Italy's data protection code, amended to sit under the GDPR rather than replaced by it. It carries the most developed criminal track of the five Tier 1 EU states profiled here — three distinct offences with escalating custody, including one aimed specifically at unlawful dissemination on a large scale.

Criminal liability

A distinct track, separate from the regulatory penalties below. The same failure can attract both — a penalty notice against the organisation and a prosecution of the individual.

Art 167 — Unlawful processing of personal data Custodial available

Processing personal data unlawfully so as to cause harm, with intent to profit or damage.

Penalty

6 months to 3 years

Imprisonment

Available

Art 167-bis — Unlawful communication and dissemination of personal data on a large scale Custodial available

Communicating or disseminating a large-scale archive of personal data without authority.

Penalty

1 to 6 years

Imprisonment

Available

Art 167-ter — Fraudulent acquisition of personal data processed on a large scale Custodial available

Acquiring by fraudulent means a large-scale archive of personal data.

Penalty

1 to 4 years

Imprisonment

Available

Sources

• Primary Decreto legislativo 30 giugno 2003, n. 196 Garante per la protezione dei dati personali no verified URL yet

  URL unconfirmed.

Never independently verified — seeded from the prototype.