RPLegal&Tax Associazione Professionale

RP Legal & Tax is an independent law firm, founded in 1949, with 7 offices throughout Italy, major international links, and about one hundred and fifty highly skilled professionals providing full service assistance. With particular regard to privacy and data protection matter, RP Legal & Tax gives assistance on the proper application of the laws governing personal data protection. Analysis of the flow of personal data at an internal, intra-group and external level and subsequent regulation, also via the implementation of appropriate procedures. Assistance in the preparation and management of all fulfilments provided by the existing laws (data processing agreements, privacy notices, consent forms, queries to the Italian DPA, authorizations, DPIA, privacy policy and cookie policy, agreements in general) and the Corporate Security Plan document. Assistance in the management of specific projects and the approach to commercial relations vis-à-vis the law on personal data protection. Assistance in the creation and implementation of promotional activities in compliance with privacy regulations. Management of the pre-litigation phase (requests for clarification from the Italian DPA, inspections) and the litigation phase deriving from the non, partial or incorrect application of regulations on areas covering personal data protection before the Italian DPA and the ordinary courts. Milan Office Piazzale Luigi Cadorna, 4 20123, Milano - Italy E-mail: milano@rplt.itTel: +39 02 87.31.31Fax: +39 02 87.31.33.22 A member of the Milan Bar Association since 1996.Admitted to practice before the highest Courts from 2008. He gained a significant experience in the protection of intellectual and industrial property rights, offering extrajudicial advice and judicial assistance to a broad range of companies as well as to individual inventors and authors. His activity ranges over different scopes of the subject, including patents, industrial secrets, trademarks, domain names, design, advertisement, unfair competition, copyright and privacy matters. Thanks to the assistance rendered since many years to some of the main public and private research institute, especially in the health and biotechnological sector, he is an expert, among other things, in the strategic advice aimed at the construction of organizational models for starting and developing specific scientific projects as well as for better valuing the results of the research. He also gained a noteworthy experience in civil and commercial litigation and in the field of the professional liability. He is a lecturer in intellectual and industrial property law and participates as speaker to conferences. Lawyer specialized in the protection of intellectual and industrial property rights. She offers extrajudicial legal advice and judicial legal aid, with particular reference to the matters related to communication law, publicity, unfair commercial practices, Consumer Code, unfair competition, trademark, image rights, copyrights and to the regulations related to prize contests and promotional activities in general. She also possesses consolidated experience in the data protection field. With regard to privacy, advice in drafting privacy assessment aimed at making data-processing compliant with the GDPR; assistance in the identification of organizational, systematic and contractual structures to be implemented for the correct administration of on-line and off-line databases; drafting of legal deeds, policies and contracts necessary for data-processing compliance; management of the related negotiations. Assistance with big data management. Communications to the competent authorities; management of the abroad transfer of databases and/or their assignment to third parties, OBAs and cookies. Assistance in litigation before ordinary courts and administrative tribunals. Data Protection Officer with the UNI 11696:2017 certification.

