Italy recently implemented Directive 2019/2161, known as the Omnibus Directive. Summarized in this slideshow, you may find our key takeaways for e-commerce.
Tag Archives: italy
GARANTE VS. CHATGPT: LATEST DEVELOPMENTS
1. An Order to Stop ChatGPT
On March 30, 2023 the Italian Data Protection Authority (“Garante”) issued an order by which it temporarily banned the ChatGPT platform (“ChatGPT”) operated by OpenAI LLC (“OpenAI”). The Garante in fact regards ChatGPT as infringing Articles 5, 6, 8, 13 and 25 of the GDPR. In particular:
- No Information. OpenAI does not provide any information to users, whose data is collected by OpenAI and processed via ChatGPT;
- No Legal Basis. There is no appropriate legal basis in relation to the collection of personal data and their processing for the purpose of training the algorithms underlying the operation of ChatGPT;
- No Check of User’s Age. OpenAI does not foresee any verification of users’ age in relation to the ChatGPT service, nor any filters prohibiting the use for users aged under 13.
Given that, the Garante has immediately banned the use of ChatGPT, and OpenAI has blocked the access to ChatGPT to the Italian people.
2. Measures Offered by OpenAI
On April 11, 2023, in light of the willingness expressed by OpenAI to put in place measures to protect the rights and the freedom of the users of ChatGPT, the Garante issued a new order, which opened the possibly to re-assess ChatGPT if OpenAI adopts the following measures:
- to draft and publish an information notice to data subjects, which should be linked so that it can be read before the registration;
- to make available, at least to data subjects who are connected from Italy, a tool to exercise their right to (i) object, (ii) obtain a rectification, insofar as such data have been obtained from third parties, or (iii) the erasure of their personal data;
- to change the legal basis of the processing of users’ personal data for the purpose of algorithmic training, by removing any reference to contract and instead relying on consent or legitimate interest;
- to include a request to all users connecting from Italy to go through an “age gate” and to submit a plan for the deployment of age verification tools; and
- to promote a non-marketing-oriented information campaign by May 15, 2023 on all the main Italian mass media, the content of which shall be agreed upon with the Italian Authority.
OpenAI has until April 30, 2023 to comply (until May 31, 2023 to prepare a plan for age verification tools). The objections by the Garante have been echoed by other European Union data protection authorities. The European Data Protection Board will be attempting to solve the dispute within two months and launched a dedicated task force on ChatGPT “to exchange information on possible enforcement actions conducted by data protection authorities”
PAYBACK ON MEDICAL DEVICES IN ITALY: LATEST UPDATES
The medical devices sector in Italy has been struggling for several months now as the Government is retroactively demanding that sellers of medical devices refund a quota of the excessive expenses sustained by the regional health systems during the years 2015-2018.
In fact, following a law decree enacted in August 2022, businesses and companies that won public tenders and provided Italian hospitals with medical devices from 2015 and onwards have been requested to turn back to the Regions part of the relating income, for a total amount of more than 2 billion euros.
In December 2022, Regions issued decrees ordering that the medical devices operators pay their respective quotas of the so-called “payback” contribution by the end of January 2023.
However, hundreds of claims were filed before the Administrative Court of Rome and the Government decided to postpone the payment deadline to 30 April 2023.
As the payment deadline draws closer, it appears that on yesterday’s Council of Ministers the Government issued a new law decree providing for a (still unspecified) discount in favour of businesses and companies that waive all claims and pay the discounted contribution by 30 June 2023.
While this new law decree is yet to be published on the Official Journal, it seems likely that the compromise reached at political level will not satisfy the expectations of several companies operating in the medical devices sector, meaning that the challenge is far from over.
New Whistleblowing Legislation Adopted in Italy
Italy has implemented today the EU whistleblowing directive (UE) 2019/1937. The new legislative decree no. 24/2003 has in fact been published on the official journal and is scheduled to enter into force on March 30, 2023.
The final published version of the decree, which had been previously leaked in an unofficial draft, can be found here: https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg.
