Tag Archives: GDPR

AI Act Transparency Obligations Are Now in Force

August 25, 2026Legal newsAI, AI Act, artificial intelligence, business, chatgpt, GDPR, technology, Transarency, Transparency ObligationsPaola Sangiovanni

Dear Readers,

I hope you had a great summer! While you were travelling, hiking, swimming or simply resting, article 50 of the AI Act has entered into force, which means that a number of transparency obligations are applicable.

1. YOUR ROLE. First things first: are you an AI provider or an AI deployer?

A provider of AI systems is a natural or legal person that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark; while
A deployer is a natural or legal person using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.

Providers and deployers have different obligations, which are summarized below.

2. PROVIDER’S OBLIGATIONS.

Providers must ensure that AI systems intended to interact directly with natural persons are designed so that those persons are informed they are interacting with an AI system, unless this is obvious from the point of view of a reasonably well-informed, observant and circumspect person.
Providers of AI systems that generate synthetic audio, image, video or text content must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Technical solutions must be effective, interoperable, robust and reliable, as far as technically feasible.

Providers have started to comply and use different technical solutions. Anthropic, for example, is using a watermarking technique, while Open AI and Google are using different strategies. No single marking technique meets Article 50(2) requirements of effectiveness, interoperability, robustness and reliability, and only an appropriate combination of techniques and detection mechanisms can satisfy them. Some point to a clear “Brussels effect” where the AI Act ends up applying beyond its scope.

3. DEPLOYER’S OBLIGATIONS.

Deployers of emotion recognition or biometric categorization systems must inform the natural persons exposed to the system of its operation and must process personal data in accordance with the GDPR and any other applicable data protection laws.
Deployers of AI systems that generate or manipulate image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. For evidently artistic, creative, satirical, fictional or analogous works, the obligation is limited to appropriate disclosure that does not hamper the display or enjoyment of the work.
Deployers of AI systems that generate or manipulate text published to inform the public on matters of public interest must disclose the artificial nature of the content, unless the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

All information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure.

The AI Office is tasked with encouraging codes of practice at Union level to facilitate the effective implementation of obligations regarding the detection and labelling of artificially generated or manipulated content. In fact, the voluntary Code of Practice on Transparency of AI-generated Content has already been signed by 190+ organizations and has been found by the EU Commission and the AI Office as an effective tool to aid compliance with article 50 of the AI Act.

In a world where AI systems have started to go rogue, perhaps the AI Act – with all its constraints to AI technology – can offer reassurance that the EU continues to pursue a human-centric, trustworthy AI.

Email Tracking Pixels: New Guidelines

May 15, 2026Legal news#tracking pixels, data protection, garante, GDPR, guidelines, Italian Data Protection Authority, italy, law, privacy, tracking pixelsPaola Sangiovanni

On 17 April 2026, the Italian Data Protection Authority (the Garante) published Guidelines on the use of tracking pixels in email communications, aimed at strengthening transparency and giving users greater control over their personal data. These Guidelines apply to anyone who uses tracking pixels, regardless of their capacity or the purpose of their communications.

Tracking pixels are tiny, virtually invisible images inserted into emails through HTML code and loaded from remote servers when a recipient opens a message. Without the user’s full awareness, this process automatically sends a request to the sender’s server, allowing the sender — or its partners — to collect data such as whether the email was opened, the type of device used, the time spent consulting the message, and the number of times it was opened. Importantly, the Garante clarifies that tracking pixels do not directly access or analyse the substantive content of the email; rather, they monitor the event of the email being opened and consulted. Their intrusiveness therefore stems primarily from their hidden nature and the recipient’s lack of awareness, as well as from the behavioural inferences that may subsequently be drawn from their use. While tracking pixels may serve a range of legitimate purposes — including improving email deliverability, measuring audience engagement, combating spam, and detecting phishing — their covert nature raises significant data protection concerns.

