Law 675 of 12-31-96

 

LAW 31 DECEMBER 1996 N. 675
Protection of people and other subjects regarding the processing of personal data
(Repealed from 1/1/2004 pursuant to Legislative Decree 196/2003)
Chapter I
GENERAL PRINCIPLES
Article 1
Purpose and definitions
1. This law guarantees that the processing of personal data is carried out in compliance with the rights, fundamental freedoms, as well as the dignity of natural persons, with particular reference to confidentiality and personal identity; it also guarantees the rights of legal persons and of any other body or association.
2. For the purposes of this law:

a) for -database- any complex of personal data, divided into one or more units located in one or more sites, organized according to a plurality of determined criteria such as to facilitate their treatment;
b) for -treatment- any operation or set of operations, carried out with or without the aid of electronic or automated means, concerning the collection, registration, organization, conservation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, cancellation and destruction of data;
c) for -personal data- any information relating to a natural person, legal person, entity or association, identified or identifiable, even indirectly, by reference to any other information, including a personal identification number;
d) for -owner- the natural person, the legal person, the public administration and any other entity, association or body responsible for decisions regarding the purposes and methods of processing personal data, including the security profile;
e) for -responsible- the natural person, the legal person, the public administration and any other entity, association or body appointed by the owner to process personal data;
f) for -interested- the natural person, legal person, body or association to which the personal data refer;
g) by -communication- giving knowledge of personal data to one or more specific subjects other than the interested party, in any form, including by making them available or consulting them;
h) for -dissemination- the disclosure of personal data to unspecified subjects, in any form, including by making them available or for consultation;
i) for -anonymous data- the data which originally, or following processing, cannot be associated with an identified or identifiable interested party;
l) for -blocking- the retention of personal data with temporary suspension of any other processing operation;
m) for -Guarantor- the authority established pursuant to article 30.
Article 2
Scope of
1. This law applies to the processing of personal data by anyone carried out in the territory of the State.
Article 3
Processing of data for exclusively personal purposes
1. The processing of personal data carried out by natural persons for exclusively personal purposes is not subject to the application of this law, provided that the data are not intended for systematic communication or dissemination.
2. The data security provisions referred to in article 15, as well as the provisions referred to in articles 18 and 36, shall in any case apply to the processing referred to in paragraph 1.
Article 4
Special treatments in the public sphere
1. This law does not apply to the processing of personal data carried out:

a) from the data processing center referred to in article 8 of the law of 1 April 1981, n. 121, as amended by article 43, paragraph 1, of this law, or on the data destined to flow therein on the basis of the law, as well as by virtue of the agreement of accession to the Convention implementing the Schengen Agreement, enforced with law 30 September 1993, n. 388;
b) by the bodies referred to in articles 3, 4 and 6 of the law of 24 October 1977, n. 801, or on data covered by state secrecy pursuant to article 12 of the same law;
c) in the context of the criminal record service referred to in title IV of the tenth book of the criminal procedure code and to the royal decree of 18 June 1931, n. 778, and subsequent amendments, or, according to the law, in the context of the service of pending charges in criminal matters;
d) in implementation of article 371-bis, paragraph 3, of the code of criminal procedure or, for reasons of justice, in the context of judicial offices, of the Superior Council of the Judiciary and of the Ministry of Justice;
e) by other public subjects for purposes of defense or state security or for the prevention, detection or repression of crimes, on the basis of express provisions of the law which specifically provide for processing.
2. The provisions referred to in articles 9, 15, 17, 18, 31, 32, paragraphs 6 and 7, and 36 shall apply in any case to the treatments referred to in paragraph 1, as well as, with the exception of the treatments referred to in letter b) of paragraph 1, the provisions referred to in articles 7 and 34.
Article 5
Data processing carried out without the aid of electronic means
1. The processing of personal data carried out without the aid of electronic or automated means is subject to the same discipline envisaged for the treatment carried out with the aid of such means.
Article 6
Processing of data held abroad
1. The processing in the territory of the State of personal data held abroad is subject to the provisions of this law.
2. If the treatment referred to in paragraph 1 consists in a transfer of personal data outside the national territory, the provisions of article 28 shall apply in any case.

Chapter II
OBLIGATIONS FOR THE HOLDER OF THE TREATMENT
Article 7
Notification
1. The owner who intends to process personal data subject to the field of application of this law is required to notify the Guarantor.
2. The notification is made in advance and only once, by registered letter or by other suitable means to certify receipt, regardless of the number of operations to be carried out, as well as the duration of the treatment and may concern one or more treatments with related purposes. A new notification is required only if any of the elements indicated in paragraph 4 changes and it must precede the implementation of the variation.
3. The notification is signed by the notifier and the controller.
4. The notification contains:

