Acquired Record: garanteprivacy.it

State Surveillance and the Privacy of Extraneous Third Parties: Reforming Judicial Interceptions and Digital Archives

garanteprivacy.itItalia2026public

#investigation#document#giustizia#intercettazioni#privacy

Verified Primary Investigative Source: garanteprivacy.it — Italia

Editorial Transparency & Fair Use Notice

Investigative dossier curated and structured by the Unclessify editorial team based on official disclosures, court filings and declassified records published by garanteprivacy.it. Historical context, analytical synthesis, and editorial commentary are provided by Unclessify under Public Interest, Freedom of the Press, and Fair Use principles.

Read Full Editorial Policy & Source Transparency →

Official Records & Declassified Dossier

Executive Summary and Public Interest

The indiscriminate capture and secondary dissemination of private communications belonging to uncharged third parties represents one of the most critical structural vulnerabilities within modern criminal proceedings. While telecommunication interceptions remain an indispensable investigative asset for prosecuting severe offenses, procedural loopholes historically allowed extraneous conversations—containing intimate, reputational, or special categories of personal data—to leak beyond the core evidentiary perimeter.

This dossier examines the evolving legal architecture governing electronic surveillance, the statutory filtering of transcripts, and the procedural boundaries designed to halt the unwarranted circulation of captured data. By scrutinizing normative revisions and technical execution standards, this investigation details how extraneous data handling directly impacts fundamental civil liberties and constitutional fair-trial guarantees.

Understanding these institutional dynamics is paramount for public oversight. When state-authorized surveillance tools capture individuals who are entirely foreign to criminal investigations, the absence of prompt judicial weeding mechanisms, digital archiving safeguards, and malware accountability undermines public trust in the rule of law and the administration of justice.

Historical and Procedural Context

For decades, the procedural framework governing judicial interceptions in Italy has struggled to reconcile the conflicting demands of effective prosecutorial investigation, judicial publicity, and constitutional privacy protections. Historically, broad wiretapping authorizations frequently captured incidental conversations involving non-parties, which were subsequently transcribed into procedural records without an early, rigorous filtration mechanism.

The persistent risk of reputational injury became evident whenever raw wiretap transcripts leaked into public circulation prior to trial scrutiny. Early legislative attempts sought to address these vulnerabilities, most notably through historical proposals such as draft bill AS 1512 during the XV Legislature, which envisioned dedicated protective mechanisms under projected provisions like Article 268-sexies of the Code of Criminal Procedure (c.p.p.) to alert individuals whose conversations had been captured before irreversible press leaks occurred.

The tension intensified with the transition from traditional telephonic wiretaps to intrusive digital surveillance, specifically via remote electronic capture devices and software malware commonly known as trojans. The technical deployment of state-commissioned spyware introduced severe systemic risks regarding operational boundaries, evidentiary chain of custody, and third-party data containment.

Critical operational failures in commercial malware implementation, exemplified by the 2019 Exodus spyware scandal, exposed the dangerous consequences of delegating intrusive surveillance operations to external technical providers under Article 348, paragraph 4 of the c.p.p. without rigorous, audited security frameworks. In that incident, defective and insecure surveillance software collected extraneous user data, illustrating the acute necessity of strict regulatory standards.

To confront these structural deficiencies, successive regulatory interventions, including Decree-Law 132/2021 (converted with amendments into Law 178/2021), established stricter statutory conditions for deploying trojan malware. Specifically, judicial authorization decrees were mandated to articulate the indispensable investigative necessity of the spyware and, for offenses outside district prosecutor jurisdiction or grave crimes against public administration, explicitly delineate the temporal and geographical boundaries governing microphone activation.

Institutional Actors and Structural Entities

The operational landscape governing electronic surveillance comprises key constitutional, regulatory, and judicial bodies tasked with maintaining procedural integrity and data security.

