, removes the burden-of-proof asymmetry that has long been criticized by practitioners, and introduces meaningful incentives for entities to invest in robust compliance programs. Businesses operating in Italy — or with Italian subsidiaries — should assess the impact on their existing 231 models as the bill progresses through Parliament.

No Human in the Loop: Uber’s Record GDPR Fine

Legal news, , , , , , , , , , ,

On August 21, 2026, the Dutch data protection authority has sanctioned the company Uber for breach of article 22 of the GDPR on automated decisions. An appeal by Uber against the fine, equal to no less than €824,990,000 (yes, all those zeros!), is pending.

Rules on automated decisions.  Section 22 of the GDPR sets forth that the data subject is entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Certain exceptions to this rule apply, namely if the decision is necessary to enter into or perform a contract with the data controller, if it is provided by law, or if it is based on express consent of the data subject. Changes to the provision may be brought by the Digital Omnibus proposal, but are not yet in force.

An entirely automated decision.  The data protection authority found that between 2018 and 2022 Uber used software to track drivers’ conduct and customers reviews, which would automatically deactivate the driver’s account in case of suspicion of fraud or if customer reviews were bad. The account’s deactivation implied no human assessment and was found to be entirely automatic.

The previous SCHUFA case.  The European Court of Justice tackled a similar issue in the Schufa case of December 7, 2023. In that case, the decision process was more articulated, with an automated first step and a second step involving a human decision heavily relying on the first step. The Court ruled that a credit information agency setting forth “a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes ‘automated individual decision-making’ within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person”. The Court justified this broad interpretation by pointing to the risk, where three parties are involved, of circumventing Article 22 and creating a gap in legal protection if the calculation of the probability value were classified merely as a preparatory act.

Are AI decisions better than human decisions?  An optimistic view argues that AI-based hiring of employees may result in a less biased human resources function. On the other hand, a more commonly shared opinion is concerned that AI decisions, which can be as biased as human decisions, are becoming fully independent from instructions received by humans (e.g., Ukrainians have started to be killed by drones entirely guided by AI).

Conclusions. The GDPR bans fully automated decisions and requires “human-in-the-loop” processes whenever such decision produces legal effects or significantly affects a person. Section 22 of the GDPR can be seen, and is being interpreted, as a safeguard for EU citizens against fully automated decisions.

AI Act Transparency Obligations Are Now in Force

Legal news, , , , , , , ,

Dear Readers,

I hope you had a great summer! While you were travelling, hiking, swimming or simply resting, article 50 of the AI Act has entered into force, which means that a number of transparency obligations are applicable.

1. YOUR ROLE. First things first: are you an AI provider or an AI deployer?

  • A provider of AI systems is a natural or legal person that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark; while
  • A deployer is a natural or legal person using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.

Providers and deployers have different obligations, which are summarized below.

2. PROVIDER’S OBLIGATIONS.

  • Providers must ensure that AI systems intended to interact directly with natural persons are designed so that those persons are informed they are interacting with an AI system, unless this is obvious from the point of view of a reasonably well-informed, observant and circumspect person.
  • Providers of AI systems that generate synthetic audio, image, video or text content must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Technical solutions must be effective, interoperable, robust and reliable, as far as technically feasible.

Providers have started to comply and use different technical solutions. Anthropic, for example, is using a watermarking technique, while Open AI and Google are using different strategies. No single marking technique meets Article 50(2) requirements of effectiveness, interoperability, robustness and reliability, and only an appropriate combination of techniques and detection mechanisms can satisfy them. Some point to a clear “Brussels effect” where the AI Act ends up applying beyond its scope.

3. DEPLOYER’S OBLIGATIONS.

  • Deployers of emotion recognition or biometric categorization systems must inform the natural persons exposed to the system of its operation and must process personal data in accordance with the GDPR and any other applicable data protection laws.
  • Deployers of AI systems that generate or manipulate image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. For evidently artistic, creative, satirical, fictional or analogous works, the obligation is limited to appropriate disclosure that does not hamper the display or enjoyment of the work.
  • Deployers of AI systems that generate or manipulate text published to inform the public on matters of public interest must disclose the artificial nature of the content, unless the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

All information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure.

The AI Office is tasked with encouraging codes of practice at Union level to facilitate the effective implementation of obligations regarding the detection and labelling of artificially generated or manipulated content. In fact, the voluntary Code of Practice on Transparency of AI-generated Content has already been signed by 190+ organizations and has been found by the EU Commission and the AI Office as an effective tool to aid compliance with article 50 of the AI Act.

In a world where AI systems have started to go rogue, perhaps the AI Act – with all its constraints to AI technology – can offer reassurance that the EU continues to pursue a human-centric, trustworthy AI.

