Civil Grounds

“Privacy” can be defined as the right of each individual to exclude others from interfering with their personal life. Although “privacy” is not explicitly defined by domestic law, the right is protected by international treaties signed by Italy – in particular, by Article 8 of the European Convention of Human Rights and by Article 7 of the Charter of Fundamental Rights of the European Union.

Moreover, specific rights related to privacy are guaranteed by Italian Constitution provisions – such as Article 2 (“protection of human rights”), Article 13 (“personal freedom”), Article 14 (“inviolability of the domicile”), Article 15 (“inviolability of correspondence”) – and by specific law provisions that protect subjects from the abusive use of their name (Article 7 of the Italian Civil Code) or image (Article 10 of the Italian Civil Code). In light of the above-mentioned provisions, the Italian Supreme Court has recognised the existence of a personal right “to keep secret aspects, behaviour and acts relating to the intimate sphere of the person, preventing such information from being divulged without the authorisation of the person concerned”; thus, “the subject has the power to control the dissemination of his or her own data, choosing what to make accessible to third parties and intervening in the face of disruptive or aggressive behaviour”.

Criminal Grounds

As regards criminal law, the only specific provision that explicitly protects privacy is Article 615-bis of the Italian Criminal Code (“illegal interference in personal life”), which punishes with a prison term of between six months and four years whoever – by using filming or recording instruments – illegally acquires information or images regarding acts of private life carried out within a private house or in another private place. The same punishment applies to who reveals or spreads, by any means of public information, the information or images illegally obtained.

Moreover, other criminal provisions protect specific aspects of privacy, as follows.

• Article 614 of the Italian Criminal Code (“violation of domicile”) punishes with a prison term of up to four years whoever enters a private place or stays in it against the owner’s consent.
• Article 616 of the Italian Criminal Code (“violation of correspondence”) punishes with a prison term of up to one year whoever illegitimately reads, steals or destroys private mail or other forms of private communication between two or more people.
• Article 617 of the Italian Criminal Code (“cognisance, interruption or impediment of telephone conversations”) punishes with a prison term of up to five years whoever fraudulently intercepts a phone call between two or more people and in which they were not supposed to participate;
• Article 617-septies of the Italian Criminal Code (“publication of fraudulent shootings or recording”) punishes with a prison term of up to four years whoever, in order to damage the image of others, reveals by any means audio or video recordings – made fraudulently – of private meetings or telephone/telematic conversations carried out in their presence or with their participation;
• Article 618 of the Italian Criminal Code (“revelation of correspondence”) punishes with a prison term of up to six months whoever – having gained unauthorised knowledge of the contents of a correspondence not addressed to them, which should have remained secret – discloses it in whole or in part, without just cause, if the conduct causes damage.

Remedies Under Civil Law

Civil remedies for violations of privacy may vary in light of the kind of violation that was committed. However, in general, there are two main remedies.

• Action for an injunction – upon request from the person whose privacy has been violated by, for example, misuse of their name or their image (Articles 8 and 10 of the Italian Civil Code), the judge may order any suitable measure to prevent the continuation or repetition of the offence, by means of a judgment ordering the cessation of the harmful acts.
• Damages – given that the violation of privacy constitutes a violation of a personal right, under Article 2043 of the Italian Civil Code, the victim must be compensated for the damage suffered (including non-economic damage). The existence of the violation and of the damage must be proven by the claimant.

With regard to injunction orders, the person whose privacy has been violated or is about to be violated can ask the judge to file precautionary measures under Article 700 of the Italian Code of Civil Procedure if the person has founded reasons to believe that – during the time necessary to assert their right – their rights might be threatened by imminent and irreparable harm. If the request is deemed founded, the judge issues the most appropriate emergency measure to ensure provisionally the effects of the judgment on the merits.

Remedies Under Criminal Law

If the violation of privacy constitutes a crime, the victim can file a formal criminal complaint (querela) to the public prosecutor, who can be asked to file precautionary measures against the offender in order to prevent the commission of further crimes.

According to Article 75 of the Italian Code of Criminal Procedure, after the public prosecutor has formally pressed charges against the defendant via the request for committal to trial (Article 405 of the Italian Code of Criminal Procedure), the person who suffered damage can participate in the trial as a “civil party” in order to obtain compensation for the economic and non-economic damage suffered. The civil party – with the assistance of an attorney – can participate in the hearings, introduce evidence, cross-examine witnesses and, in general, support the public prosecutor.

Under Article 538 of the Italian Code of Criminal Procedure, if the defendant is found guilty, the judge shall sentence them to compensate the damage suffered by the civil party, who has to prove the damage.

Range of Financial Awards

Under Articles 2043 and 2059 of the Italian Civil Code – as well as Article 185 of the Italian Criminal Code with regard to cases where the wrongful act constitutes a crime – the financial award of damages shall include:

• economic damages, which cover the “actual damage” suffered (ie, the financial loss caused to the wealth of the victim) and the “loss of profits” caused by the tort/crime; and
• non-economic damages, which cover all non-monetary damage caused to the victim in light of the violation of a personal right/freedom (eg, personal distress caused to the victim) – the value of the non-economic damages is determined by the judge in light of the severity of the violation of the victim’s personal rights.

The range of financial awards is broad, depending on the scale of the damage suffered by the offended person.