Garante per la protezione dei dati personali (Italian Data Protection Authority)

The national supervisory authority responsible for monitoring the processing of personal data across public and private sectors. In its consultative and regulatory capacity, the Authority evaluates draft primary legislation touching upon the treatment of personal records within judicial archives, the transcription of wiretaps, and procedural safeguards under European and domestic data protection frameworks.

Parliament of Italy (Legislative Assemblies)

The legislative branches responsible for deliberating statutory amendments to the Code of Criminal Procedure, the implementing provisions (disp. att. c.p.p.), and sector-specific privacy transposition statutes that calibrate the rights of investigative authorities against individual civil rights.

Judicial Authorities and Public Prosecutor Offices

The magistrates, preliminary investigation judges (GIP), and prosecuting bodies directing judicial police operations, executing interception decrees, overseeing digital archive transfers (RIT - Registro Intercettazioni Telefoniche), and managing the formal evidentiary stralcio (severance) proceedings.

External Technical Auxiliaries and Software Providers

Private entities appointed under Article 348, paragraph 4 of the c.p.p. to supply technological solutions, host digital communication relays, and develop capture malware. These contractors operate under statutory mandates requiring absolute software reliability, security, and containment to prevent unauthorized lateral data harvesting.

Critical Evidence Analysis and Regulatory Architecture

A rigorous examination of the normative mechanics reveals significant legal safeguards, alongside lingering technical and procedural vulnerabilities that demand detailed analysis.

Publication Bans and Exclusionary Transcription Rules

The core reform centers on amending Article 114 c.p.p. by instituting a general prohibition against the publication, even in partial form, of wiretap content unless it has been explicitly reproduced by a judge within the legal reasoning of a judicial order or formally introduced during the public trial hearing. This provision is designed to insulate raw investigative materials from preemptive media exposure.

Parallel modifications to Article 268, paragraph 2-bis c.p.p. reinforce this safeguard at the initial drafting stage. Investigative transcripts must exclude expressions injurious to individual reputation or those concerning special categories of personal data—as harmonized with Article 9 of the General Data Protection Regulation—unless strictly relevant to the investigation. Crucially, the reform expands this exclusion to include personal data relating to subjects entirely different from the investigated parties.

“The reform introduces a general ban on the publication, even partial, of the content of interceptions that is not reproduced by the judge in the motivation of a measure or used during the hearing, while excluding non-party data from formal transcripts.”

This statutory filtration is mirrored in the amendment to Article 268, paragraph 6 c.p.p., which integrates non-party personal data into the formal severance procedure (stralcio), ensuring that irrelevant recordings and records are systematically segregated from the main evidentiary dossier.

Digital Archive Integrity and Endoprocedural Circulation

The containment of intercepted records within secure judicial digital archives requires rigorous statutory coherence. Article 89-bis, paragraph 2 of the implementing provisions (disp. att. c.p.p.) must align with Article 268 c.p.p. to ensure that all segregated materials concerning non-parties are cataloged exclusively within restricted archives indexed by their Interception Register Number (RIT).

To prevent continuous exposure during proceedings, structural provisions allow for provisional destruction of sensitive non-party logs upon final, irrevocable judgment, mirroring the disposal architecture established under Article 262 and Article 269, paragraph 2 c.p.p.

Enforceability via Article 14 of Legislative Decree 51/2018

A significant procedural advancement lies in activating the special remedies established by Article 14 of Legislative Decree 51/2018. Unlike standard procedural motions limited strictly to formal defendants and prosecutors, Article 14 grants standing to “anyone who has an interest” (chiunque vi abbia interesse).

This allows an impacted third party to petition the presiding judge directly during an active criminal proceeding to obtain the rectification, erasure, or restriction of their personal data. When systematically connected with the destruction regime of Article 269 c.p.p. and strict limitations on internal procedural circulation, this mechanism establishes an enforceable judicial remedy against non-party data abuse.

Guaranteed Notification and Technical Compliance of Trojans

Procedural privacy safeguards also extend to notifications. Under Article 369, paragraph 1-quater c.p.p., the formal information of judicial inquiry (informazione di garanzia) must be delivered, even when served to individuals other than the direct recipient, under strict protocols guaranteeing recipient confidentiality, while explicitly adhering to the publication restrictions of Article 114, paragraph 2 c.p.p.