How to Handle DATABASES in M&A Transactions

Legal news

Mergers and acquisitions (M&A) inevitably involve the transfer of valuable corporate assets—and among the most sensitive of these are databases containing personal data. Whether these datasets relate to healthcare professionals, employees, customers, suppliers, or business partners, their transfer raises questions under data protection law.

What is the role of consent in data transfers during M&A? What are the data protection obligations when data changes hands?

1. Consent in M&A: Is It Always Necessary?

A common concern in M&A transactions is whether companies must obtain fresh consent from data subjects when personal data is transferred to the acquiring entity. In many cases under Italian and EU law, the answer is no, thanks to the principle of continuity of processing.

The Italian Data Protection Authority (the Garante per la protezione dei dati personali) has clarified this position in several decisions, including Decision No. 97/2015. According to the Garante, when an M&A transaction involves a transfer of a business or business unit, the applicable provisions of the Italian Civil Code—specifically Articles 2558, 2559, 2560, and 2112—establish a legal succession framework.

Under this framework:

  • The acquiring company automatically steps into the legal position of the seller.
  • All contractual relationships, rights, and obligations transfer seamlessly.
  • This includes data processing activities connected to those relationships.

As a result, the transfer of personal data does not require new consent, provided that:

  • The data continues to be used for the same purposes for which it was originally collected.
  • The processing remains within the expectations of the data subjects.

This principle reflects a pragmatic balance between business continuity and data protection, avoiding unnecessary disruption to commercial operations.

2. Privacy Notice Obligations: the Role of Article 14 GDPR

Even when consent is not required, the GDPR imposes strict transparency obligations.

When personal data is not collected directly from the data subject—as is typically the case in M&A transactions—the acquiring company must provide a privacy notice pursuant to Article 14 GDPR.

This obligation has been reinforced by the Garante in Decision No. 285/2022 and earlier guidance, including the 2009 guidelines on mergers and demergers.

3. How to Provide a Privacy Notice: Simplified Approaches

Given the potentially large number of individuals involved, providing individual notices can be challenging. Fortunately, the Garante has recognized simplified methods of compliance, including:

  • Publication of the privacy notice on the websites of both the transferring and acquiring companies.
  • Deferred individual communication, such as sending an email at the first available opportunity.

These approaches, confirmed in Decisions No. 664/2015 and No. 97/2015, strike a balance between practicality and transparency, especially in large-scale transactions.

4. Key Takeaways for M&A Practitioners

To ensure compliance when transferring databases in an M&A context, companies should:

·         Rely on the principle of continuity of processing, where applicable. This avoids unnecessary consent collection if legal succession applies.

·         Provide Article 14 GDPR privacy notices to affected individuals. Simplified communication methods when dealing with large datasets can be used.

Email Tracking Pixels: New Guidelines

Legal news, , , , , , , , ,

On 17 April 2026, the Italian Data Protection Authority (the Garante) published Guidelines on the use of tracking pixels in email communications, aimed at strengthening transparency and giving users greater control over their personal data. These Guidelines apply to anyone who uses tracking pixels, regardless of their capacity or the purpose of their communications.

Tracking pixels are tiny, virtually invisible images inserted into emails through HTML code and loaded from remote servers when a recipient opens a message. Without the user’s full awareness, this process automatically sends a request to the sender’s server, allowing the sender — or its partners — to collect data such as whether the email was opened, the type of device used, the time spent consulting the message, and the number of times it was opened. Importantly, the Garante clarifies that tracking pixels do not directly access or analyse the substantive content of the email; rather, they monitor the event of the email being opened and consulted. Their intrusiveness therefore stems primarily from their hidden nature and the recipient’s lack of awareness, as well as from the behavioural inferences that may subsequently be drawn from their use. While tracking pixels may serve a range of legitimate purposes — including improving email deliverability, measuring audience engagement, combating spam, and detecting phishing — their covert nature raises significant data protection concerns.

Under the Guidelines, the use of tracking pixels must always be disclosed to recipients in advance accordance with the principles of lawfulness, fairness and transparency under Article 5(1)(a) GDPR and the Italian Personal Data Protection Code. The Garante also clarifies that the use of tracking pixels falls within the scope of Article 122 of the Italian Personal Data Protection Code, as it involves the storage of information in the user’s terminal equipment and/or access to information already stored therein. Accordingly, where no exemption under Article 122 applies, data controllers must obtain the recipient’s prior, informed, free, specific and unambiguous consent before deploying tracking pixels. Such exemptions may apply, for instance, where pixels are used solely for aggregate statistical counts subject to appropriate anonymisation measures, for security and authentication purposes, or where institutional, service-related or legally mandated communications make it necessary to verify that the recipient has actually become aware of the message.

Where consent is required, it must be collected when the email address is obtained and must be easily revocable by the user. For processing already underway at the time the Guidelines come into force, data controllers must promptly fulfil their information obligations and implement a clearly visible and user-friendly consent withdrawal mechanism. All parties concerned have six months from the Guidelines’ publication in the Official Gazette to ensure full compliance.