The new legislation is certain to affect private companies and public entities alike when it comes to managing whistleblowing reports and new measures may need to be adopted to comply with the new requirements.
For additional information on this subject, materials from our February webinar can be freely accessed here: https://lawhealthtech.com/2023/02/09/our-whistleblowing-webinar/.
Italian Transparency Act: the Opinion of the Italian Data Protection Authority
The Italian Data Protection Authority has issued its opinion on the data protection implications relating to the new information duties set forth on employers by legislative decree 104/2022.
On August 13, 2022, legislative decree 104/2022 (“Transparency Act”) has entered into force. It provides for a new set of mandatory information that the employer must communicate to its employees at the time of their onboarding. On January 24, 2023, the Italian Data Protection Authority (“Garante”) issued its opinion about compliance of such new information duties with the provisions of the relevant data protection legislation.
In particular, the focus of the Garante was centered on the mandatory communication that, according to section 4, paragraph 8 of the Transparency Act, the employer must give to the employees if any “decision or monitoring automated system is used for the sake of providing information which is relevant for the hiring, management or termination of the employment relationship, for the assignment of tasks and duties, or for the surveillance, evaluation and fulfillment of contractual duties by the employee”. The Garante has stated that:
- GDPR Sanctions Apply in case of Breach. The implementation of any decision or monitoring automated system must be made in compliance and within the limits set forth by the applicable labor law provisions, and in particular law 300/1970. Such labor law provisions, which allow the implementation of automated systems only if certain conditions occur, must be deemed as providing “more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context” (as per section 88, paragraph 2, of the GDPR), and thus non-compliance with them may lead to administrative fines pursuant to section 83 of the GDPR.
- Data Processing Impact Analysis (“DPIA”). The employer, who is subject to the duty of accountability, must assess beforehand if the relevant processing is likely to result “in a high risk to the rights and freedoms of natural persons responsibility”, and thus requires a preliminary data processing impact analysis under section 35 of the GDPR. In such regard, the Garante has clarified that data subjects (i.e., employees) should be deemed as “vulnerable”, and that the processing of their data with automated systems is very likely to meet the conditions that make the DPIA mandatory according to the guidelines on the DPIA issued by the WP 29 on April 4, 2017.
- Compliance with the “privacy by default” and “privacy by design” principles. Employers must implement appropriate technical and organizational measures and integrate the necessary safeguards into the processing so that to protect the rights of data subjects (privacy by design). Moreover, the controller shall ensure that, by default, only personal data which are necessary for the specific purpose of the processing are processed (privacy by default), and should then refrain from collecting personal data that are not strictly related to the specific purpose of the relevant processing.
- Update of the register of processing activities (“ROPA”). The employer must indicate the processing of data through automated systems within his/her ROPA.
Need any further assistance on the matter? Don’ hesitate to reach us out!
EU Artificial Intelligence Act
Abuse of Economic Dependence: Digital Platforms with a Key Role
Italian law now includes a new provision on abuse of economic dependence with a special focus on digital space. Abuse of economic dependence is prohibited and triggers nullity of the agreement concerned and, if the abuse is considered to be affecting competition on the market, additional administrative sanctions issued by the Italian antitrust authority.
The Italian annual bill on competition modified Article 9 of Italian law no. 192/1998 and introduced a presumption of economic dependence applicable to contractual relationships where digital platforms play a “key role” in reaching end users and/or suppliers. The presumption shifts to digital platform operators the burden of proving the absence of economic dependence.
The law does not offer a specific definition of “digital platform”, therefore a wide range of entities, including marketplaces and search engines, can be included in the scope of the rule. For the provision to apply, however, a “key role” of the digital platform in reaching end users or suppliers must be proven. “Key role” is a concept that lends itself to multiple interpretations, but some commentators suggested that said criterion could be referring to the gatekeepers as defined by the Digital Markets Act (Regulation (EU) 2022/1925), even if it does not seem to exclude other “minor” operators.
The newly introduced provisions are expected to have a huge impact on relationships between digital platforms operators and their business partners.