a) the name, denomination or company name and domicile, residence or registered office of the holder;
b) the purposes and methods of processing;
c) the nature of the data, the place where they are kept and the categories of interested parties to whom the data refer;
d) the scope of communication and dissemination of data;
e) transfers of data envisaged to countries outside the European Union or, if they concern any of the data referred to in articles 22 and 24, outside the national territory;
f) a general description which makes it possible to evaluate the adequacy of the technical and organizational measures adopted for data security;
g) indication of the database or databases to which the treatment refers, as well as any connection with other treatments or databases, even outside the national territory;
h) the name, denomination or company name and domicile, residence or registered office of the person in charge; in the absence of this indication, the notifier is considered responsible;
i) the quality and legitimacy of the notifier.
5. Persons required to register or who must be noted in the business register referred to in article 2188 of the civil code, as well as those who must provide the information referred to in article 8, paragraph 8, letter d), of law no. 580, the chambers of commerce, industry, handicrafts and agriculture, can make the notification through the latter, according to the procedures established with the regulation referred to in article 33, paragraph 3. Small entrepreneurs and craftsmen can also make the notification through the respective category representatives; members of professional registers also through their respective professional orders. In any case, the provision referred to in paragraph 3 remains unchanged.
5-bis. The notification in simplified form may not contain some of the elements referred to in paragraph 4, letters b), c), e) and g), identified by the Guarantor pursuant to the regulation referred to in article 33, paragraph 3, when the processing is carried out:

a) by public subjects, excluding economic public entities, on the basis of an express provision of the law pursuant to articles 22, paragraph 3 and 24, or the provision referred to in the same article 24;
b) in the exercise of the profession of journalist and for the exclusive pursuit of the related purposes, or by the subjects indicated in paragraph 4-bis of article 25, in compliance with the code of ethics referred to in the same article;
c) temporarily without the aid of electronic or automated means, for the sole purposes and in the manner strictly connected to the internal organization of the activity carried out by the owner, in relation to data not recorded in a database and other than those referred to in articles 22 and 24.
5-ter. Except for the cases referred to in article 4, the processing is not subject to notification when:

a) it is necessary for the performance of a task established by the law, by a regulation or by community legislation, in relation to data other than those indicated in articles 22 and 24;
b) concerns data contained in or originating from public registers, lists, deeds or documents that can be known by anyone, without prejudice to the limits and methods referred to in article 20, paragraph 1, letter b);
c) is carried out for the exclusive purposes of protocol management, in relation to the data necessary for the classification of correspondence sent for purposes other than those referred to in Article 13, paragraph 1, letter e), with particular reference to the personal details and contact details of the interested parties, their qualification and the organization to which they belong;
d) concerns telephone directories or similar not intended for distribution, used solely for office and work reasons and in any case for purposes other than those referred to in article 13, paragraph 1, letter e);
e) is aimed solely at the fulfillment of specific accounting, remuneration, social security, welfare and tax obligations, and is carried out with reference only to the categories of data, of interested parties and of recipients of the communication and dissemination strictly connected to this fulfillment, keeping the data no later than the period necessary for the fulfillment itself;
f) is carried out, except for the provisions of paragraph 5-bis, letter b) by freelance professionals registered in professional registers or lists, only for purposes strictly connected to the fulfillment of specific services and without prejudice to professional secrecy;
g) is carried out by small entrepreneurs referred to in article 2083 of the Civil Code for the sole purposes strictly connected to the performance of the professional activity exercised, and limited to the categories of data of interested parties, recipients of communication and dissemination and the retention period of the data necessary for the pursuit of the same purposes;
h) is aimed at keeping registers or professional lists in compliance with the laws and regulations;
i) is carried out for the exclusive purposes of the ordinary management of libraries, museums and exhibitions, in compliance with laws and regulations, or for the organization of cultural or sporting initiatives or for the creation of catalogs and bibliographies;
l) it is carried out by associations, foundations, committees also of a political, philosophical, religious or trade union nature, or by their representative bodies, set up for non-profit purposes and for the pursuit of lawful purposes, in relation to data relating to the members and to the subjects who, in relation to these purposes, have regular contact with the association, foundation, committee or body, without prejudice to the obligations of informing the interested parties and acquiring consent, where necessary;
m) is carried out by voluntary organizations referred to in the law of 11 August 1991, n. 266, within the limits referred to in letter l) and in compliance with the authorizations and provisions of the law referred to in articles 22 and 23;
n) is carried out temporarily and is aimed exclusively at the occasional publication or diffusion of articles, essays and other manifestations of thought, in compliance with the Code referred to in article 25;
o) it is carried out, also with electronic or in any case automated means, for the preparation of periodicals or publications having the purpose of legal information, relating to data inferred from provisions of the judicial authority or other authorities;
p) is carried out temporarily for the exclusive purpose of gathering adhesions to popular initiative law proposals, referendum requests, petitions or appeals;
q) is aimed solely at the administration of the condominiums referred to in article 1117 and following of the Civil Code, limited to the categories of data, interested parties and recipients of the communication necessary for the administration of common goods, keeping the data no longer than the period necessary for the protection of the corresponding rights.
5-quater. The holder can make use of the simplified notification or the exemption referred to in paragraphs 5-bis and 5-ter, provided that the processing concerns only the purposes, the categories of data, interested parties and recipients of the communication and dissemination identified, together with the data retention period, by the same paragraphs 5-bis and 5-ter, as well as:

a) in the cases referred to in paragraphs 5-bis, letter a) and 5-ter, letters a) and m), by the provisions of the law or regulation or by the Community legislation indicated therein;
b) in the case referred to in paragraph 5-bis, letter b), by the code of ethics indicated therein;
c) in the remaining cases, by the Guarantor, with the authorizations issued in the manner envisaged by article 41, paragraph 7, or, for data other than those referred to in articles 22 and 24, with similar provisions.
5-quinquies. The holder who makes use of the exemption referred to in paragraph 5-ter must provide the elements referred to in paragraph 4 to anyone who requests them
Article 8
Responsible
1. The person in charge, if designated, must be appointed from among subjects who, by experience, ability and reliability, provide a suitable guarantee of full compliance with the provisions in force on the subject of treatment, including the profile relating to security.
2. The person in charge proceeds with the treatment by following the instructions given by the owner who, also through periodic checks, supervises the punctual observance of the provisions referred to in paragraph 1 and of his own instructions.
3. Where necessary for organizational reasons, several subjects may be designated as managers, also by subdivision of tasks.
4. The tasks entrusted to the manager must be analytically specified in writing.
5. Data processors must process the personal data to which they have access following the instructions of the controller or processor.

Chapter III
PROCESSING OF PERSONAL DATA
Section I
Data collection and requirements
Article 9
Methods of collection and requirements of personal data
1. The personal data being processed must be:

a) processed lawfully and fairly;
b) collected and recorded for specific, explicit and legitimate purposes, and used in other processing operations in terms not incompatible with such purposes;
c) accurate and, if necessary, updated;
d) pertinent, complete and not excessive in relation to the purposes for which they are collected or subsequently processed;
e) kept in a form that allows identification of the data subject for a period of time not exceeding that necessary for the purposes for which they were collected or subsequently processed.
Article 10
Information rendered at the time of collection
1. The interested party or the person from whom the personal data are collected must be previously informed orally or in writing about:

a) the purposes and methods of the processing for which the data are intended;
b) the mandatory or optional nature of the provision of data;
c) the consequences of a possible refusal to answer;
d) the subjects or categories of subjects to whom the data may be communicated and the scope of diffusion of the same data;
e) the rights referred to in article 13;
f) the name, denomination or company name and domicile, residence or registered office of the owner and, if designated, of the person in charge.
2. The information referred to in paragraph 1 may not include the elements already known to the person providing the data or the knowledge of which may hinder the performance of public inspection or control functions, carried out for the pursuit of the purposes referred to in articles 4, paragraph 1, letter e), and 14, paragraph 1, letter d).
3. When the personal data are not collected from the interested party, the information referred to in paragraph 1 is given to the same interested party when the data is recorded or, if their communication is envisaged, no later than the first communication.
4. The provision referred to in paragraph 3 does not apply when the information to the interested party involves the use of means that the Guarantor declares manifestly disproportionate to the protected right, or proves to be, in the opinion of the Guarantor, impossible, or in the case in which the data are processed on the basis of an obligation established by law, by a regulation or by community legislation. The same provision does not apply, moreover, when the data are processed for the purpose of carrying out the investigations referred to in article 38 of the implementation, coordination and transitional rules of the code of criminal procedure, approved with legislative decree 28 July 1989, n. 271, and subsequent amendments, or, in any case, to assert or defend a right in court, provided that the data are processed exclusively for these purposes and for the period strictly necessary for their pursuit.

Section II
Rights of the interested party in data processing
Article 11
Consent
1. The processing of personal data by private individuals or public economic entities is permitted only with the express consent of the interested party.
2. The consent may concern the entire treatment or one or more operations of the same.
3. Consent is validly given only if it is freely expressed, and in a specific and documented form in writing, and if the information referred to in article 10 has been provided to the interested party.
Article 12
Cases of exclusion of consent
1. Consent is not required when the treatment:

a) concerns data collected and held on the basis of an obligation established by law, by a regulation or by community legislation;
b) it is necessary for the execution of obligations deriving from a contract of which the interested party is a party or for the acquisition of pre-contractual information activated at the request of the latter, or for the fulfillment of a legal obligation;
c) concerns data from public registers, lists, deeds or documents that can be known by anyone;
d) is aimed solely at scientific research or statistical purposes and is anonymous data;
e) is carried out in the exercise of the profession of journalist and for the exclusive pursuit of the related purposes. In this case, the code of ethics referred to in article 25 applies;
f) concerns data relating to the performance of economic activities also collected for the purposes indicated in article 13, paragraph 1, letter e), in compliance with current legislation on business and industrial secrecy;
g) it is necessary to safeguard the life or physical integrity of the interested party or of a third party, in the event that the interested party cannot give his consent due to physical impossibility, inability to act or inability to understand or want;
h) it is necessary for the purposes of carrying out the investigations referred to in article 38 of the implementation, coordination and transitional rules of the criminal procedure code, approved by legislative decree no. 271, and subsequent amendments, or, in any case, to assert or defend a right in court, provided that the data are processed exclusively for these purposes and for the period strictly necessary for their pursuit.
Article 13
Rights of the interested party
1. In relation to the processing of personal data, the interested party has the right:

a) to know, through free access to the register referred to in article 31, paragraph 1, letter a), the existence of data processing that may concern him;
b) to be informed of what is indicated in article 7, paragraph 4, letters a), b) and h);
c) to obtain, by the owner or manager, without delay:

1) confirmation of the existence or not of personal data concerning him, even if not yet recorded, and communication in an intelligible form of the same data and their origin, as well as the logic and purposes on which the treatment is based; the request can be renewed, save for the existence of justified reasons, with an interval of no less than ninety days;
2) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
3) updating, rectification or, if interested, integration of data;
4) the attestation that the operations referred to in numbers 2) and 3) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment proves impossible or involves a use of means manifestly disproportionate to the protected right;
d) to object, in whole or in part, for legitimate reasons, to the processing of personal data concerning him, even if pertinent to the purpose of the collection;
e) to object, in whole or in part, to the processing of personal data concerning him, envisaged for the purpose of commercial information or the sending of advertising material or direct sales or for carrying out market research or interactive commercial communication and to be informed by the owner, no later than the moment in which the data are communicated or disseminated, of the possibility of exercising this right free of charge.
2. For each request referred to in paragraph 1, letter c), number 1), the interested party may be asked, if the existence of data concerning him/her is not confirmed, for a contribution to expenses, not exceeding the costs actually incurred, according to the methods and within the limits established by the regulation referred to in article 33, paragraph 3.
3. The rights referred to in paragraph 1 referring to personal data concerning deceased persons can be exercised by anyone who has an interest therein.
4. In exercising the rights referred to in paragraph 1, the interested party may grant, in writing, a proxy or power of attorney to natural persons or associations.
5. The rules on professional secrecy of journalists remain unchanged, limited to the source of the news.
Article 14
Limits on the exercise of rights
1. The rights referred to in article 13, paragraph 1, letters c) and d), cannot be exercised with respect to the processing of personal data collected:

a) on the basis of the provisions of the decree-law of 3 May 1991, n. 143, converted, with amendments, by law 5 July 1991, n. 197, and subsequent modifications;
b) on the basis of the provisions of the decree-law of 31 December 1991, n. 419, converted, with amendments, by law February 18, 1992, n. 172, and subsequent modifications;
c) by parliamentary commissions of inquiry set up pursuant to article 82 of the Constitution;
d) by a public entity, other than economic public bodies, on the basis of an express provision of the law, for exclusive purposes relating to monetary and currency policy, the payment system, the control of intermediaries and credit and financial markets as well as the protection of their stability;
e) pursuant to article 12, paragraph 1, letter h), limited to the period during which the conduct of the investigations or the exercise of the right referred to in the same letter h) could be prejudiced.
2. In the cases referred to in paragraph 1, the Guarantor, also upon notification by the interested party pursuant to article 31, paragraph 1, letter d), carries out the necessary checks in the manner referred to in article 32, paragraphs 6 and 7, and indicates the necessary modifications and additions, verifying their implementation.

Section III
Security in data processing, limits on the usability of data and compensation for damages
Article 15
Data security
1. The personal data being processed must be kept and controlled, also in relation to the knowledge acquired on the basis of technical progress, the nature of the data and the specific characteristics of the treatment, in order to minimize, through the adoption of suitable and preventive security measures, the risks of destruction or loss, even accidental, of the data themselves, of unauthorized access or of treatment that is not permitted or does not comply with the purposes of the collection.
2. The minimum safety measures to be adopted as a preventive measure are identified by regulation issued by decree of the President of the Republic, pursuant to article 17, paragraph 1, letter a), of the law of 23 August 1988, n. 400, within one hundred and eighty days from the date of entry into force of this law, on the proposal of the Minister of Justice, having consulted the Authority for information technology in public administration and the Guarantor.
3 The security measures referred to in paragraph 2 are adequate, within two years from the date of entry into force of this law and subsequently at least every two years, with subsequent regulations issued with the methods referred to in the same paragraph 2, in relation to the technical evolution of the sector and the experience gained.
4. The security measures relating to the data processed by the bodies referred to in article 4, paragraph 1, letter b), are established by decree of the President of the Council of Ministers with observance of the rules governing the matter.
Article 16
Cessation of data processing
1. In the event of termination, for any reason, of data processing, the holder must notify the Guarantor in advance of their destination.
2. The data can be:

a) destroyed;
b) transferred to another owner, provided they are intended for processing for purposes similar to the purposes for which the data were collected;
c) stored for exclusively personal purposes and not intended for systematic communication or dissemination.
3. The transfer of data in violation of the provisions of letter b) of paragraph 2 or of other legal provisions on the processing of personal data is void and is punished pursuant to article 39, paragraph 1.
Article 17
Limits on the usability of personal data
1. No judicial or administrative act or provision involving an assessment of human behavior can be based solely on an automated processing of personal data aimed at defining the profile or personality of the data subject.
2. The interested party may oppose any other type of decision adopted on the basis of the treatment referred to in paragraph 1 of this article, pursuant to article 13, paragraph 1, letter d), unless the decision was adopted on the occasion of the conclusion or execution of a contract, in acceptance of a proposal from the interested party or on the basis of adequate guarantees identified by law.
Article 18
Damage caused by the processing of personal data
1. Whoever causes damage to others as a result of the processing of personal data is required to pay compensation pursuant to article 2050 of the civil code.