Deadline for Civil Actions

A civil lawsuit to get compensation for damage suffered from the violation of personal privacy must be presented within five years following the violation itself. In fact, Article 2947 of the Italian Civil Code provides that the right to compensation for damage resulting from a wrongful act is limited to five years from the date on which the damage occurred.

However, if the wrongful act constitutes a crime, the longer statute of limitations provided for criminal purposes applies (Article 2947, Section 2 of the Italian Civil Code).

Deadline for Filing Criminal Complaints and Statute of Limitations

A criminal complaint must be filed within three months from the moment the offended person acknowledges the commission of the crime (Article 121 of the Italian Criminal Code).

Under Article 157 of the Italian Criminal Code, criminal liability is extinguished after a period corresponding to the maximum term of imprisonment provided for the offence (statute of limitations); in any case, criminal liability shall not be considered extinguished before six years from the day the offence was committed. Under Articles 161 of the Italian Criminal Code, the statute of limitations can be extended by up to one quarter of its normal duration by certain procedural acts (eg, request for committal to trial under Article 405 of the Italian Code of Criminal Procedure).

Possible Defences

Reduced privacy protection for publicly exposed people and in other special cases

With regard to the publication and use of images and names of people, a general provision is set by Article 97 of Law No 633/1941 – according to which, “the consent of the portrayed person is not required when the reproduction of the image is justified by reputation or public office covered, by the need for justice or the police, by scientific, didactic or cultural purposes, when the reproduction is connected with facts, events, ceremonies of public interest or held in public”.

Violations of privacy and exercise of right to report/inform

With regard to the protection accorded to the media regarding violations of privacy, the following distinction should be made.

• On one hand, when the publication of news or information legitimately acquired by the journalist constitutes a violation of privacy, the latter can be justified by the exercise of press freedom and the right to report under Article 21 of the Italian Constitution (for more information, see 2.3 Defamation Deadlines and Defences).
• On the other hand, the Italian Supreme Court has stated that – when a privacy violation is committed to obtain information – the author of the crime or of the civil tort cannot be justified by the exercise of the right to inform.

Differences Between Criminal and Civil Proceedings

In order to file a criminal complaint, the violation of privacy has to be criminally relevant.

In general, criminal proceedings are usually faster and the crime can be proved with no limitation regarding the types of evidence. Indeed, the public prosecutor’s powers of investigation are wider and more effective than those of a private citizen, enabling public authorities to find evidence that might otherwise be precluded from the victim.

Moreover, owing to its deterrent effect, filing a criminal lawsuit usually interrupts the commission of the violation. In the most serious cases and if there is a risk of commission of other crimes, the public prosecutor can ask the judge of preliminary investigation to apply a precautionary measure against the defendant, such as an injunction ordering the defendant to stay away from the places attended by the victim (Article 282-ter of the Italian Code of Criminal Procedure) or temporarily prohibiting the exercise of specific professional or entrepreneurial activities (Article 290 of the Italian Code of Criminal Procedure).

However, establishing a civil proceeding has its own advantages.

• First of all, the protection accorded by civil law is wider than the one accorded by criminal law, given that conduct that might not be a crime can nonetheless constitute a civil tort under Article 2043 of the Italian Civil Code or other law provisions (eg, Articles 8 and 10 of the Italian Civil Code).
• Furthermore, the deadline for filing a lawsuit for damages is significantly longer than the deadline for filing a criminal complaint. In addition, civil proceedings do not involve any public authority besides the judge, allowing the claimant to have more control over the unfolding proceedings.
• Lastly, compensation for damage is directly liquidated by the civil judge, whereas in criminal proceedings the judge does not usually determine the compensation for the civil party – instead, only sentencing the defendant to pay the damages that will be determined by a civil judge (Article 539 of the Italian Code of Criminal Procedure).

Italian civil jurisdiction

With regard to privacy violation, the Italian tribunal where the defendant is domiciled is competent.

In cases where the wrongful act involves a third party from an EU member state, in order to establish a civil proceeding before an Italian tribunal, the defendant must be domiciled in Italy (Article 4 of Regulation (EU) No 1215/2012). Nevertheless, considering that the violation of privacy is a non-contractual civil tort, Article 7(2) of Regulation (EU) No 1215/2012 may be applicable – with the result that Italian jurisdiction occurs also in cases where the damage or the event giving rise to the damage occurred in Italy.

Lastly, if the violation of privacy has been committed by a foreign third party who is not domiciled in the EU, Italy has civil jurisdiction if the claimant is domiciled in Italy or the harmful event occurred within Italian territory (Article 18 and 20 of the Italian Civil Code).

Italian criminal jurisdiction

Italian criminal law applies to crimes committed on Italian territory. According to Article 6 of the Italian Criminal Code, in order to bring a case in front of the Italian authorities, the crime must have been committed – at least partially – within Italian territory. Specifically, at least part of the unlawful conduct must have been committed within Italian territory or at least part of the harmful consequences of the crime must have occurred within Italian territory.

Moreover, Articles 9 and 10 of the Italian Criminal Code provide for Italian extraterritorial jurisdiction over conduct committed outside Italian territory when four conditions are met:

• the crime committed is punished with a minimum prison term of up to three years (with regard to crimes committed by an Italian citizen) or one year (with regard to crimes committed by a foreign citizen); 
• the author of the crime is within Italian territory;
• the conduct is a crime both in Italy and in the country where it was committed; and
• a request for punishment is made by the Minister of Justice or by the victim.

ADR Mechanisms

Domestic law provides for two main forms of ADR through which parties can resolve disputes concerning disposable rights, including disputes concerning reputation, harassment, data protection, and violations of privacy.

• Legislative Decree No 28/2010 regulates “mediation proceedings”, in which a third independent person assists the parties in settling their dispute. Under Article 2 of Legislative Decree No 28/2010, “everyone has access to mediation to resolve civil and commercial disputes over rights of disposal”. The access to mediation is voluntary; nevertheless, with regard to certain disputes provided by Article 5 of Legislative Decree No 28/2010 (including defamation cases), mediation is mandatory before filing a civil lawsuit (see 2.6 Other Features of Defamation Actions).

The request is submitted to an accredited mediation provider with territorial jurisdiction. Once the provider has appointed a mediator, a notice indicating the date and location of the first mediation meeting is filed to the defendant.

The parties can have one or more meetings in order to reach a settlement and can be assisted by their lawyers. Article 9 of Legislative Decree No 28/2010 provides that parties and the mediator are bound to confidentiality with regard to statements made or information acquired within the mediation.

At the end of the mediation proceedings, which should last at most three months (Article 6 of Legislative Decree No 28/2010), the parties may reach a settlement agreement to resolve the dispute. If the parties do not reach an agreement, the mediator can draft a non-binding settlement proposal (Article 11 of Legislative Decree No 28/2010).

When the parties reach a settlement agreement and the document is signed by the parties, their lawyers and the mediator, the settlement agreement constitutes an enforceable title and has the same effects as a court judgment (Article 12 of Legislative Decree No 28/2010).

• Decree Law No 132/2014 (converted into Law No 162/10 November 2014) regulates the “assisted negotiation procedure”, which is a form of ADR whereby the parties – assisted by their lawyers – agree to co-operate in good faith to settle a dispute. As per mediation proceedings, the assisted negotiation procedure may be used as an alternative to ordinary jurisdiction for any type of dispute concerning disposable rights.

The procedure is started by the request to enter the assisted negotiation filed by the claimant’s lawyer to the other party. The two parties – assisted by their lawyers – sign a private convention that defines the controversy and sets the rules concerning the negotiation (duration, acquisition of evidences, meetings, etc). The procedure ensures confidentiality of the information disclosed during the negotiations. Moreover, the agreement that settles the dispute constitutes an enforceable title.

It must be underscored that the assisted negotiation procedure is a condition for the admissibility of any civil lawsuit for the payment of sums not exceeding EUR50,000, including requests for compensation for damage under Article 2043 of the Italian Civil Code.

Both in criminal and civil proceedings, the judge can sentence the losing party to reimburse the legal cost suffered by the winning party. However, the recovery of legal costs is not always granted and, most of the time, the compensation does not cover all the legal expenses.

Recovery of Legal Costs in Civil Proceedings

Under Article 91 of the Italian Code of Civil Procedure, the judge – in the ruling closing the proceedings before them – orders the succumbing party to reimburse the other party’s costs and awards them together with the costs of the defence.

Under Article 92 of the Italian Code of Civil Procedure, the judge may not order the reimburse of legal costs if the request of the winning party is deemed excessive or redundant. Furthermore, the judge might compensate – in whole or in part – legal costs between the parties in the event of mutual succumbence or in the case of absolute novelty of the legal case.

Moreover, under Article 96 of the Italian Code of Civil Procedure, if the judge deems that the succumbing party has acted or resisted in the legal proceeding in bad faith or with gross negligence, the succumbing party may be sentenced to pay the related damages to the winning party upon request of the other party.

Recovery of Legal Costs in Criminal Proceedings

Under Article 541 of the Italian Code of Criminal Procedure, in the event of conviction, the judge might sentence the defendant to pay the legal costs suffered by the civil party unless there are valid grounds for full or partial set-off. In the event of acquittal, the judge can sentence the civil party to pay the legal costs incurred by the defendant, unless there are valid grounds for full or partial set-off. In the latter case, where there has been gross negligence on the part of the civil party, the judge shall sentence the civil party to compensate for the damage caused to the defendant.

Moreover, under Articles 427 and 541 of the Italian Code of Criminal Procedure, in cases where the defendant was acquitted because the crime was not committed or because the defendant did not commit it, the judge shall order the person who filed the criminal complaint from which the criminal proceedings originated to pay the costs of the proceedings advanced by the State, as well as the legal costs suffered by the defendant.

With regard to proceedings concerning violations of privacy, the normal rules provided by the Italian Code of Civil Procedure and the Italian Code of Criminal Procedure apply.

Reputation is defined by the Italian Supreme Court as esteem in the social environment – ie, others’ opinions of the honour and decorum of a person. Given that personal reputation is considered a human right protected under Article 2 of the Italian Constitution, Italian law protects the reputation of individuals and legal entities alike from defamatory conduct.

Criminal Grounds

Abolition of the crime of personal insult

The crime of “personal insult” under Section 594 of the Italian Criminal Code – which punished whoever offended the honour or reputation of a person that was present at the time and place of the act – was abolished in 2016. Nevertheless, according to Legislative Decree No 7/2016, the offended person can act before a civil court, who can sanction the author of the personal insult with a fine of up to EUR12,000.

The crime of defamation

Article 595 of the Italian Criminal Code punishes whoever – by communicating with more than two people – offends someone’s reputation if the offended person is not present at the moment the act is committed.