Finally, the integrity of digital evidence demands strict compliance standards under Article 89, paragraphs 2 and 4 disp. att. c.p.p. Authorizing decrees must enforce verified requirements of reliability, security, and operational efficacy on all malware software, precluding untrusted code from violating the digital chain of custody or executing unapproved ambient surveillance.

Transparency, Verification, and Legal Basis

This investigative dossier is constructed upon official institutional opinions and regulatory evaluations issued by the Italian Data Protection Authority regarding draft legislative amendments to the Italian Code of Criminal Procedure and related implementing rules.

The source documentation is published under the legal framework of Article 5 of Italian Law no. 633/1941, which establishes that official texts of state and public administration acts are exempt from copyright and belong to the public domain.

Primary document reference: Italian Data Protection Authority Official Opinion on the Draft Bill regarding Interceptions and Information of Guarantee, Docweb ID 9927390 (garanteprivacy.it/docweb/9927390). Archival verification confirms that all cited normative proposals, procedural articles, and technical criteria reflect documented institutional records.

What this piece rests on

Source act

garanteprivacy.it/home/docweb/-/docweb-display/docweb/992…

The text was checked against the facts listed below, extracted from the act above. It does not yet carry corroboration from independent sources.

The 20 facts verified in the text

Per quanto riguarda le competenze di questa Autorità rilevano, in maniera particolare, le disposizioni introdotte dall’articolo 2, in materia di intercettazioni e informazione di garanzia, di seguito esposte.
RILEVATO Le lettere da a) a d), n.1, ed e), n.2), del comma 1 dell’articolo 2, introducono una significativa riforma del regime di pubblicità del contenuto delle intercettazioni e alcune, rilevanti, modifiche sulla disciplina della loro trascrizione, volte a rafforzare le garanzie di riservatezza dei soggetti le cui conversazioni siano state oggetto di captazione e, in particolare, dei terzi.
In primo luogo la lettera a), nel novellare l’art. 114 c.p.p., introduce il divieto generale di pubblicazione, anche parziale, del contenuto delle intercettazioni che non sia riprodotto dal giudice nella motivazione di un provvedimento o utilizzato nel corso del dibattimento.
La lettera c), nel novellare il comma 2-bis dell’articolo 268 c.p.p. include nella categoria di espressioni che non devono essere riportate nei verbali di trascrizione (oltre a quelle lesive della reputazione delle persone o che riguardano dati personali “definiti sensibili dalla legge”, salvo che risultino rilevanti ai fini delle indagini), anche quelle che riguardano dati relativi a soggetti diversi dalle parti.
Sul punto, è opportuno rilevare, incidentalmente, che la qualifica di “sensibili” dei dati personali soggetti a maggiore tutela è stata modificata in quella, di cui all’articolo 9 del Regolamento, di dati appartenenti a “categorie particolari”, cui peraltro si riferisce, correttamente, il comma 6 del medesimo articolo 268, il cui testo andrebbe dunque, sotto questo profilo, uniformato.
Dell’articolo 268 è modificato anche il comma 6, per includere nella procedura di stralcio ivi prevista (oltre alle registrazioni e ai verbali di cui è vietata l'utilizzazione e di quelli che riguardano “categorie particolari” di dati personali, sempre che non ne venga dimostrata la rilevanza), anche quelli che riguardano soggetti diversi dalle parti.
Per altro verso, per quanto concerne la disciplina dell’informazione di garanzia, meritevole di apprezzamento è la previsione, introdotta al comma 1-quater dell’articolo 369 c.p.p., del vincolo di effettuazione della notificazione, anche mediante consegna a persona diversa dal destinatario, “in modo tale da garantire la riservatezza del destinatario”.
