EdLaw
Italy — Codice in materia di protezione dei dati personali
The Italian data-protection code (d.lgs. 30 giugno 2003, n. 196), rewritten around the GDPR by d.lgs. 101/2018. Curated here are the EdTech-decisive provisions: the child digital-consent age, the public-interest basis covering education, and the student-data provision.
Fact text is Italian (authentic language); this README is curation.
Applicability to EdTech
- Digital-consent age is 14 — Italy derogated from the GDPR's 16: a minor who has turned fourteen can consent to processing for information-society services; below fourteen, parental-responsibility consent is required (art. 2-quinquies, comma 1). Services aimed at minors must draft their notices in language a minor can understand (comma 2).
- Education is an enumerated public-interest ground: processing of special categories by bodies performing public tasks is deemed of substantial public interest in "istruzione e formazione in ambito scolastico, professionale, superiore o universitario" (art. 2-sexies, comma 2, lett. bb)), subject to the comma-1 requirement of a legal/regulatory basis specifying data types, operations and safeguards (comma 1).
- Student outcomes may be shared only on request and purpose-bound: schools and universities may communicate or diffuse students' formative results (not Art. 9/10 data) to third parties, including privately and online, su richiesta degli interessati, for orientation/training/job-placement purposes only (art. 96, comma 1); the student-confidentiality rule of d.P.R. 249/1998 stays intact (comma 2).
Contents
| Document | Covers |
|---|---|
| MINORI-E-STUDENTI.md | Codice privacy art. 2-quinquies, 2-sexies, 96 |
Scope note: the Garante's school-sector layer is carried separately: its provvedimenti on schools in Garante — scuola and the vademecum in La scuola a prova di privacy.
Key obligations at a glance
- Consent-based features for under-14s need parental consent; 14+ can consent themselves (art. 2-quinquies).
- Schools' special-category processing rides on art. 9(2)(g) GDPR via art. 2-sexies, not on consent.
- Publishing student results beyond the statutory channels needs the student's request (art. 96).
Enforcement
Garante per la protezione dei dati personali (garanteprivacy.it).
Licence
The corpus reproduces selected articles of the Codice in materia di protezione dei dati personali (d.lgs. 196/2003) in the testo vigente on Normattiva, with Normattiva's AGGIORNAMENTO notes labelled.
Italian copyright law does not apply to official acts. Art. 5 of legge 22 aprile 1941, n. 633 (Normattiva — legge 633/1941, art. 5, read 2026-10-01) provides: "Le disposizioni di questa legge non si applicano ai testi degli atti ufficiali dello stato e delle Amministrazioni pubbliche, sia italiane che straniere."
The AGGIORNAMENTO notes kept in the text are factual amendment references.
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (Normattiva). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.
Related
- EU GDPR — the directly applicable substance
- Legge Stanca — the Italian accessibility act
- Garante — scuola and La scuola a prova di privacy — the Garante's provvedimenti and vademecum applying the Codice to schools
- UODO, BDSG — sibling national frameworks (Poland kept 16; Germany kept 16)