Lead: Public Interest in Non-Governmental Judicial Data Processing
The boundary between effective crime prevention and individual privacy safeguards undergoes its most delicate test when private or semi-public entities handle criminal records outside direct state oversight. Regulatory decrees under Italian privacy legislation define exactly when non-judicial bodies may process information on criminal convictions and preventive anti-mafia measures. Establishing these boundaries ensures that organized crime screening protocols remain legally sound without eroding fundamental civil protections.
Historical and Legal Context: The Transition from General Authorizations to GDPR Alignment
The legal architecture governing judicial data in Italy underwent structural reform following the adaptation of national legislation to the General Data Protection Regulation. Under the previous regime established by the 2003 Privacy Code, the processing of judicial data by private actors was primarily managed through recurring General Authorizations issued by the supervisory authority under former Articles 21 and 27. The 2018 legislative overhaul shifted this mechanism toward formal governmental decree under Article 2-octies of the revised Code.
Article 10 of the European regulation establishes a strict baseline: processing of personal data relating to criminal convictions, offences, or related security measures may only take place under the control of official authority, or when authorized by Union or Member State law providing appropriate safeguards. Because national legal systems across the European Union diverge significantly regarding non-conviction security and prevention measures, the European text did not explicitly harmonise prevention orders within its primary wording.
In the Italian legal framework, personal prevention measures have historically formed an essential pillar of crime control and anti-mafia strategy. Prior to 2018, Article 4, paragraph 1, letter e) of the Code explicitly classified personal prevention measures—as referenced in Article 3, paragraph 1, letter l) of Presidential Decree 313/2002—within the definition of judicial data. Omitting these measures from the modern post-GDPR regulatory perimeter would have created a substantial regression in personal data protection.
The draft regulation submitted to the national supervisory authority stems from extensive bilateral exchanges, formally marked by the institutional note of December 18, 2020, from the Service for Legislative and Institutional Affairs. This administrative instrument bridges the regulatory gap by codifying the specific sectors where judicial data processing is permitted, replacing the historical reliance on provisional administrative authorizations with a stable statutory foundation.
Key Institutional Actors
The regulatory and consultative framework involves key institutional entities responsible for data protection, justice administration, and internal security:
[[Garante per la protezione dei dati personali|Q3758624]]: The national supervisory authority tasked with monitoring compliance with data protection laws, reviewing draft regulatory schemes, and issuing binding opinions on the processing of sensitive and judicial information.
[[Ministry of Justice (Italy)|Q3858474]]: The primary executive department responsible for drafting the regulation under Article 2-octies of the Code, determining the lawful cases and specific safeguards for handling judicial data outside direct public authority control.
[[Ministry of the Interior (Italy)|Q3858475]]: The co-signatory department for provisions governing data processing linked to memoranda of understanding and collaborative protocols executed with prefectures for organized crime prevention.
[[General Data Protection Regulation|Q1155990]]: The overarching European legal framework whose Article 10 requires specific statutory safeguards whenever national legislation permits judicial data processing by non-public bodies.
Critical Analysis of the Regulatory Schema: Scope, Deficits, and Safeguards
A rigorous examination of the regulatory draft reveals both critical systematic alignments and notable drafting omissions that impact legal certainty. Article 1 of the scheme establishes the objective scope by setting out the cases, modalities, and mandatory safeguards governing judicial data. However, the initial text restricted its formal scope to data relating to criminal convictions and offences, omitting an explicit reference to connected security measures—an omission identified as a drafting error that required corrective alignment with the broader rubric of Article 2-octies.
The material scope expands from Article 5 onward, delineating specific operational sectors that largely mirror the historical categories covered by the former General Authorizations under Articles 21 and 27 of the pre-reform Code. The choice to include prevention measures within the protective scope of Article 10 represents a necessary adaptation to Italian reality. Because prevention measures operate as autonomous pre-trial or non-conviction instruments, failing to subject them to the stringent safeguards of Article 10 would expose individuals to unregulated secondary screenings by private entities.
The legitimacy of the regulatory source to permit the processing of data referred to in Article 10 of the Regulation derives from this same provision, which allows it—if carried out not under the control of public authority—only if authorized by European Union or Member State law providing appropriate safeguards for the rights and freedoms of data subjects.
A central innovation within the text is Article 13, which regulates the processing of judicial data executed under memoranda of understanding signed with the Ministry of the Interior or local Prefectures. These anti-mafia protocols permit private signatories to screen counter-parties, contractors, and personnel. To prevent unchecked proliferation of informal intelligence, the schema strictly confines admissible data to qualified official sources.
Permissible Data Sources Under Protocol Treatments
Under the regulatory provisions, data collection cannot rely on informal reporting, hearsay, or non-definitive police annotations. Permissible sources are exclusively limited to:
1. Definitive criminal judgments, including plea-bargain rulings issued under Article 444 of the Italian Code of Criminal Procedure;
2. Irrevocable penal sentencing decrees;
3. Definitive judicial orders applying personal prevention measures.
The supervisory analysis further highlighted structural cross-referencing gaps. The general safeguards outlined in Article 4, paragraph 1 of the draft scheme were designed to extend to data treatments governed by external normative provisions lacking explicit protections. While this extension directly applies under paragraph 4 of Article 2-octies, legal consistency demands that the same guarantees cover treatments under paragraph 5. The absence of explicit coordination between Article 1, paragraph 2, Article 2, and the foundational definitions in Article 4 of the GDPR leaves open procedural questions regarding the uniform application of data minimization principles across private screening bodies.
Transparency and Legal Foundation
This dossier is compiled from official administrative proceedings and legislative consultations conducted between the Italian Ministry of Justice and the national data protection authority. The foundational documentation includes the formal regulatory review opinion on the draft decree issued pursuant to Article 2-octies of Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018.
In accordance with Article 5 of Italian Law No. 633/1941, official texts of state acts and public administrative bodies are not subject to copyright and reside in the public domain. The complete source text and accompanying normative citations are accessible through the official institutional archive of the Garante per la protezione dei dati personali.