Si riconduce inoltre, espressamente, l’informazione di garanzia alla disciplina della pubblicità degli atti d’indagine di cui all’articolo 114, c.2, c.p.p. (art. 369, c. 1-quinquies, c.p.p., introdotto dalla lettera m), n.2, del comma 1 dell’articolo 2 del disegno di legge).
In tal senso, all’articolo 89-bis, c.2, primo periodo, disp. att. c.p.p., si potrebbero aggiungere, in fine, le seguenti parole: “o, comunque, dati personali relativi a soggetti diversi dalle parti”.
Tale modifica è necessaria per allineare il novero delle intercettazioni da includere nell’archivio digitale con quello relativo alle intercettazioni oggetto di stralcio (art. 268, c.6, c.p.p.).
In tal senso si potrebbe, in particolare, valutare di disporre in sentenza, sul modello dell’articolo 262 c.p.p., la distruzione provvisoria- da effettuarsi tuttavia solo dopo che la pronuncia sia divenuta inoppugnabile: art. 269, c.2, c.p.p. - dei verbali e delle registrazioni conservati nell’archivio digitale, con indicazione del numero RIT (registro intercettazioni telefoniche).
Per altro verso, al fine di garantire l’effettivo rispetto del divieto di circolazione endoprocessuale dei dati captati dei terzi che risultino irrilevanti, si potrebbero agevolare i presupposti di azionabilità della tutela speciale accordata, anche ai terzi e con forme innovative, dall’articolo 14 del d.lgs. 51 del 2018.
Tale norma legittima, infatti, “chiunque vi abbia interesse” (non, dunque, solo le parti processuali, al pari dell’articolo 269, c.2, c.p.p.) a richiedere al giudice, sussistendone i presupposti, la rettifica, cancellazione o la limitazione dei dati che lo riguardano, anche durante il procedimento penale.
Si tratta di una norma dalle notevoli potenzialità che, combinandosi con la procedura di distruzione di cui all’articolo 269, potrebbe contribuire a rafforzare sensibilmente le garanzie di riservatezza soprattutto dei terzi, le cui conversazioni siano state indirettamente captate.
Naturalmente, l’effettività della norma sarebbe rafforzata con un sistema analogo a quello previsto dall’art. 268-sexies c.p.p. - di cui l’art. 10 AS 1512, XV legislatura, prospettava l’introduzione- per evitare che il soggetto apprenda dell’esistenza, in atti processuali, di proprie conversazioni, direttamente dalla stampa, quando ormai l’intervento ablativo sarebbe tardivo.
In tal modo, tramite la connessione procedimentale tra il diritto di cui all’articolo 14 d.lgs. 51, l’istituto della distruzione di cui all’articolo 269 c.p.p. e i proposti limiti alla circolazione endoprocedimentale dei dati dei terzi, potrebbe essere accordata una tutela realmente effettiva alla riservatezza.
La necessità di tali garanzie sembra, peraltro, asseverata da alcune vicende (si pensi al caso Exodus del 2019), relative a particolari modalità di realizzazione delle captazioni mediante malware, da parte delle società incaricate ai sensi dell’articolo 348, comma quarto, c.p.p.
Si potrebbe esplicitare, in questo senso, il requisito, di cui all’articolo 89, c.4, disp. att. c.p.p., della “affidabilità, sicurezza ed efficacia” dei software utilizzabili a fini captativi (che devono appunto limitarsi alle sole operazioni autorizzate), garantendo così effettivamente la completezza della catena di custodia della prova informatica.
Sarà peraltro opportuno chiarire, all’articolo 89, c.2, disp. att. c.p.p., le conseguenze del ricorso a programmi informatici non conformi ai requisiti di sicurezza previsti con il d.M.
Certamente positiva è la previsione della necessità d’indicazione, nel decreto autorizzativo, delle ragioni di indispensabilità dell’utilizzo del trojan (introdotta dal d.l. 132 del 2021, convertito, con modificazioni, dalla legge n. 178 del 2021) e, per i delitti diversi da quelli di competenza delle Procure distrettuali o dai più gravi contro la p.a., dei luoghi e dei tempi di attivazione del microfono.

Click to switch theme: