Sanctions and penalties under Italian data protection law

Articles 167, 167-bis, 167-ter and 168 of the Italian Data Protection Code list the violations for which imprisonment is possible:

  • Unlawful processing (imprisonment between 6 month and 3 years)
  • Unlawful transfer of data outside the EU (imprisonment between 1 and 3 years)
  • Unlawful communication and dissemination of personal data undergoing large-scale processing (imprisonment between 1 and 6 years)
  • Fraudulent acquisition of personal data subject to large-scale processing (imprisonment between 1 and 4 years)

False statements to the Supervisory Authority and interruption of the execution of the tasks or the exercise of the SA’s powers (imprisonment between 6 months and 3 years)