Aggravating circumstances are constituted if:

• the offence consists of the attribution of a specific fact to the offended person (Article 595, Section 2 of the Italian Criminal Code);
• defamation is committed by the press or by any other means of publicity (Article 595, Section 3 of the Italian Criminal Code);
• the offended person is a public entity or a public official (Article 595, Section 4 of the Italian Criminal Code).

Although the crime can be punished with a prison term of up to three years if committed by the press or by another means of public communication, courts usually sanction defamation with a fine.

On this point, it should be highlighted that the Italian Constitutional Court has recently deemed unconstitutional Article 13 of Law No 47/1948 and Article 30 of Law No 223/1990, which required the judge to punish with imprisonment the offence of defamation by the press or radio and television aggravated by the attribution of a specific fact. In the Italian Constitutional Court’s opinion, the mandatory application of imprisonment was in contrast with Article 21 of the Italian Constitution (“freedom of the press”) because it would have excessively dissuaded journalists – through fear of punishment – from exercising their crucial function of public monitoring.

Criminal liability of the editor-in-chief

With regard to defamation committed by the press, Articles 57 and 596-bis of the Italian Criminal Code provide for the culpable criminal liability of an editor-in-chief who commits the crime of defamation by omitting to exercise the necessary control over the publication in order to prevent the commission of crimes through the press. According to the case law of the Italian Supreme Court, the editor-in-chief’s liability for failure to check the content of the periodical in relation to the defamatory acts can be excluded if it is proved that the editor-in-chief did everything in their power to prevent the dissemination of untrue news by prescribing and imposing rules and control in respect of accuracy, faithfulness and impartiality.

Civil Grounds

Defamation is also a non-contractual civil tort under Article 2043 of the Italian Civil Code – according to which, every act (voluntary or culpable) that causes unjust damage to someone requires compensation for such damage by the author. Therefore, as personal reputation is a personal right, the offended person may act before civil courts to stop the defamation and obtain compensation for the suffered damage.

Remedies Under Criminal Law

As regards actions for an injunction, the offended person can file a criminal complaint (querela) to the public prosecutor, who can ask the judge of the preliminary investigation to seize the defamatory publication (Article 321 of the Italian Code of Criminal Procedure). If the defamation is committed on the internet, the seizure is applied by the blacking out of the internet page.

The person who suffered damage from a crime can participate in the proceeding as a civil party in order to get compensation. For more information, see 1.2 Privacy Remedies.

Remedies Under Civil Law

There are two main remedies for defamation under civil law.

• Action for an injunction – upon the request of the person whose reputation has been violated, the judge may order any suitable measure to prevent the continuation or repetition of the offence.
• Damages – given that the defamation constitutes a violation of a personal right, the author is obliged to compensate the damage suffered by the victim. The existence of damage must be proven by the person who claims to have suffered the damage.

As regards injunction orders, the person whose reputation has been violated or is about to be violated can ask the judge to file precautionary measures under Section 700 of the Italian Code of Civil Procedure. For more information, see 1.2 Privacy Remedies.

Range of Financial Awards

Under Articles 2043 and 2059 of the Italian Civil Code, as well as Article 185 of the Italian Criminal Code, the financial award of damages shall include economic and non-economic damages.

With regard to compensation for non-economic damage caused by defamation, the Tribunal of Milan has set out in a chart the criteria for evaluating the severity of the defamation and therefore the amount of compensation required, as follows.

• In the case of mild/non-severe defamation, compensation ranges from EUR1,075 to EUR23,490.
• In the case of medium-severity defamation, compensation ranges from EUR23,490 to EUR35,247.
• In the case of severe defamation, compensation ranges from EUR35,247,00 to EUR58,745.
• In the case of extremely severe defamation, compensation must exceed EUR58,745.

For more information on deadlines and limitation periods for crimes and non-contractual civil torts, see 1.3 Privacy Deadlines and Defences.

Possible Defences

In general, the first defence in defamation proceedings usually concerns the lack of offensiveness of defamatory remarks.

Moreover, under Article 51 of the Italian Criminal Code, the Italian Supreme Court case law grants immunity – both in criminal and civil proceedings – in cases where the author of defamatory remarks has exercised one of the following constitutional rights, all derived from Article 21 of the Italian Constitution (“freedom of the press”):

• the “right to report”, which applies to journalists who have reported true facts of public interest and have exposed them in a correct and non-offensive manner;
• the “right to criticise”, which applies to whoever has expressed a critique based on true facts of public interest if the terms used are not overly offensive;
• the “right to make satire”, which applies to whoever has made a joke about a fact of public interest if the terms used are not overly offensive and do not constitute an unjustifiable personal attack on the target of the joke.

Finally, it must be emphasised that the Italian Supreme Court has stated that the broadness of the exercise of the right to report, the right to criticise and the right to make satire may vary depending on the target of defamatory statements. Prominent and public figures – such as politicians, public officials, celebrities, and big companies – should expect to be subjected to the public scrutiny and to be the target of attacks and harsh critiques. Therefore, in order for a statement to be deemed defamatory by a judge in such cases, the damage to the reputation in question must be particularly serious and harmful.

Differences Between Criminal and Civil Proceedings

For more information concerning the differences between criminal and civil proceedings in defamation, harassment, and violation of privacy cases, see 1.4 Privacy Proceedings Forum Choice.