Representatives

Chiara Agostini

partner

Gianluca Morretta

member

Contact

Publications

• National AI legislation adopted in Italy: a first look at privacy implicationsItaly has become the first EU Member State to adopt a comprehensive national AI regulatory framework with Law No. 132 of 23 September 2025. The law adapts the Italian legal system to EU Regulation 2024/1689 (AI Act), introducing provisions that overlap with existing data protection regulation, particularly affecting healthcare data processing, worker information duties and transparency obligations in public administration.27 January 2026
• Video surveillance and artificial intelligence: sanctions against a Public Body by the Italian DPAWith the decision No. 5 of 2024, the Italian Data Protection Authority (“DPA”) penalised the Municipality of Trento for the unlawful data processing in two AI surveillance projects. The DPA stated that the AI systems used did not provide adequate data anonymization techniques and that there was the lack of a solid legal basis for data processing.25 June 2024
• ChaptGPT: the Italian Data Protection Authority leads the way and imposes GDPR compliance.The Italian Data Protection Authority recently gained international attention for being the first to address the privacy risks of generative artificial intelligence, ordering the temporary restriction of the Italians’ data processing to OpenAI because of the violation of several GDPR rules. With the implementation of several measures to improve the compliance of this AI system with the GDPR, ChatGPT is back online again in Italy.28 November 2023
• The privacy risks of the “virtual friend”: the Italian DPA clamps down ReplikaThe Italian Data Protection Authority (“Garante Privacy”) has ordered the limitation of the data processing activities carried out by the Replika chatbot due to minors’ data protection concerns.21 April 2023
• Right of access to data: the Italian Data Protection Authority fines company 70,000 euros for failure to respond fully.The Italian Data Protection Authority (“Garante Privacy”) has imposed a fine of 70,000 euros on a data controller for failing to provide complete, intelligible and easily accessible response to a request-submitted by one of its employees- to access to data processed as part of the employment relationship.1 December 2022
• Facial recognition systems: 20 million fine against the American company Clearview."Not everything that is technically possible is legally and ethically lawful." These are the words of Guido Scorza, member of the Italian Data Protection Authority, to describe the €20 million fine imposed last February by the Italian DPA on the US company Clearview AI Inc. for its facial recognition service.4 July 2022
• New Italian cookie Guidelines: this is how the regulation of users' browsing data changes.On 9 July 2021, the Italian DPA released the new guidelines on the use of cookies. The purpose of these new guidelines is to achieve an higher level of transparency and to obtain an unambiguous consent for profiling data processing.21 September 2021
• Data breaches in healthcare due to human errors: two hospitals and a Local Health Administration Unit sanctioned by the Italian Data Protection AuthorityData breaches are violations of database security that may result not only from cyber attacks, as it is usually assumed, but also from human errors committed by persons who, under the direct authority of the data controller or the data processor, are authorized to process personal data. The absence of corporate procedures for the proper handling of patient data within a healthcare facility throughout their lifecycle or the inadequacy of these policies to cover all possible cases, in particular, can lead to material errors being made by the staff, such as the communication of patient's data to persons other than the data subject or to unauthorised persons. Such breaches in the health sector have a potentially very serious and detrimental impact on the rights of data subjects, given the special nature of the data processed, which consist of information on a person's state of health. This issue has been the subject of three recent decisions of the Italian Data Protection Authority which are briefly described in this news.13 April 2021
• The Italian Data Protection Authority Published Its Annual Report: In 2019, Public And Private Entities Notified 1443 Data BreachesThe annual report summaries the different issues on which the Italian Data Protection Authority (“Italian DPA” or “Authority”) worked over the past year; it also shows the state of implementation of privacy legislation in Italy, as well as an overview of the data breaches notified and the related measures taken.24 August 2020
• Italian data protection authority against the unlawful data processing through telemarketing activitiesThe Italian Data protection Authority (Italian DPA) issued two fines against Tim and Eni Gas e Luce, for a total amount of almost 36 million euros, due to data processing for telemarketing purposes carried out without the data subjects’ consent.28 March 2020
• The Italian Data Protection Authority Limits the Sending of Advertising and Promotional Contents to Fidelity Cards HoldersFor the first time, the Italian Data Protection Authority has exercised its power of "warning" provided by the GDPR, through which it has prohibited the unconditional sending of unsolicited advertising contents to fidelity cards holders.20 August 2019
• Three Legal Opinions of the Italian DPA clarify some GDPR Implementation AspectsThe aim of this article is to focus on three important legal opinions published by the Italian Data Protection Authority on the application of GDPR to personal data of deceased persons, the existence of a possible duty to communicate employees’ personal data to their professional associations and the role of the labour consultant after the full implementation of GDPR.4 April 2019
• Joint Controllership Sub-group NewsDuring 2018, the Not-for-Profit International Network CPC set up some study groups with the aim to analyze and compare the Member States laws and Data Protection Authorities’ interpretations on some specific legal arrangements provided by the EU Regulation 679/2016, GDPR.13 December 2018