Under the Guidelines, the use of tracking pixels must always be disclosed to recipients in advance accordance with the principles of lawfulness, fairness and transparency under Article 5(1)(a) GDPR and the Italian Personal Data Protection Code. The Garante also clarifies that the use of tracking pixels falls within the scope of Article 122 of the Italian Personal Data Protection Code, as it involves the storage of information in the user’s terminal equipment and/or access to information already stored therein. Accordingly, where no exemption under Article 122 applies, data controllers must obtain the recipient’s prior, informed, free, specific and unambiguous consent before deploying tracking pixels. Such exemptions may apply, for instance, where pixels are used solely for aggregate statistical counts subject to appropriate anonymisation measures, for security and authentication purposes, or where institutional, service-related or legally mandated communications make it necessary to verify that the recipient has actually become aware of the message.

Where consent is required, it must be collected when the email address is obtained and must be easily revocable by the user. For processing already underway at the time the Guidelines come into force, data controllers must promptly fulfil their information obligations and implement a clearly visible and user-friendly consent withdrawal mechanism. All parties concerned have six months from the Guidelines’ publication in the Official Gazette to ensure full compliance.

The future of GDPR? Focus on Automated Decisions

April 21, 2026Legal newsAI, artificial intelligence, Automated decisions, business, chatgpt, Digital Omnibus, GDPR, technologyPaola Sangiovanni

The Digital Omnibus Proposal. The so called “Digital Omnibus” regulation proposal promises to lighten the burden of compliance with data protection legislation. Its aim is “to ensure that the rules continue to be fit for supporting innovation and growth”. Europe is not giving up on privacy, but it is willing to simplify it.

EDPB and EDPS Chime In. The proposal, published in November 2025, has recently been the subject matter of a joint opinion by the European Data Protection Board and the European Data Protection Supervisor. While these two bodies are apparently in favor of facilitating GDPR compliance and strengthening consistency in its application, they express significant concerns regarding the impact of the changes on the fundamental rights and freedoms of individuals. They also fear that the proposal will create additional legal uncertainties.

The GDPR of the Future. Gitti and Partners is embarking in a series of blog posts to explain what the GDPR may look like if the Digital Omnibus proposal becomes law. Today we focus on changes to the provision on automated decisions.

Automated Decisions: from Right to Prohibition. Article 22 of the current GDPR regulates automated individual decision-making. The current language of the provision frames the rule as a “right”: a data subject is entitled not to be subject to a decision based solely on automated processing, unless certain conditions apply. The new proposal, instead, shapes a similar rule as a prohibition.

Conditions for Automated Decisions. The new proposal reads (new language highlighted in yellow): “1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means. […]”

While – as before – the automated decision is legitimate if necessary to enter into or perform a contract with the data subject, the novelty is that the necessity of the automated decision can be assessed “regardless of whether the decision could be taken otherwise than by solely automated means”. Therefore:

An automated decision that does not produce any legal effects is fine.

An automated decision producing legal effects may be based on automated processing only if the decision is necessary to enter into or perform a contract with the data subject.

No automated decision is allowed unless it is necessary to enter or perform a contract with the data subject.

In order to add certainty to the interpretation of the requirement of “necessity”, the proposal clarifies that the decision may be regarded as necessary also if the decision could be made by a human. In the words of the EDPB/EDPS opinion, “the requirement of necessity does not mean that the mere fact that a decision could theoretically also be taken by a human should prevent the controller from taking the decision by solely automated means”.

In short, “The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing” (recital (38) of the Digital Omnibus proposal).

Bottom line: the data controller may choose a human decision process or an automated decision process so long as they are necessary to enter into or perform a contract with the data subject.

In conclusion, as shown in the “AI First” policy, the EU is now worried that AI may not be fully exploited. The above changes are supposed to encourage automated decisions even if such decisions could be taken by a human being.

Stay tuned for more angles of the Digital Omnibus.

Italy’s New AI Law: A Boost for Healthcare Research?

October 2, 2025Legal newsAI, AI Act, anonymization, artificial intelligence, chatgpt, data protection, GDPR, healthcare, Italian AI Law, Italian Data Protection Authority, news, pseudonymization, technologyPaola Sangiovanni

Italy has recently enacted its own “Artificial Intelligence Act”, set to take effect on October 10, 2025.

You might be wondering: Did we really need another layer of AI regulation? That was our initial reaction, too. But a closer look reveals that the Italian AI Law introduces several interesting provisions, especially in the healthcare sector, that could facilitate research for both public and private entities. Here are some highlights:

1. Healthcare Data Processing as Based on Public Interest

The law explicitly recognizes that the processing of health-related personal data by:

Public or private non-profit entities,
Research hospitals (IRCCS),
Private entities collaborating with the above for healthcare research,

is of “substantial public interest.” This significantly expands the scope of Article 9(2)(g) of the GDPR, offering a clearer legal basis for processing sensitive data in research contexts.

2. Secondary Use of Data

The law introduces a simplified regime for the secondary use of personal data without direct identifiers. In particular:

No new consent required, as long as data subjects are informed (even via a website).
Automatic authorization unless blocked by the Data Protection Authority within 30 days of notification.

This provision applies only to the entities mentioned above so it is limited in scope, but in any case significantly strengthens the framework for nonprofit research projects.

3. Freedom to Anonymize, Pseudonymize and Synthesize

Under Article 8(4) of the AI Law, processing data for anonymization, pseudonymization, or synthesization is always permitted, provided the data subject is informed. This is a major step forward in enabling privacy-preserving AI research.

4. Guidelines and Governance

The law delegates the creation of technical guidelines to:

AGENAS – for anonymization and synthetic data generation.
Ministry of Health – for processing health data in research, including AI applications.

It also establishes a national AI platform at AGENAS, which will act as the data controller for personal data collected and generated within the platform.

Final Thoughts

While the GDPR aimed to support research, its implementation often created legal uncertainty and operational hurdles. Italy’s AI Law appears to address some of these gaps, offering a more pragmatic and enabling framework for healthcare research.

Happy GDPR-compliant Xmas and a prosperous new year!

December 23, 2024Legal news231, aifa, compliance, data protection, Garante Privacy, GDPR, healthcare, Italian Data Protection Authority, italy, law, lawyer, medical device, pharma, privacy, regulatoryFrancesco Stelio Clerici

Winter recess is about to start. While we’ll all be resting, GDPR will not!

While we will all be recharging our batteries to tackle the challenges for the upcoming 2025, GDPR will not go on vacation, and will thus never be out-of-office!

Check out the following tips that the Italian Data Protection Authority has recently issued in order to avoid threats to your privacy rights during the upcoming vacations:

Are you receiving plenty of virtual greetings and commercial offers? Be careful about them, even if apparently sent by a friend or parent: they may contain viruses, obscure links or may hide tentative of phishing. Not all presents may be welcome.
Have you taken good family pictures that you wish to share on your social network? Don’t forget to ask consent of all depicted individuals. Is your grandpa going to provide his consent as well?
Have you filmed your children’s Christmas pageant? Keep it for yourself! You’d need consent from all depicted individuals for publishing (including from their parents in case of minors).
Are you wishing to download any specific Christmas-related app on your smartphone? Choose them carefully, check their issuer and the reviews. You may inadvertently be downloading the Grinch’s one!
Are you going away for a trip? Don’t share too much information and pictures on your social media about your time off, your house and your vehicles, as it may attract thieves. Only Santa Claus shall be allowed to break in without your consent!
Are you connecting with your hotel’s or restaurant’s Wi-Fi? Ask the staff about its security: they may not be protected enough.
Have you bought any “smart” presents for your little nephews? Check whether they may collect any personal data from their users. In the affirmative, make sure that they will not harm them in any way possible.

Our own additional tips: rest, enjoy good food, spend time with your loved ones, and get ready for 2025! We wish you happy holidays and a healthy and successful new year.

Gitti and Partners Life Sciences Team

New Guidelines on Web Scraping

June 20, 2024Legal newsGDPR, italy, law, privacyleonardomoscatigrplex

Pursuant to Article 57(1)(b) of the GDPR, on May 20, 2024 the Italian Data Protection Authority (“Italian DPA”) adopted guidelines [LINK] on web scraping, with the aim of providing guidance to operators of websites and online platforms, acting in Italy as data controllers of personal data made available online to the public.

Web scraping is defined by the Italian DPA as the massive collection of personal data from the web for the purpose of training generative artificial intelligence models. Specifically, whenever such phenomenon involves the collection of traceable information – linked to an identified or identifiable natural person – a data protection issue arises with reference to the identification of an appropriate legal basis for the processing of such data.

According to the guidelines, the assessment of the lawfulness of web scraping must be carried out on a case-by-case basis. Personal data are made available on the web as a result of a primary level processing by operators of online platforms as data controllers. Only then, third parties – often web robots or “bots” – may gather such data for different purposes while scraping the web. This is the reason why the Italian DPA addresses its guidelines to operators of online platforms: they are, in fact, the only ones able i) to more easily evaluate how data are used after being scraped from their platforms and ii) to implement measures on their platforms that may prevent or mitigate web scraping activity for purposes of training algorithms.

Possible precautions or enforcement actions identified by the Italian DPA are the following:

Creation of restricted areas, which can only be accessed after registration. In this way, certain personal data would be removed from public availability;
Inclusion of ad hoc clauses in the terms of service of the online platform expressly prohibiting the use of web scraping techniques;
Monitoring network traffic to detect any abnormal flow of data and adopting limits as countermeasures;
Direct intervention on bots (e.g. insertion on websites of CAPTCHA checks or monitoring log files to block undesirable users).

Such measures should be adopted by the data controller after an independent assessment – in compliance with the accountability principle, which increasingly appears to govern new data protection legislation and strategies. At any rate, the Italian DPA acknowledges that, albeit useful, none of these measures can be expected to entirely prevent web scraping from happening.

Processing Health Data: the Most Recent Amendment to Italian Privacy Code

May 31, 2024Legal newsdata protection, GDPR, healthcare, innovation, Italian Data Protection Authority, italy, law, privacyleonardomoscatigrplex

The Italian “Privacy Code” (Legislative Decree No. 196/2003), which governs data protection in Italy together with the European GDPR, has recently been amended.

Law No. 56/2024, further implementing the National Recovery and Resilience Plan, intervened on section 110 of the Privacy Code, which deals with the processing of health-related data for the purposes of medical, biomedical or epidemiological scientific research.

Section 110 provides that consent of the data subject for the processing of health-related data for the purpose of medical, biomedical or epidemiological scientific research is not required when:

the research is carried out on the basis of legal provisions or European Union law, when processing is necessary for scientific research or statistical purposes, provided that an impact assessment is carried out pursuant to sections 35 and 36 of the GDPR; or
informing the data subject is impossible or involves a disproportionate effort, or would render impossible or seriously jeopardise the attainment of the purposes of the research.

In such cases – before the latest amendment – the data controller had to:

1) take appropriate measures to protect the rights, freedoms and interests of the data subject;

2) obtain a favorable opinion of the competent ethics committee; and

3) consult the Italian Data Protection Authority prior to processing.

The obligation to consult the Italian Data Protection Authority has now been repealed. Thus, there is no need to apply for the Authority’s clearance prior to processing health-related data (in those cases where consent of the data subject is not required under section 110 of the Privacy Code).

This amendment may have a significant impact especially on retrospective studies for which informing data subjects is particularly burdensome. The data controller will, in fact, be able to proceed without the Authority’s permission. Nonetheless, the data controller will still have to comply with specific guarantees and ethical rules issued by the Authority – as specified by the amended section 110.

On the one hand, the amended section 110 seems to favor accountability and to soften the procedural requirements in processing health data for research purposes, making the overall procedure quicker. When it comes to “secondary use” of health data, the accountability approach should be considered strong enough to protect data and favorably welcomed, as it moves in the same direction of the European Health Data Space – which intends to provide a reliable and efficient system for the re-use of health data in areas as research and innovation.

On the other hand, though, the Italian Data Protection Authority has already issued some interim guarantees, specifying that data controllers – when processing health data related to deceased or non-contact subjects – must carry out and publish an impact assessment, pursuant to section 35 of the GDPR, notifying it to the Authority. It remains to be seen how the amendment will be handled by the Authority in practice: the effects of the simplification provided by the new version of section 110 may be diminished if the guarantees set forth by the Authority generate equally articulate procedures.

Processing of personal and health data through apps and online platforms aimed at connecting HCPs and patients: the new digest of the Italian DPA

April 15, 2024Legal newsAPP, data, data controller, data processor, data protection, data subject, Data Transfer, dpa, dpia, garante, gdpd, GDPR, hcp, health, health data, healthcare, heath app, innovation, Italian Data Protection Authority, italy, law, privacy, regulationFrancesco Stelio Clerici

On March 2024, the Italian Data Protection Authority (“Italian DPA”) has issued a new digest (“Digest”) relating to the processing of personal data, whether or not concerning health data pursuant to section 9 of the GDPR, carried out through the utilization of platforms, accessible through apps or web pages (“Platforms”), that aim to facilitate connection between healthcare professionals (“HCPs”) and patients.

The use of such Platforms poses high risks to the protection and security of patients’ personal data, and in particular health-related data, given that the latter are subject to an enhanced protection regime set forth by section 9 of the GDPR.

The Digest seeks to summarize the applicable data protection rules that may be followed, and defines the roles of the parties, as well as the legal bases, applicable to (i) the processing of personal data of the users by Platform’s owners; (ii) the processing of HCP’s personal data by Platform’s owners; and (iii) the processing of health data of the patients by the Platform’s owner and by the HCPs.

Additional guidance is provided as to:

The necessity for the Platform’s owner to carry out (and periodically update) a data protection impact assessment (DPIA) pursuant to section 35 GDPR, since the use of Platforms determine a “high risk” processing of personal data, as such kind of treatment automatically meets the criteria issued by the European Data Protection Board for the identification of the list of data processing that may be deemed subject to the duty to perform a DPIA;
Which information notices should be provided, by who and to whom, as well as the contents that such information notices should have in each case, according to sections 13 and 14 GDPR;
The specific rules applicable to cross-border data transfers and data transfer to third countries.

Lastly, the Digest includes a list of the most common measures that are taken by the data controllers to ensure an appropriate level of technical and organizational measures to meet the GDPR requirements, such as encryption, verification of the qualification of the HCPs that seek to enroll within the Platform; strengthened authentication systems, monitoring systems aimed at preventing unauthorized access or loss of data.

The Digest should be very welcomed by the Platform’s owners, as it now gives a reliable and complete legal frame that may be followed in order to set up a Platform in a way which is compliant with the GDPR principles.

A New European Digital Identity

April 5, 2024Legal newsdigital wallet, digital-identity, EU Commission, european digital identity, GDPR, privacy, regulation, technologyleonardomoscatigrplex

On March 26, 2024 the Council adopted a new framework for a European digital identity (eID).

Background. In June 2021, the Commission proposed a framework for a eID that would be available to all EU citizens, residents, and businesses, via a European digital identity wallet (EDIWs). The new framework amends the 2014 regulation on electronic identification and trust services for electronic transactions in the internal market (eIDAS regulation n. 910/2014), which laid the foundations for safely accessing public services and carrying out transactions online and across borders in the EU. According to the Commission, the revision of the regulation is needed since only 14% of key public service providers across all Member States allow cross-border authentication with an e-Identity system.

Entry into Force. The revised regulation will be published in the EU’s Official Journal and will enter into force 20 days after its publication. The regulation will be fully implemented by 2026.

Digital Wallets. Member States will have to offer citizens and businesses digital wallets that will be able to link their national digital identities with proof of other personal attributes (e.g., driving license, bank account). Citizens will be able to prove their identity simply using their mobile phones.

EU-wide Recognition. The new EDIWs will enable all citizens to access online services with their national digital identification, which will be recognised throughout the EU. Uses of EDIWs include: opening a bank account, checking in in a hotel, filing tax returns, storing a medical prescription, signing legal documents.

The Right to Digital Identity. The fundamental purpose of the regulation is to establish the right to a digital identity for Union citizens and to enhance their privacy.

Main features of EDIWs. According to the new regulation:

• the use of EIDWs shall be voluntary and shall be provided directly, under mandate or recognition by a Member State;

• EDIWs shall enable the user to (1) securely request, store, delete, share person identification data and to authenticate to relying parties; (2) generate pseudonyms and store them encrypted; (3) access a log of all transactions and report to the national authority any unlawful or suspicious request for data; (4) sign or seal by means of qualified electronic signatures; (5) exercise the rights to data portability.

Privacy. Privacy will be safeguarded through different technologies, such as cryptographic methods allowing to validate whether a given statement based on the person’s identification data is true without revealing any data on which that statement is based. Moreover, EDIWswillhave a dashboard embedded into the design to allow users to request the immediate erasure of any personal data pursuant to Article 17 of the Regulation (EU) 2016/679.