Google Analytics under Scrutiny by Italian Data Protection Authority
The second issue of our summer series focuses on the recent decision by the Italian Data Protection Authority, which affects all users of the Google Analytics services in Italy, as well as other similar services that entail the transfer of users’ personal data to the United States.
Read our slides to understand what actions are available to you.
The Italian Sunshine Act
Check Your Website’s Compliance with New Rules on Cookies
The Italian Data Protection Authority’s new guidelines for the processing of cookies are in force. Does your website comply? Find out if the answer is yes (or if you need adjustments) through the Q&A below.
On January 9, 2022, the new guidelines for processing of cookies and other online tracking instruments issued by the Italian DPA have officially entered into force. Take this test to check if you are already compliant.
Q: What kind of cookies are you currently using on your website?
A: The Italian DPA has divided the cookies currently in use in 3 categories:
- Technical cookies: these cookies are the ones strictly necessary to a service provider for the dispensing of a service requested by users.
- Profiling cookies: these cookies are the ones used to create clusters of users, by associating them with specific actions or behavioral patterns. Such cookies are mainly aimed at modulating the delivery of services provided to the user in an increasingly personalized way, as well as to carry out targeted advertising activity.
- Analytic cookies: these cookies are the ones which are aimed at evaluating the effectiveness of the services offered or to measure user “traffic” on the website, by memorizing users’ online activities within the website. These cookies are mainly provided by third party suppliers.
Q: What should I do in case I use TECHNICAL COOKIES?
A: Technical cookies are not subject to any prior consent by the users. This means that you just need to provide the users with a specific cookie policy information, having the details set forth by article 13 of the GDPR. Such policy may also be contained on a specific section of your general privacy policy information.
Q: What should I do in case I use PROFILING COOKIES?
A: Profiling cookies may be used only upon prior consent by the users. You may obtain users’ consents by implementing a cookie banner that will pop up on your website as soon as users log your online page.
Q: What should I do in case I use ANALYTIC COOKIES?
A: Analytic cookies can be processed without any consent by users only if they do not allow any identification (direct identification – i.e. “singling out” – of the person concerned should not be achieved), and if they are used for the production of aggregate data only. Otherwise, they need to be expressly authorized.
Usually, analytical cookies are provided by third parties. In such case, you must provide, within your cookie policy notice, an updated list of all the third party cookies that are implemented within your website.
Q: How do I collect consent by users, when mandatory?
A: You may set up a cookie bannerthat will pop up on your website when users log your online page.
Q: How to draft a cookie banner?
A: First and foremost, cookie banners must be user-friendly and immediately visible. The dimensions of the banner must be neither too small nor too big, if compared with the kind of device used. Their wording must also be simple and easy to understand. In addition, cookie banners must contain a link to the cookie policy notice. No profiling cookies can be implemented before consent by the user. Only technical cookies may be pre-implemented.
Q: Do I have to grant users the possibility to modify their choices?
A: Yes, a specific section on the website must always be included to the end of consenting users to modify their first decisions.
Q: Can I obtain consent by users in other ways?
A: Consent by the user must be free and unambiguous, but there is no mandatory way to obtain consent by the users: you may implement your own system, in accordance with accountability principles set forth by the GDPR so long as consent is unambiguous and through a positive act of the user (“opt in”). No form of implicit consent is acceptable.
Q: Can I propose the banner again in case the user has declined consent?
A: The excessive and redundant use of banners requesting consent is not allowed – except for certain specific exceptions – since this may bring the user to give consent for the sole purpose of interrupting the pop-up of the banner.
Q: What about “cookie walls” and “scroll down”?
A: Don’t use them! A “cookie wall” is a mechanism by virtue of which the denial of the consent by users prevents them from accessing the website entirely. A “scroll down” system assumes the implied consent of the user when browsing of the website without expressing any choice with regard to cookies consent is continued. Neither cookie walls nor scroll down systems are compliant, since they are not aimed at obtaining an express consent by the user.
All clear? If not, reach out to us!
Law, Health & Technology 
You must be logged in to post a comment.