With regard to cases of defamation committed by the press, TV or other forms of mass communication that do not involve any foreign party, the Italian Supreme Court has stated that the Italian tribunal where the claimant had its domicile at the time of the dissemination of the damaging news or judgment is competent.

In cases of defamation involving a third party from an EU member state, in order to establish a civil proceeding before an Italian tribunal, the defendant must be domiciled in Italy (Article 4 of Regulation (EU) No 1215/2012). Nevertheless, considering that the defamation is a non-contractual civil tort, the Italian Supreme Court has recently stated that “the connecting factor of Article 7(2) of Regulation (EU) No 1215/2012 is applicable, with the result that jurisdiction lies either in the place where the damage occurred or, alternatively – at the option of the claimant – in the place where the event giving rise to the damage occurred”. Thus, if the defamatory comments concern people or companies based in Italy and the defamatory comments were accessible in Italy, the Italian court has jurisdiction on the case.

In cases where defamation has been committed by a foreign entity who is not domiciled in the EU, Italy has civil jurisdiction if the actor is domiciled in Italy or if the harmful event occurred within Italian territory (Article 18 and 20 of the Italian Civil Code).

For more information on Italian criminal jurisdiction, see 1.4 Privacy Proceedings Forum Choice.

ADR Mechanisms

Defamation disputes can be settled by means of the “mediation proceeding” under Legislative Decree No 28/2010 and the “assisted negotiation procedure” under Decree Law No 132/2014. For more information, see 1.4 Privacy Proceedings Forum Choice.

Both in criminal and civil proceedings, the judge can sentence the losing party to reimburse the legal cost suffered by the winning party. For more information on this point, see 1.5 Privacy Costs.

The ordinary rules provided for criminal proceedings apply to defamation cases.

As regards civil proceedings, under Article 5 of Legislative Decree No 28/2010, in the case of defamation committed by means of press or other form of mass communication, it is necessary to establish a mediation proceeding before filing a lawsuit to the judicial authority against the author of defamation.

If the mediation proceeding is not established, the lawsuit cannot be examined by the judge. Nevertheless, mediation does not preclude the granting of interim and precautionary measures.

The term “harassment” indicates a vast variety of conduct that disturbs/impedes the personal freedom and serenity of the offended person. Acts of harassment differ in their nature and gravity and – depending on the circumstances – may be relevant under the Italian Criminal Code.

Criminal Grounds

With regard to harassment cases, the following criminal provisions are relevant:

• Article 660 of the Italian Criminal Code (“harassment”) punishes with a prison term of up to six months whoever harasses or disturbs someone in a public place or by using the telephone or other forms of communication;
• Article 610 of the Italian Criminal Code (“private violence”) punishes with a prison term of up to four years whoever – by means of violence or threats – compels others to do, tolerate or omit something;
• Article 612-bis of the Italian Criminal Code (“persecutive conduct” (stalking)) punishes with a prison term of up to six years whoever – through repeated acts – harasses or threatens someone, causing to the victim:
1. a lasting state of fear and anxiety;
2. founded concerns regarding their personal safety or the safety of a relative; or
3. a change to the victim’s way of life.

Civil Grounds

Given that personal serenity and personal freedom constitute a personal right protected by Articles 2 and 14 of the Italian Constitution, their violation can also be deemed relevant under Article 2043 of the Italian Civil Code – according to which, all conduct (whether voluntary or culpable) that causes unjust damage to someone requires compensation for such damage.

Considering that harassment amounts to a violation of privacy, the same remedies apply. For further details, see 1.2 Privacy Remedies.

Both in criminal and civil proceedings, the offended person can ask for compensation for damage suffered. The compensation can include both economic and non-economic damages. The range of financial awards is pretty broad, depending on the scale of the offence. For more information on this point, see 1.2 Privacy Remedies.

For more information on deadlines and statute of limitations for crimes and non-contractual civil torts, see 1.3 Privacy Deadlines and Defences.

Possible Defences

The first defence in harassment cases usually consists of proving the lack of offensiveness of the conduct and the lack of personal distress caused to the victim.

Moreover, under Article 51 of the Italian Criminal Code, the Italian Supreme Court case law grants immunity – both in criminal and civil proceedings – in cases where the harassment has been carried out in the exercise of a constitutional right, such as:

• the “right to report” under Article 21 of the Italian Constitution (“freedom of the press”); and
• the “right of defence”, which applies when the violation of someone’s serenity and/or privacy has been caused within in order to assure the complete defence of a party in a criminal or civil proceeding.

Please refer to 1.4 Privacy Proceedings Forum Choice for further information on:

• the differences between the criminal and civil procedure in harassment, defamation, and violation of privacy cases; and
• Italian criminal and civil jurisdiction with regard to crimes and non-contractual civil torts.

ADR Mechanisms

Harassment disputes can be settled by means of the “mediation proceeding” under Legislative Decree No 28/2010 and the “assisted negotiation procedure” Decree Law No 132/2014. For more information, see 1.4 Privacy Proceedings Forum Choice.

Both in criminal and civil proceedings, the judge can sentence the losing party to reimburse the legal cost suffered by the winning party. For more information on this point, see 1.5 Privacy Costs.

Respect for ethics and journalistic accuracy mostly depends on the size and authority of the newspaper or broadcaster. Whereas the most-read newspapers and national broadcasters are usually reliable and respectful of journalistic ethics, smaller or politically oriented media might be less accurate in their reporting.

