Italy: Data Protection Authority issued ruling in investigation into non-consensual disclosure of private audio over privacy violations

On 4 August 2025, the Italian Data Protection Authority issued Provision No. 467 in response to the non-consensual disclosure of a private audio file taken from a chat conversation involving a well-known actor. The Authority considered the audio to form part of private correspondence protected under Article 15 of the Constitution and recognised that its publication constituted processing of personal data within the scope of Regulation (EU) 2016/679 (General Data Protection Regulation) and the Italian Personal Data Protection Code (Legislative Decree No. 196/2003, as amended). The Authority found that, while journalistic freedom of expression does not always require consent, the disclosure lacked materiality in relation to the actor’s public role and instead concerned intimate and emotional matters unrelated to public interest. Pursuant to Article 58(2)(a) of the Regulation and Article 154(1)(f) of the Code, the Authority issued a warning to potential users of the data subject’s personal data, emphasising that any further dissemination of the audio or related extracts could constitute a violation leading to sanctions. Furthermore, under Article 154-bis(3) of the Code, the Authority ordered publication of the decision in the Official Journal of the Italian Republic to ensure wider awareness. The provision also noted the right of appeal under Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, allowing challenges before the competent judicial authority within 30 days in Italy or 60 days if abroad.