Intellectual Property Law

Recent regulation aimed at simplifying the enforcement of Italian Data Protection Regulation

By IBLS Editor

Since its enactment in 1995, Italian Small Medium Sized Enterprises (SMEs) found numerous difficulties in the enforcement of the Italian Data Protection Code (IDPC) provisions. These difficulties are mainly due to the IDPC complexity as well as to the costs related to its compliance. 

These difficulties lead Garante, the authority empowered to look after the enactment of the IDPC, to enact circular No. 152 on June 19, 2008; published in the ?Official Journal? on July 1, 2008. This circular aimed at simplifying the fulfilments of administrative and bookkeeping data obligations by the public and private sector.

Following such circular, on July 6, 2008, the Italian government issued Legislative Decree n°112/2008, which became Law n° 133 of August 6, 2008, and entered into force on August 21, 2008.  The new regulations aim at facilitating the application of the principles of the IDPC among the SMEs that do not process sensitive personal data; as well as the transfer of personal data outside the EU and among companies within the same group.

Specifically:

1. those subject that do not process sensitive personal data or process only sensitive data concerning the state of health or illness of the employees and project service providers, without any indication of the relative diagnosis, or regarding the accession to the trade union or trade union character, are required to issue a self-certification to notify to the Garante the correct adoption of the measures under the IDPC. Therefore, it is not longer required to prepare a document, named Security Programmatic Document, which involved many efforts and costs and whose preparation was compulsory prior to these regulations;

1. Service to the Garante authority of certain data processing can be made not only via electronics network but also through the Garante?s web-site with a special format published on it, without any digital signature requirement. The document to be served to the Garante shall include:

a)      data information of the treatment holder or of his representative, as well as the formalities to individualize the person responsible for the treatment, if designated;

b)      aim of the treatment;

c)      description of the interested categories;

d)      the recipients or the categories of recipients of the data;

e)      the data transfer to third countries;

f)        general description of the measures adopted to guarantee the safety of the treatment.

Finally, the new regulations make easier the transfer of personal data to companies belonging to same groups, but located outside the European Union. To that extent, the companies exporting the data are required to prepare personal data proper corporate rules of treatment, according to the provisions set forth under the IDPC.  These corporate rules refer to data processing from any company belonging to the group, to allow the free flow of data within companies resident in EU or non EU countries.

Full post as published by IBLS Internet Law Blog on September 29, 2008 (boomark / email).