Section IV
Communication and dissemination of data
Article 19
Persons in charge of the treatment
1. The knowledge of personal data by the persons appointed in writing to carry out the processing operations by the owner or manager, and who operate under their direct authority, is not considered communication.
Article 20
Requirements for communication and dissemination of data
1. The communication and dissemination of personal data by private individuals and economic public bodies are permitted:

a) with the express consent of the interested party;
b) if the data come from public registers, lists, deeds or documents that can be known by anyone, without prejudice to the limits and methods that the laws and regulations establish for their knowledge and publicity;
c) in fulfillment of an obligation established by law, by a regulation or by community legislation;
d) in the exercise of the profession of journalist and for the exclusive pursuit of the related purposes. The limits of the right to report placed to protect confidentiality and in particular the essentiality of information regarding facts of public interest remain unchanged. The code of ethics referred to in article 25 also applies;
e) if the data relate to the performance of economic activities, in compliance with current legislation on corporate and industrial secrecy;
f) if they are necessary to safeguard the life or physical integrity of the interested party or of a third party, in the event that the interested party cannot give his consent due to physical impossibility, inability to act or inability to understand or want;
g) limited to communication, if this is necessary for the purposes of carrying out the investigations referred to in article 38 of the implementation, coordination and transitional rules of the code of criminal procedure, approved with legislative decree 28 July 1989, n. 271, and subsequent amendments, or, in any case, to assert or defend a right in court, in compliance with the legislation referred to in letter e) of this paragraph, provided that the data are processed exclusively for these purposes and for the period strictly necessary for their pursuit;
h) limited to the communication, when this is made within the banking groups referred to in article 60 of the consolidated text of the laws on banking and credit approved by legislative decree 1 September 1993, n. 385, as well as between subsidiaries and associated companies pursuant to article 2359 of the civil code, whose treatments with related purposes have been notified pursuant to article 7, paragraph 2, for the pursuit of the same purposes for which the data were collected.
2. The provisions of article 27 shall apply to the communication and dissemination of personal data by public entities, excluding economic public bodies.
Article 21
Prohibition of communication and dissemination
1. The communication and dissemination of personal data for purposes other than those indicated in the notification referred to in article 7 are prohibited.
2. The communication and dissemination of personal data whose cancellation has been ordered, or when the period of time indicated in article 9, paragraph 1, letter e), is also prohibited.
3. The Guarantor may prohibit the dissemination of some of the data relating to individual subjects, or categories of subjects, when the dissemination is in contrast with relevant interests of the community. Opposition can be lodged against the prohibition pursuant to article 29, paragraphs 6 and 7.
4. The communication and dissemination of data are in any case permitted:

a) if they are necessary for scientific or statistical research purposes and are anonymous data;
b) when they are requested by the persons referred to in article 4, paragraph 1, letters b), d) and e), for purposes of defense or state security or the prevention, detection or repression of crimes, with observance of the rules governing the matter.

Chapter IV
PROCESSING OF PARTICULAR DATA
Article 22
Sensitive data
1. Personal data suitable for revealing racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political or trade union nature, as well as personal data suitable for revealing the state of health and sex life, may be processed only with the written consent of the interested party and with the prior authorization of the Guarantor.
2. The Guarantor communicates the decision adopted on the request for authorization within thirty days, after which failure to pronounce is equivalent to rejection. With the authorization provision, or subsequently, also on the basis of any checks, the Guarantor can prescribe measures and expedients to guarantee the interested party, which the data controller is required to adopt.
3. The processing of the data referred to in paragraph 1 by public subjects, excluding economic public bodies, is permitted only if authorized by express provision of the law which specifies the data that can be processed, the operations that can be performed and the relevant purposes of public interest pursued.
4. Personal data suitable for revealing the state of health and sexual life may be processed with the prior authorization of the Guarantor, if the processing is necessary for the purposes of carrying out the investigations referred to in article 38 of the implementation, coordination and transitional rules of the code of criminal procedure, approved with legislative decree 28 July 1989, n. 271, and subsequent amendments, or, in any case, to assert or defend in court a right of equal rank to that of the interested party, provided that the data are processed exclusively for these purposes and for the period strictly necessary for their pursuit. The Guarantor prescribes the measures and precautions referred to in paragraph 2 and promotes the signing of a specific code of ethics and good conduct according to the methods referred to in article 31, paragraph 1, letter h). The provisions of article 43, paragraph 2 remain unchanged
Article 23
Health data
1. Health professions and public health bodies may, even without the authorization of the Guarantor, process personal data suitable for revealing the state of health, limited to data and operations essential for the pursuit of purposes of protection of the physical safety and health of the interested party. If the same purposes concern a third party or the community, in the absence of the interested party's consent, the treatment can take place with the prior authorization of the Guarantor.
2. Personal data suitable for revealing the state of health may be made known to the interested party only through a doctor designated by the interested party or by the owner.
3. The authorization referred to in paragraph 1 is issued, except in cases of particular urgency, after consultation with the Higher Health Council. The communication of data obtained beyond the limits established with the authorization is prohibited.
4. The dissemination of data suitable for revealing the state of health is prohibited, except in the case in which it is necessary for the purposes of prevention, investigation or repression of crimes, with the observance of the rules governing the matter.
Article 24
Data relating to the provisions referred to in article 686 of the criminal procedure code
1. The processing of personal data capable of disclosing provisions referred to in article 686, paragraph 1, letters a) and d), 2 and 3, of the code of criminal procedure, is permitted only if authorized by express provision of the law or provision of the Guarantor which specify the relevant purposes of public interest of the processing, the types of data processed and the precise authorized operations.
Article 25
Processing of particular data in the exercise of the profession of journalist
1. The provisions relating to the consent of the interested party and the authorization of the Guarantor, as well as the limit established by article 24, do not apply when the processing of the data referred to in articles 22 and 24 is carried out in the exercise of the profession of journalist and for the exclusive pursuit of the relative purposes. The journalist respects the limits of the right to report, in particular that of the essentiality of information regarding facts of public interest, without prejudice to the possibility of processing data relating to circumstances or facts disclosed directly by the interested party or through his or her behavior in public.
2. The Guarantor promotes, in the manner referred to in article 31, paragraph 1, letter h), the adoption, by the National Council of the Order of Journalists, of a specific code of ethics relating to the processing of data referred to in paragraph 1 of this article, carried out in the exercise of the profession of journalist, which provides for measures and precautions to guarantee the interested parties related to the nature of the data, in particular as regards those suitable for revealing the state of health and sexual life. In the phase of formation of the code, or subsequently, the Guarantor, in cooperation with the Council, prescribes any measures and expedients to guarantee the interested parties, which the Council is required to implement.
The code is published in the Official Gazette by the Guarantor, and becomes effective fifteen days after its publication.
3. If, within six months of the Guarantor's proposal, the code of ethics referred to in paragraph 2 has not been adopted by the National Council of the Order of Journalists, it is adopted as a substitute by the Guarantor and is effective until the adoption of a different code according to the procedure referred to in paragraph 2. In the event of violation of the provisions contained in the code of ethics, the Guarantor may prohibit the treatment pursuant to article 31, paragraph 1, letter l).
4. The code referred to in paragraphs 2 and 3 also includes provisions concerning personal data other than those indicated in articles 22 and 24.
The code may provide for simplified forms for the disclosures referred to in article 10.
4-bis. The provisions of this law which pertain to the exercise of the profession of journalist also apply to the treatments carried out by the subjects registered in the list of publicists or in the register of trainees referred to in articles 26 and 33 of the law of 3 February 1963, n. 69, as well as temporary treatments aimed exclusively at the occasional publication or diffusion of articles, essays and other manifestations of thought.
Article 26
Data relating to legal entities
1. The processing as well as the termination of the processing of data concerning legal persons, entities or associations are not subject to notification.
2. The provisions of article 28 do not apply to data concerning legal persons, entities or associations.

Head V
TREATMENTS SUBJECT TO A SPECIAL REGIME
Article 27
Processing by public entities
1. Except as provided for in paragraph 2, the processing of personal data by public subjects, excluding economic public bodies, is permitted only for the performance of institutional functions, within the limits established by law and regulations.
2. The communication and dissemination to public subjects, excluding economic public bodies, of the data processed are permitted when they are provided for by law or regulation, or are in any case necessary for the performance of institutional functions. In the latter case, prior notification must be given in the manner referred to in article 7, paragraphs 2 and 3 to the Guarantor who prohibits, with a reasoned provision, the communication or dissemination if the provisions of this law are violated.
3. The communication and dissemination of personal data by public subjects to private individuals or to economic public entities are permitted only if provided for by law or regulation.
4. The criteria of organization of the public administrations referred to in article 5 of the legislative decree 3 February 1993, n. 29, are implemented in full compliance with the provisions of this law.
Article 28
Transfer of personal data abroad
1. The transfer, even temporary, outside the national territory, by any form or means, of personal data being processed must be previously notified to the Guarantor, if it is directed to a country not belonging to the European Union or concerns any of the data referred to in articles 22 and 24.
2. The transfer can only take place after fifteen days from the date of notification; the deadline is twenty days if the transfer concerns some of the data referred to in articles 22 and 24.
3. The transfer is prohibited if the law of the State of destination or transit of the data does not ensure an adequate level of protection of individuals or, in the case of data referred to in articles 22 and 24, of a level equal to that ensured by the Italian law. The methods of transfer and the envisaged treatments, the related purposes, the nature of the data and the security measures are also evaluated.
4. The transfer is in any case permitted if:

a) the interested party has expressed his express consent or, if the transfer concerns some of the data referred to in articles 22 and 24, in writing;
b) it is necessary for the execution of obligations deriving from a contract of which the interested party is a party or for the acquisition of pre-contractual information activated at the request of the latter, or for the conclusion or for the execution of a contract stipulated in favor of the interested party;
c) it is necessary to safeguard a significant public interest identified by law or regulation, or specified pursuant to articles 22, paragraph 3, and 24, if the transfer regards some of the data envisaged therein;
d) it is necessary for the purposes of carrying out the investigations referred to in article 38 of the implementation, coordination and transitional rules of the criminal procedure code, approved by legislative decree no. 271, and subsequent amendments, or, in any case, to assert or defend a right in court, provided that the data are transferred exclusively for these purposes and for the period strictly necessary for their pursuit;
e) it is necessary to safeguard the life or physical integrity of the interested party or of a third party, in the event that the interested party cannot give his consent due to physical impossibility, inability to act or inability to understand or want;
f) is carried out in acceptance of a request for access to administrative documents, or a request for information that can be extracted from a public register, list, deed or document that can be known by anyone, in compliance with the rules governing the matter;
g) is authorized by the Guarantor on the basis of adequate guarantees for the rights of the interested party, also provided with a contract.
5. An objection may be lodged against the prohibition referred to in paragraph 3 of this article pursuant to article 29, paragraphs 6 and 7.
6. The provisions of this article do not apply to the transfer of personal data carried out in the exercise of the profession of journalist and for the exclusive pursuit of the related purposes.
7. The notification referred to in paragraph 1 of this article is made pursuant to article 7 and is noted in the appropriate section of the register provided for in article 31, paragraph 1, letter a). The notification can be made with a single act together with that provided for in article 7.