The future of GDPR? Focus on Automated Decisions

Legal news, , , , , , ,

The Digital Omnibus Proposal.  The so called “Digital Omnibus” regulation proposal promises to lighten the burden of compliance with data protection legislation. Its aim is “to ensure that the rules continue to be fit for supporting innovation and growth”. Europe is not giving up on privacy, but it is willing to simplify it.

EDPB and EDPS Chime In.  The proposal, published in November 2025, has recently been the subject matter of a joint opinion by the European Data Protection Board and the European Data Protection Supervisor. While these two bodies are apparently in favor of facilitating GDPR compliance and strengthening consistency in its application, they express significant concerns regarding the impact of the changes on the fundamental rights and freedoms of individuals. They also fear that the proposal will create additional legal uncertainties.

The GDPR of the Future.  Gitti and Partners is embarking in a series of blog posts to explain what the GDPR may look like if the Digital Omnibus proposal becomes law. Today we focus on changes to the provision on automated decisions.

Automated Decisions: from Right to Prohibition.  Article 22 of the current GDPR regulates automated individual decision-making. The current language of the provision frames the rule as a “right”: a data subject is entitled not to be subject to a decision based solely on automated processing, unless certain conditions apply. The new proposal, instead, shapes a similar rule as a prohibition.

Conditions for Automated Decisions.  The new proposal reads (new language highlighted in yellow): “1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means. […]”

While – as before – the automated decision is legitimate if necessary to enter into or perform a contract with the data subject, the novelty is that the necessity of the automated decision can be assessed “regardless of whether the decision could be taken otherwise than by solely automated means”. Therefore:

  • An automated decision that does not produce any legal effects is fine.
  • An automated decision producing legal effects may be based on automated processing only if the decision is necessary to enter into or perform a contract with the data subject.
  • No automated decision is allowed unless it is necessary to enter or perform a contract with the data subject.
  • In order to add certainty to the interpretation of the requirement of “necessity”, the proposal clarifies that the decision may be regarded as necessary also if the decision could be made by a human. In the words of the EDPB/EDPS opinion, “the requirement of necessity does not mean that the mere fact that a decision could theoretically also be taken by a human should prevent the controller from taking the decision by solely automated means”.
  • In short, “The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing” (recital (38) of the Digital Omnibus proposal).

Bottom line: the data controller may choose a human decision process or an automated decision process so long as they are necessary to enter into or perform a contract with the data subject.

In conclusion, as shown in the “AI First” policy, the EU is now worried that AI may not be fully exploited. The above changes are supposed to encourage automated decisions even if such decisions could be taken by a human being.

Stay tuned for more angles of the Digital Omnibus.

Italy’s New AI Law: A Boost for Healthcare Research?

Legal news, , , , , , , , , , , ,

Italy has recently enacted its own “Artificial Intelligence Act”, set to take effect on October 10, 2025.

You might be wondering: Did we really need another layer of AI regulation? That was our initial reaction, too. But a closer look reveals that the Italian AI Law introduces several interesting provisions, especially in the healthcare sector, that could facilitate research for both public and private entities. Here are some highlights:

1. Healthcare Data Processing as Based on Public Interest

The law explicitly recognizes that the processing of health-related personal data by:

  • Public or private non-profit entities,
  • Research hospitals (IRCCS),
  • Private entities collaborating with the above for healthcare research,

is of “substantial public interest.” This significantly expands the scope of Article 9(2)(g) of the GDPR, offering a clearer legal basis for processing sensitive data in research contexts.

2. Secondary Use of Data

The law introduces a simplified regime for the secondary use of personal data without direct identifiers. In particular:

  • No new consent required, as long as data subjects are informed (even via a website).
  • Automatic authorization unless blocked by the Data Protection Authority within 30 days of notification.

This provision applies only to the entities mentioned above so it is limited in scope, but in any case significantly strengthens the framework for nonprofit research projects.

3. Freedom to Anonymize, Pseudonymize and Synthesize

Under Article 8(4) of the AI Law, processing data for anonymization, pseudonymization, or synthesization is always permitted, provided the data subject is informed. This is a major step forward in enabling privacy-preserving AI research.

4. Guidelines and Governance

The law delegates the creation of technical guidelines to:

  • AGENAS – for anonymization and synthetic data generation.
  • Ministry of Health – for processing health data in research, including AI applications.

It also establishes a national AI platform at AGENAS, which will act as the data controller for personal data collected and generated within the platform.

Final Thoughts

While the GDPR aimed to support research, its implementation often created legal uncertainty and operational hurdles. Italy’s AI Law appears to address some of these gaps, offering a more pragmatic and enabling framework for healthcare research.