The Italian media environment is complex. While many differently owned newspapers still exist at a local level, the consolidation of big media groups is taking place on a national level – whereby a few players own many of the most important newspapers distributed on a country-wide basis.

TV broadcasters have always been very few, with the most important national terrestrial televisions being owned by only three companies (one public company, two private companies).

Currently, the five most influential news provider are:

• RAI, the Italian public broadcasting company, which owns three of the main national TV channels and multiple radio stations;
• Mediaset Group, the largest private Italian broadcaster, which owns three of the main national TV channels and multiple radio stations;
• RCS Group, a private company that owns the most-read national newspaper (Corriere della Sera) and one national TV channel;
• GEDI Group, a private company that owns two of the most-read national newspapers (Repubblica, La Stampa) and several local newspapers; and
• Sky, which is the Italian branch of Mediacom Group and is the main Italian cable TV provider.

The Italian legal framework concerning the media is fragmented and – with regard to new forms of communication – incomplete.

As regards the press, its activity is regulated by Law No 47/1948, which provides a definition of “the press”, the basic conditions required to institute and run a newspaper (such as the registration process for the newspaper and the information that must be provided in the newspaper regarding the editor), and the rules regarding publication as well as related safeguards.

TV broadcasting is regulated by Law No 223/1990 and by Legislative Decree No 208/2021, which provide the rules concerning TV and radio broadcasting – for example, the mandatory authorisations, the principles that should guide broadcasting, and some essential rules concerning the activity. The monitoring of broadcasting and the enforcement of the above-mentioned rules are overseen by the Independent Authority for Communication (Autorità per le Garanzie nelle Comunicazioni, or AGCOM).

As regards social media, no specific law has been adopted to regulate activity thereon. However, the general rules of civil and criminal law apply.

Lastly, journalism – no matter the media through which the activity is carried out – is regulated by Law No 69/1963, which establishes and regulates the Order of Journalists, sets the conditions under which the profession can be carried out, and provides for the regulation of journalists’ activity. The Order of Journalists has adopted the Charter of Duties of Journalists in order to assure a minimum standard of quality and fairness of the activity.

Effectiveness of Regulators

Press and broadcasting activities are regulated mostly on a “formal” level. The main goal of the legislature is to ensure that press and broadcasting activities are carried out in an orderly way and that pluralism is assured within the Italian territory.

On the other hand, in light of freedom of expression and freedom of the press as enshrined in Article 21 of the Italian Constitution, media content is poorly regulated. The few rules set are often unenforceable.

Media Protection

The most important protection afforded to the media is Article 21 of the Italian Constitution, which provides that “everyone is free to express freely their thoughts, with words, scripts and every other means of communication”, specifying that “the press” – although the rule applies to all sorts of regulated media – “is free and cannot be subjected to authorisation and censorship”. By applying the foregoing provision, Italian case law affords the media a broad protection from censorship and or acts of interference.

Moreover, according to Section 3 of Article 21 of the Italian Constitution, a newspaper and/or a specific newspaper article can be seized only by order of a judge and only in cases specifically listed by the law. Currently, a newspaper article can be seized only in cases of:

• violation of the rules on the registration of periodical publications;
• publication of content that is obscene or offensive to public decency;
• fascist apologism published in the periodical press; and
• violation of the rules protecting copyright.

The Italian Supreme Court has therefore excluded the legitimacy of the seizure of a newspaper article that is deemed defamatory, extending this protection to online newspapers. On the other hand, the Italian Supreme Court has excluded social media content and/or content published by online-only websites (eg, personal blogs) from such protection, as they cannot be compared to newspapers.

Both Law No 47/1948, which regulates the press, and Legislative Decree No 208/2021, which regulates TV and radio broadcasting, provide a specific rectification procedure that can be used by whoever believes they have been damaged by the publication of false facts/allegations.

With regard to the press, Article 8 of Law No 47/1948 provides that the offended person can ask the newspaper that has published false information to publish a rectification statement within 48 hours following the publication of defamatory/incorrect information. If the newspaper does not publish the rectification, the offended person can ask a civil court to issue an order to publish the rectification; moreover, the violation of the rectification process by the newspaper will be punished with a fine of up to EUR10,000.

As regards TV and radio broadcasting, Article 35 of Legislative Decree No 208/2021 provides that the offended person can ask the broadcaster to transmit a rectification statement within 48 hours following the broadcasting of defamatory/incorrect information. If the broadcaster does not comply with the request within 48 hours or does not want to comply with the offended person’s request, both parties can request AGCOM to rule on the validity of the request for rectification. If the request is deemed legitimate, AGCOM will order the broadcaster to transmit the rectification statement.

Criminal Liability of Internet Providers

With regard to crimes committed on internet platforms/by using platforms that host user-generated information/content (eg, ISPs or social networks), no specific law provides for the criminal liability of the host/owner of the platform for the crimes committed by its users.

The Italian Supreme Court has excluded ISPs from criminal responsibility for the commission of crimes by users of the service, in reference both to defamation and to other crimes (eg, personal data infringement). The decisions were founded on the lack of a preventive surveillance duty on the part of the ISP concerning the information and content uploaded by users.

However, the Italian Supreme Court found the owner of a website/blog guilty of co-operation in defamation under Articles 110 and 595 of the Italian Criminal Code for failing to comply with a victim’s request to remove defamatory content posted on the web page by another user. The Italian Supreme Court argued that such omission should be considered an implicit agreement with the defamatory post.

