The draft legislative decree implementing GDPR has been approved

On 22 March 2018, the Council of Ministers has approved the draft legislative decree laying down provisions on the adaptation of the national laws to the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the “Regulation”). The draft legislative decree peremptorily sets out that effective from the following 25 May Legislative Decree 196/2003 (so-called “Privacy Code”) shall be deemed repealed by such decree and by the Regulation, thus definitely clearing all the doubts arisen in recent times. The most relevant novelties include a broad decriminalization in case of violation of the “new” rules, in consideration of the strong dissuasive effect exerted by the administrative penalties in the light of Article 83 of the Regulation. Instances of infringement that, due to the particularly detrimental impact they may have on the activity of the Data Protection Authority remain in force. Therefore any individuals who in the proceedings before the Data Protection Authority render misrepresentations or intentionally cause interruption of, or disrupt, the regular performance of duties or exercise of powers of the Authority shall be punished with imprisonment.  Finally, it should be noted that the draft legislative decree provides for the “non-usability of data” as one would logically expect, as a direct and immediate consequence of any unlawful use of data, which, together with the administrative penalties, is an ex-post measure protecting the parties involved. It shall be understood that the draft might be amended before its final approval.