Italy's privacy watchdog turns the spotlight on police facial recognition: a favourable opinion, but with demands for tighter safeguards

On 14 July 2026 the Italian data protection authority, the Garante, adopted opinion no. 531 (doc-web 10275606) on Titles I and III of the draft legislative decree that brings Italian law into line with EU Regulation 2024/1689 (the AI Act). Published in the authority's newsletter of 29 July 2026, the opinion is broadly favourable, yet it asks for sturdier safeguards on four key points: the role of human oversight, a sharper definition of responsibilities in research and testing projects, the authority's involvement in regulatory sandboxes that handle personal data, and stronger guarantees on the quality of the reference biometric databases.

In the Garante's view, police forces should process biometric data only after the fact, on traces already recorded, and only where specific operational needs arise; automated, blanket processing does not square with the AI Act, which permits facial recognition only ex post and for targeted searches. According to ANSA's reporting, the draft would allow faces to be recorded in places deemed sensitive — squares, stadiums, marches — with the data kept for seven days: if a crime is committed in that window the recordings become investigative material, otherwise they are deleted. The opinion also flags that Article 10(3) of the draft would permit automated processing of the biometric data of everyone entering certain places, which the authority considers disproportionate by European standards, and it calls for an explicit ban on databases built through untargeted scraping.

On 29 July 2026 the Senate's EU Policies Committee, speaking through its chair, issued a favourable opinion on the draft, while senators from the Democratic Party and the Five Star Movement walked out of the session, calling it a «blitz» and demanding the vote be postponed. The following day, however, the Chamber of Deputies' EU Policies Committee put the vote off after protests from opposition MPs. In the same context, a European Commission spokesperson stated that «facial recognition in publicly accessible spaces is prohibited by the AI Act», adding that the Commission does not yet have enough information to assess the Italian draft. The government has reiterated that Italy will keep complying with European law: Palazzo Chigi replied that Italy «will continue to respect European legislation, as it has done so far», and deputy prime minister Antonio Tajani added: «The EU has set out guidelines and we will follow them».

The final text of the draft decree has not yet been adopted by the Council of Ministers and may change from what the Garante examined and the press reported. What is more, the precise details of Articles 8 and 10 (real-time biometric identification and seven-day retention) are known mainly through the authority's opinion and press accounts, not from a version published in the Official Gazette. It remains to be seen how the Justice and Constitutional Affairs committees will shape the final measure.