Civil Liability of Internet Providers

With regard to liability for damage caused by defamation committed online, the Italian Supreme Court has considered liable the ISP (in particular, hosting providers) that – having been informed of the defamatory content published on/made available by the internet platform and having been asked to remove the harmful information/content – does not remove the defamatory content.

In Italy, domestic law does not provide any specific mechanism in order to prevent Strategic Lawsuits Against Public Participation (SLAPPs) and/or protect journalists against abusive legal actions intended to prevent the publication of information of public interest.

In the absence of a specific safeguard for journalists, Italy has frequently ranked first among the EU member states for numbers of SLAPPs. Notably, according to a study by the European Parliament (“Open SLAPP Cases in 2022 and 2023”), Italy had the highest number of SLAPPs recorded – with 25.5% of total cases.

Implicit Safeguards Against SLAPPs in Domestic Law

In the absence of specific domestic law to prevent or neutralise SLAPPs, two implicit safeguards to prevent abusive legal actions against journalists and press can still be found in the Italian legislation, as follows.

• With regard to abusive civil lawsuits, Article 96 of the Italian Code of Civil Procedure states that where the judge deems that the succumbing party has acted or resisted in the legal proceeding in bad faith or with gross negligence – upon request of the other party – the succumbing party may be sentenced to pay the costs and damages, which shall be determined in the judgment.
• With regard to radically unfounded criminal complaints concerning the commission of defamation or of other crimes, Article 368 of the Italian Criminal Code (“slander”) punishes with a prison term of up to six years whoever – through a criminal complaint or another action directed at the judicial authorities or at another public authority (even if filed anonymously or by using a fake name) – intentionally accuses someone of a crime, if the author of the accusation knew that the accused person was innocent at the time the complaint was filed.

EU Directive No 2024/1069

In order to prevent SLAPPs within the EU, the EU Parliament and Council have recently adopted EU Directive No 2024/1069 on protecting persons who engage in public participation from manifestly unfounded claims or abusive court proceedings. Its goal is to provide safeguards against SLAPPs – defined as “court proceedings that are not brought to genuinely assert or exercise a right, but have their main purpose in the prevention, restriction or penalisation of public participation” – in cases with cross-border implications concerning matters of public interest.

EU Directive No 2024/1069 has not been implemented by Italy. The reception of EU Directive No 2024/1069’s provisions – such as the option to require the claimant to provide security for the costs of the proceedings for the defendant (Article 10), the option to apply penalties (Article 15), and the option to dismiss SLAPPs early (Article 11) – will have a positive impact on the protection of freedom of speech and freedom of public debate, as the safeguards to prevent and mitigate the negative effects of SLAPPs will probably be adopted in respect of all cases, irrespective of their cross-border implications.

No specific legislation to prevent the enforcement of judgments in media cases from other jurisdictions has been adopted by Italy.

However, Article 16 of EU Directive No 2024/1069 provides that EU member states must ensure that the enforcement of a third-country judgment in court proceedings against public participation by a person domiciled in an EU member state will be refused if those proceedings are manifestly unfounded or abusive under the law of the EU member state in which such recognition or enforcement is sought. By adopting the provisions of EU Directive No 2024/1069, Italy will therefore ensure specific rules in order to prevent the recognition of foreign judgements in cases where the relative proceedings are considered manifestly unfounded or abusive.

Legal Framework

The first domestic law concerning data protection was Law No 675/1996, which adopted EU Directive No 95/46/CE of the European Parliament and of the European Council.

In 2004, Legislative Decree No 196 of 2003 – entitled “Code on the Protection of Personal Data” (the “Privacy Code”) – was approved. More than a decade later, it remains the main applicable law concerning privacy and data protection in Italy.

Data protection in Italy is now mainly regulated by Regulation (EU) 2016/679 (the “General Data Protection Regulation” (GDPR)). This has introduced common principles and provisions concerning data protection within the EU (eg, data rights, duties of protection, co-operation among EU member states, remedies in case of data breach, and liability for breach of rights).

In light of the introduction of the GDPR, Italy has amended the Privacy Code by approving Legislative Decree No 101/2018. This has modified the Privacy Code in compliance with the provisions of the GDPR and integrated those matters that are of national competence (eg, regulations of the Italian Data Protection Authority (IDPA) and criminal law provisions).

Useful tools to interpret the provisions of both the GDPR and the Privacy Code are the guidelines adopted by the IDPA. These provide general indications in relation to the processing of personal data in various fields.

Interpretation of Domestic Law

It should be considered that – in light of the direct applicability of the GDPR in EU member states and the principle of the primacy of European law over national law – domestic laws and regulations concerning data should be interpreted in light of the GDPR. Thus, in the event of conflict between European and domestic provisions, the judge must disapply domestic law and apply European law.

The Privacy Code (see 5.1 Data Protection Grounds) provides three main types of remedies in case of violation of provisions concerning data treatment and protection, as follows..

Complaint or Notice to IDPA

Under Article 142 of the Privacy Code, in the event of a violation of data protection rights or provisions, the data subject or their attorney can file a complaint to the IDPA with detailed indication of the facts and circumstances on which it is based, the provisions allegedly violated and the measures requested, as well as the identification details of the data controller or processor. The procedure is regulated by Articles 142—146 of the Privacy Code and by Regulation No 1/2019 of the IDPA.

