The presence or absence of penal sanctions in the new legal context of privacy protection has been the subject of a heated confrontation in the debate promoted by Assonime on the imminent entry into force of the European regulation on the subject (GDPR).
The European guarantor of privacy, Giovanni Buttarelli, opened the hostilities, speaking by telephone from Washington, who said he was "deeply disappointed" with the draft legislative decree, approved in recent days by the Council of Ministers, and which will accompany the launch of European regulation.
The reason for the disappointment - he explained - was the lack of importance given to penal sanctions by the legislative decree which instead left the task of exercising deterrence against incorrect behavior to administrative sanctions. "It was a bad regulatory accident - she commented - there is the risk that companies will interpret the administrative sanctions only as a balance sheet item".
Gisella Finocchiaro, president of the working group that drafted the legislative decree, immediately answered him at the conference. “We have in no way trivialized the issue of protecting citizens – she replied – apart from the rhetoric, criminal sanctions have been little used by the Italian courts. And I assure you that companies are much more concerned about administrative sanctions which can reach 4% of turnover".
Even on the latter, however, there are those who ask to act with the necessary gradualness. "A strong administrative sanction - underlined Ginevra Bruzzone, deputy general manager of Assonime - obtains an effective deterrent effect when the perimeter of the illicit conduct is clear". When, on the other hand, the picture is not clear, it is advisable to precede a phase in which controllers and controlled parties agree on what is possible to do or what is prohibited.
