Italy's data protection authority turns the spotlight on police facial recognition: a favourable opinion, but with demands for tighter safeguards

On 14 July 2026 the Italian data protection authority (Garante per la protezione dei dati personali) adopted opinion no. 531 (doc‑web 10275606) on Titles I and III of the draft legislative decree aligning Italian law with EU Regulation 2024/1689 (the AI Act). The opinion, made public in the newsletter of 29 July 2026, was broadly favourable, but demanded stronger safeguards on four key points: the role of human oversight, a sharper definition of accountability in research and testing projects, the Authority's involvement in regulatory sandboxes that process personal data, and stronger guarantees on the quality of the reference biometric databases.

According to the Garante, biometric data may be processed by police forces only after the fact, on traces already recorded, and in response to specific operational needs; automated, blanket processing does not square with the AI Act, which permits facial recognition only retrospectively and for targeted searches. According to ANSA's account, the draft would allow faces to be recorded in places deemed sensitive — squares, stadiums, marches — with data kept for seven days: if a crime is committed during that window the recordings become investigative material, otherwise they are deleted. The opinion also flagged that article 10(3) of the draft would allow automated processing of the biometric data of everyone entering certain places, judging this disproportionate by European standards and calling for an explicit ban on databases built through untargeted scraping.

On 29 July 2026 the Senate's EU Policies Committee, chaired by Giulio Terzi di Sant'Agata (Brothers of Italy), gave the draft a favourable opinion, while senators from the Democratic Party and the Five Star Movement walked out of the session, calling it a «blitz» and asking for the vote to be postponed. The following day, however, the Chamber of Deputies' EU Policies Committee did postpone its vote after protests from opposition MPs. In the same context, a European Commission spokesperson stated that «facial recognition in publicly accessible spaces is prohibited by the AI Act», while noting that Brussels does not yet have enough information to assess the Italian draft. The government insisted Italy would keep to EU law: the prime minister's office replied that Italy «will continue to respect European legislation, as it has done so far», and deputy prime minister Antonio Tajani added: «The EU has set out guidelines and we will follow them».

The final text of the draft decree has not yet been adopted by the Council of Ministers and may change from what the Garante analysed and the press reported. Moreover, the precise contents of articles 8 and 10 (real-time biometric identification and seven-day data retention) are known mainly through the Garante's opinion and press accounts, not from a version published in the Official Gazette. It remains to be seen how the Justice and Constitutional Affairs committees will shape the final measure.