The IDPA will notify the controller or processor of personal data and inform them of the potential violation. Within 30 days following the notification, the notified party must file defensive briefs to the IDPA and ask for an audition.

At the end of the proceedings, if a violation of data protection is assessed, the IDPA will its resolution and adopt the corrective and sanctioning measures provided by Article 58, Section 2 of the GDPR.

According to Article 144 of the Privacy Code, every person has the right to file a notice to the IDPA calling for a check as to whether the rules on the processing of personal data have been respected. Unlike a complaint, the notice does not necessary require a formal decision of the IDPA. If the notice is deemed founded, the complaint procedure is followed and the controller or processor of data rights may be sanctioned with the measures provided by Article 58, Section 2 of the GDPR.

According to Article 10 of Legislative Decree No 150/2021, the decisions of the IDPA can be appealed before the civil tribunal within 30 days following notification of the decision (60 days if the subject is resident in a foreign country).

Civil Lawsuit for Damages

Under Article 140-bis of the Privacy Code, “if a person considers that [their] rights under data protection legislation have been infringed, [they] may file a complaint to the IDPA or appeal to the judicial authorities”. However, the two actions cannot be proposed at the same time if the request is the same.

In terms of civil-law remedies, Article 150 of the Privacy Code provides that all disputes concerning personal data – as well as the right to compensation for damage pursuant to Article 82 of the GDPR – shall be assigned to the ordinary judicial civil authority.

By filing a civil lawsuit, the data subject can ask for compensation for the damage caused by the infringement of data protection laws, as provided by Article 82 of the GDPR. On this point, it should be emphasised that – according to the Italian Supreme Court – the mere violation of data protection laws does not necessarily cause damage to the interested person, who has to prove the existence of damage (be it economic or non-economic) and a certain severity of such damage.

Criminal Penalties

The Privacy Code provides penalties for specific crimes with regard to certain violations of data protection, as follows.

• “Unlawful processing of personal data” – Article 167, Section 2 of the Privacy Code punishes with a prison term of up to three years whoever, in order to obtain profit for themselves or others or to cause damage to the data subject, causes damage to the data subject by processing personal data (Articles 9 and 10 of the GDPR) in breach of:
1. the provisions concerning processing of personal data (Articles 2-sexies of the Privacy Code) or data relating to criminal convictions and offences (2-octies of the Privacy Code); or
2. the safeguard measures for personal data (Article 2-septies of the Privacy Code).
• “Unlawful transfer of personal data to third countries” – Article 167, Section 3 of the Privacy Code punishes with a prison term of up to three years whoever, in order to gain profit for themselves or others or to cause damage to the data subject, causes damage to the data subject by transferring personal data to a third country or an international organisation outside the circumstances permitted under Articles 45, 46 or 49 of the GDPR.
• “Unlawful communication and dissemination of personal data processed on a large scale” – Article 167-bis of the Privacy Code punishes with a prison term of up to six years whoever communicates or disseminates, in order to gain profit for themselves or others or in order to cause damage, an automated file (or a substantial part thereof) containing personal data subject to large-scale processing.
• “False statement to the IDPA” – Article 168 of the Privacy Code punishes with a prison term of up to three years whoever, in proceedings or in the course of investigations before the IDPA, falsely declares or attests news or circumstances or produces false documents or deeds.

As regards privacy crimes, it should be mentioned that IDPA has to inform the public prosecutor if – in the course of its activity – elements emerge that give rise to the presumption of the existence of a crime (Article 167, Section 5 of the Privacy Code).

For more information on deadlines and statute of limitations of crimes and non-contractual civil torts, see 1.3 Privacy Deadlines and Defences.

There is no explicit deadline for filing a complaint or notice to the IDPA.

Cases Where Personal Data Can Be Used

According to Article 6 of the GDPR, the processing of personal data is lawful only if at least one of the following conditions is met:

• the data subject has consented to the processing of their personal data for one or more specified purposes – according to Article 4 of the GDPR, for consent to be valid, it must be free, specific, informed and express an unambiguous will;
• the processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the request of the data subject;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary to safeguard the vital interests of the data subject or of another person;
• processing is necessary for the performance of a task carried out in the public interest or in connection with the exercise of the official authority vested in the controller; or
• processing is necessary for the furtherance of the legitimate interests of the controller or of a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data are not overridden, where the data subject is a child.

These provisions can also be found in Articles 23 and 24 of the Privacy Code.

Differences Between Criminal and Civil Proceedings

For further details of the differences between the criminal and civil procedure, see 1.4 Privacy Proceedings Forum Choice.

According to Article 79 of the GDPR, Italian civil courts have jurisdiction on disputes concerning data violations when:

• the violation of data has occurred within Italian territory;
• the data controller or processor sued is established in Italy; or
• the data subject is established in Italy, even when the controller or processor is established in another EU country, unless the controller or processor is a public authority of an EU member state acting in the exercise of its public powers.

For more information on Italian criminal jurisdiction, see 1.4 Privacy Proceedings Forum Choice.

ADR Mechanisms

Data protection disputes can be settled by means of the “mediation proceeding” under Legislative Decree No 28/2010 and the “assisted negotiation procedure” under Decree Law No 132/2014. For more information, see 1.4 Privacy Proceedings Forum Choice.

Both in criminal and civil proceedings, the judge can condemn the losing party to reimburse the legal cost suffered by the winning party. For further information on this point, see 1.5 Privacy Costs.