EdLaw
Italy — Codice in materia di protezione dei dati personali
The Italian data-protection code (d.lgs. 30 giugno 2003, n. 196), rewritten around the GDPR by d.lgs. 101/2018. Curated here are the EdTech-decisive provisions: the child digital-consent age, the public-interest basis covering education, and the student-data provision.
Fact text is Italian (authentic language); this README is curation.
Applicability to EdTech
- Digital-consent age is 14 — Italy derogated from the GDPR's 16: a minor who has turned fourteen can consent to processing for information-society services; below fourteen, parental-responsibility consent is required (art. 2-quinquies, comma 1). Services aimed at minors must draft their notices in language a minor can understand (comma 2).
- Education is an enumerated public-interest ground: processing of special categories by bodies performing public tasks is deemed of substantial public interest in "istruzione e formazione in ambito scolastico, professionale, superiore o universitario" (art. 2-sexies, comma 2, lett. bb)), subject to the comma-1 requirement of a legal/regulatory basis specifying data types, operations and safeguards (comma 1).
- Student outcomes may be shared only on request and purpose-bound: schools and universities may communicate or diffuse students' formative results (not Art. 9/10 data) to third parties, including privately and online, su richiesta degli interessati, for orientation/training/job-placement purposes only (art. 96, comma 1); the student-confidentiality rule of d.P.R. 249/1998 stays intact (comma 2).
Contents
| Document | Covers |
|---|---|
| MINORI-E-STUDENTI.md | Codice privacy art. 2-quinquies, 2-sexies, 96 |
Scope note: the Garante's school-sector guidance ("La scuola a prova di privacy") and provvedimenti are the operational layer — add them when an Italy deployment question needs that level.
Key obligations at a glance
- Consent-based features for under-14s need parental consent; 14+ can consent themselves (art. 2-quinquies).
- Schools' special-category processing rides on art. 9(2)(g) GDPR via art. 2-sexies, not on consent.
- Publishing student results beyond the statutory channels needs the student's request (art. 96).
Enforcement
Garante per la protezione dei dati personali (garanteprivacy.it).
Related
- EU GDPR — the directly applicable substance
- Legge Stanca — the Italian accessibility act
- UODO, BDSG — sibling national frameworks (Poland kept 16; Germany kept 16)
Sources
Meta
Statute text in MINORI-E-STUDENTI.md is reproduced verbatim in Italian from Normattiva (normattiva.it, the official consolidated-legislation portal; each article resolved as testo vigente via its URN with !vig=) and built/re-verified mechanically by tools/normattiva/build_it_codice_privacy.py (verify demands exact canonical equality with the portal text; do not hand-edit statute text). Normattiva's (( )) amendment markers are stripped; its AGGIORNAMENTO annotations are kept, labelled. Anchors derive from printed numbering ({#a2quinquies-1} = art. 2-quinquies, comma 1).