language: en · source language: it · status: in-force · last checked: 2026-10-08

Italy — Garante per la protezione dei dati personali: provvedimenti on schools

Three acts of the Italian data-protection authority (the Garante per la protezione dei dati personali) that apply the GDPR and the Codice privacy to schools and the platforms schools use: the general provvedimento "Didattica a distanza: prime indicazioni" (26 March 2020), the Garante's opinion on the Ministry of Education's guidelines for introducing AI in schools (4 August 2025), and a 2025 sanction against a school for fingerprint attendance. They are reproduced in full, in Italian.

The guidance is not binding in itself. The Garante adopted the didattica a distanza document under its art. 57(1)(b) and (d) GDPR tasks of promoting awareness. The sanction binds only the school it was addressed to. All three show how the authority that enforces the GDPR in Italy reads it for schools. The school-sector vademecum "La scuola a prova di privacy" is a separate instrument: garante-vademecum-scuola.

Fact text is Italian (authentic language); this README is curation.

Applicability to EdTech

• The platform is the school's processor and needs an art. 28 contract (DaD all. 1 §3). This covers the registro elettronico, whose supplier processes data on the school's behalf. On "generalist" platforms only the services strictly needed for teaching may be switched on by default, configured to minimise data, avoiding geolocation and social login.
• No processing for the supplier's own purposes, and no consent bundling (DaD §4). Platform processing must be limited to what the requested teaching services need. Making access to distance learning conditional on accepting a contract or consenting to other, non-teaching online services is "inammissibile", and minors' data deserve specific protection against marketing and profiling.
• Schools need no consent for teaching platforms (DaD §1). A DPIA is not required for a single school using a videoconferencing service or platform that does not systematically monitor users or use particularly invasive technology. Geolocation or biometric uses are given as the examples of what would change that (§2).
• AI in schools (parere n. 454/2025): the Garante gave a favourable opinion on the Ministry's "Linee guida per l'introduzione dell'Intelligenza Artificiale nelle Istituzioni scolastiche". It records the points it secured: strict observance of the AI Act's prohibitions, naming emotion recognition (sentiment analysis) in the school context; the high-risk regime for Annex III point 3 systems; using student and teacher personal data only where strictly indispensable, preferring synthetic data; and configurations that prevent the retention of prompts and the profiling or tracking of students.
• Biometrics (provv. n. 167/2025 §4): fingerprint templates are biometric data even when the vendor stores only a non-reversible template. Without a specific legal provision, a school has no legal basis for biometric processing, and staff consent cannot fill that gap. The school was fined €4,000. Among the aggravating factors, it relied on the supplier's assurances of GDPR conformity and did not consult its DPO (§6).

Contents

Scope note: the MIM's AI guidelines themselves (the Ministry's document, not the Garante's) and the Garante's 2020 letter to the Minister on the registro elettronico (doc. web n. 9334326) are not carried. No Garante provvedimento on smart glasses or facial recognition in Italian schools was found (searched 2026-10-08). The biometric sanction above concerns staff attendance; its reasoning on legal basis and consent is general.

Enforcement

The Garante enforces the GDPR and the Codice privacy (art. 58 GDPR powers; sanctions under art. 83 GDPR and art. 166 Codice), as in the ordinanza ingiunzione above. A decision can be appealed to the ordinary courts within thirty days (art. 152 Codice).

Licence

The corpus reproduces three provvedimenti adopted by the Collegio of the Garante and published in its Registro dei provvedimenti: n. 64 of 26 March 2020 with its annex, n. 454 of 4 August 2025, and n. 167 of 27 March 2025.

Italian copyright law does not reach official acts. Art. 5 of legge 22 aprile 1941, n. 633 (Normattiva — legge 633/1941, art. 5) provides: "Le disposizioni di questa legge non si applicano ai testi degli atti ufficiali dello stato e delle Amministrazioni pubbliche, sia italiane che straniere." The Garante is a public authority, and these are acts it adopted in the exercise of its powers. Allegato n. 1 is, in the act's own words, a document "che forma parte integrante del presente provvedimento". The Garante's site sets no other reproduction terms: its "Regole del sito" page (garanteprivacy.it — Regole del sito, read 2026-10-08) explains navigation, search and accessibility only.

Conditions: none attach to the text, because no copyright subsists in it. The corpus still identifies its source: each document names its docweb page in its provenance line and Meta section. The selection, the Markdown layout and the added anchors are described in Meta. The corpus does not claim that the Garante endorses it.

Related

• Codice privacy: the Italian statute these acts apply (digital-consent age 14, the education public-interest ground)
• La scuola a prova di privacy: the Garante's vademecum for schools, which cites the didattica a distanza provvedimento
• Legge Stanca and AGID Linee guida accessibilità: the accessibility side of school ICT procurement
• ACN Regolamento cloud: what a cloud service must be to be used by an Italian public administration

Sources

• Garante — doc. web n. 9300784, "Didattica a distanza: prime indicazioni"
• Garante — doc. web n. 10162698, parere sulle Linee guida IA del MIM
• Garante — doc. web n. 10138981, provvedimento del 27 marzo 2025
• Garante — Scuola (theme page)