Chapter VI
ADMINISTRATIVE AND JURISDICTIONAL PROTECTION
Article 29
Protection
1. The rights referred to in article 13, paragraph 1, can be asserted before the judicial authority or with recourse to the Guarantor. The appeal to the Guarantor cannot be proposed if, for the same object and between the same parties, the judicial authority has already been appealed.
2. Except for cases in which the expiry of the term would expose someone to imminent and irreparable damage, recourse to the Guarantor can only be proposed after five days have elapsed from the request made on the same subject to the person responsible. The presentation of the appeal makes a further request before the judicial authority between the same parties and for the same object unfeasible.
3. In the proceeding before the Guarantor, the holder, the manager and the interested party have the right to be heard, personally or by means of a special prosecutor, and have the right to present briefs or documents. The Guarantor may order, even ex officio, the completion of appraisals.
4. Having obtained the necessary information, the Guarantor, if he deems the appeal founded, orders the owner and the manager, with a reasoned decision, to cease the unlawful conduct, indicating the necessary measures to protect the rights of the interested party and assigning a deadline for their adoption. The provision is communicated without delay to the interested parties, by the Guarantor's office. Failure to pronounce on the appeal, after twenty days from the date of presentation, is equivalent to rejection.
5. If the particularity of the case requires it, the Guarantor may temporarily order the blocking of all or part of some of the data or the immediate suspension of one or more processing operations. The provision ceases to have any effect if, within the following twenty days, the decision referred to in paragraph 4 is not adopted and it can be challenged together with this decision.
6. Against the express provision or the tacit rejection referred to in paragraph 4, the holder or the interested party may lodge an opposition with the court of the place where the holder resides, within the term of thirty days from the date of communication of the provision or from the date of the tacit rejection. The opposition does not suspend the execution of the provision.
7. The court provides in the ways set out in articles 737 and following of the code of civil procedure, also in derogation of the prohibition set out in article 4 of the law of 20 March 1865, n. 2248, attachment e), and may suspend, upon request, the execution of the measure. Against the decree of the court, only the appeal in cassation is allowed.
8. All disputes, including those relating to the issue of the authorization referred to in article 22, paragraph 1, or which, in any case, concern the application of this law, are the responsibility of the ordinary judicial authority.
9. Non-pecuniary damage is also recoverable in cases of violation of article 9.

Chapter VII
GUARANTOR FOR DATA PROTECTION
Article 30
Establishment of the Guarantor
1. The Guarantor for the protection of personal data is established.
2. The Guarantor operates in full autonomy and with independence of judgment and evaluation.
3. The Guarantor is a collegiate body made up of four members, two elected by the Chamber of Deputies and two by the Senate of the Republic with limited voting. They elect a president from within them, whose vote prevails in the event of a tie. The members are chosen among people who ensure independence and who are experts of recognized competence in the fields of law or information technology, guaranteeing the presence of both qualifications.
4. The president and the members remain in office for four years and cannot be confirmed more than once; for the entire duration of their office, the president and the members cannot exercise, under penalty of forfeiture, any professional or consultancy activity, nor be directors or employees of public or private bodies, nor hold elective offices.
5. Upon acceptance of the appointment, the president and the members are placed out of office if they are employees of public administrations or magistrates in active service; if tenured university professors, they are placed on unpaid leave pursuant to article 13 of the decree of the President of the Republic of 11 July 1980, n. 382, and subsequent modifications. Personnel placed out of office or on leave cannot be replaced.
6. The president is entitled to an indemnity not exceeding, at most, the remuneration due to the first president of the Court of Cassation. Members are entitled to a functional allowance not exceeding, at most, two thirds of that due to the president. The aforementioned function allowances are determined, with the regulation referred to in article 33, paragraph 3, in such an amount as to be paid out of ordinary allocations.
Article 31
Duties of the guarantor
1. The Guarantor has the task of:

a) set up and keep a general register of treatments on the basis of the notifications received;
b) check whether the treatments are carried out in compliance with the law and regulations and in compliance with the notification;
c) notify the relative owners or managers of the appropriate modifications in order to make the treatment compliant with the provisions in force;
d) receive the reports and complaints of the interested parties or of the associations that represent them, relating to non-compliance with the law or regulation, and act on the appeals presented pursuant to article 29;
e) adopt the provisions established by law or by regulations;
f) monitor cases of termination, for any reason, of a treatment;
g) report the facts that can be configured as crimes that can be prosecuted ex officio, of which he becomes aware in the exercise or because of his duties;
h) promote within the categories concerned, in compliance with the principle of representativeness, the signing of codes of ethics and good conduct for certain sectors, verify their compliance with the laws and regulations also by examining the observations of interested parties and help ensure their dissemination and compliance;
i) ensure public awareness of the rules governing the matter and the related purposes, as well as the data security measures referred to in Article 15;
l) prohibit, in whole or in part, the processing of data or block it when, in consideration of the nature of the data or, in any case, of the methods of processing or the effects that it can determine, there is the concrete risk of the occurrence of a significant prejudice for one or more interested parties;
m) notify the Government of the opportunity for regulatory measures required by the evolution of the sector;
n) prepare an annual report on the activity carried out and on the state of implementation of this law, which is sent to Parliament and the Government by 30 April of the year following the one to which it refers;
o) take care of the assistance activity indicated in chapter IV of the Convention n. 108 on the protection of people with respect to the automated processing of personal data, adopted in Strasbourg on 28 January 1981 and enforced by law 21 February 1989, n. 98, as designated authority for the purposes of cooperation between States pursuant to article 13 of the same Convention;
p) exercise control over the treatments referred to in article 4 and verify, also at the request of the interested party, whether they meet the requirements established by law or regulations.
2. The President of the Council of Ministers and each minister shall consult the Guarantor when preparing the regulatory provisions and administrative acts likely to affect the matters governed by this law.
3. The register referred to in paragraph 1, letter a), of this article, is kept in the manner referred to in article 33, paragraph 5. Within the term of one year from the date of its establishment, the Guarantor promotes appropriate agreements with the provinces and possibly with other public administrations in order to ensure consultation of the register through at least one terminal located on a provincial basis, preferably within the office for relations with the public referred to in article 12 of legislative decree no. of 3 February 1993 . 29, and subsequent modifications.
4. Against the prohibition referred to in paragraph 1, letter l), of this article, an objection may be lodged pursuant to article 29, paragraphs 6 and 7.
5. The Guarantor and the Authority for information technology in the public administration cooperate with each other in carrying out their respective duties; to this end, they invite the chairman or a delegate member of the other body to attend the meetings by taking part in the discussion of topics of common interest included in the agenda; they may also request the collaboration of specialized personnel assigned to the other body.
6. The provisions of paragraph 5 also apply in relations between the Guarantor and the competent supervisory authorities for the credit sector, for insurance activities and for radio broadcasting and publishing.
Article 32
Checks and checks
1. In order to carry out its duties, the Guarantor may request the person in charge, the owner, the interested party or even third parties to provide information and produce documents.
2. The Guarantor, if necessary for the purpose of checking compliance with the provisions on the processing of personal data, may arrange access to databases or other inspections and checks in the places where the processing takes place or in which it is necessary to carry out surveys in any case useful for the same control, making use, where necessary, of the collaboration of other State bodies.
3. The investigations referred to in paragraph 2 are ordered with the prior authorization of the president of the court competent for the territory in relation to the place of the investigation, who provides without delay on the request of the Guarantor, with a reasoned decree; the related methods of performance are identified with the regulation referred to in article 33, paragraph 3.
4. The subjects interested in the checks are required to have them carried out.
5. The provisions of article 220 of the implementation, coordination and transitional provisions of the criminal procedure code, approved with legislative decree no. 271.
6. For the treatments referred to in articles 4 and 14, paragraph 1, the checks are carried out through a member designated by the Guarantor. If the treatment does not comply with the provisions of the law or regulation, the Guarantor indicates to the owner or manager the necessary modifications and additions and verifies their implementation. If the assessment has been requested by the interested party, the latter is in any case provided with feedback on the relative outcome, unless the reasons referred to in article 10, paragraph 4, of the law of 1 April 1981, n. 121, as replaced by article 42, paragraph 1, of this law, or for reasons of defense or state security.
7. The investigations referred to in paragraph 6 cannot be delegated. If it proves necessary due to the specific nature of the verification, the designated member may be assisted by specialized personnel who are bound to secrecy pursuant to article 33, paragraph 6. The deeds and documents acquired are kept in a manner that ensures their secrecy and can be known by the president and members of the Guarantor and, if necessary for the performance of the body's functions, by a limited number of employees in the relevant office, identified by the Guarantor on the basis of criteria defined by the regulation referred to in article 33, paragraph 3. For the checks relating to the bodies and data referred to in article 4, paragraph 1, letter b), the designated member examines the relevant deeds and documents and reports orally in the meetings of the Guarantor.
Article 33
Guarantor's office
1. An office made up of employees of the State and of other public administrations, employed by the Guarantor, placed outside the role in the forms provided for by the respective regulations, whose service in the same office is equivalent to all effects of the law to that provided in the respective administrations of origin. The relative quota is determined, in an amount not exceeding forty-five units, on the proposal of the Guarantor himself, with a decree of the President of the Council of Ministers, in agreement with the Ministers of the Treasury and for the public function, within ninety days from the date of election of the Guarantor.
The general secretary can also be chosen from among ordinary or administrative magistrates.
2. The operating expenses of the Guarantor's office are charged to a fund set aside for this purpose in the State budget and entered in a specific chapter of the estimates of the Ministry of the Treasury. The statement of financial management is subject to the control of the Court of Auditors.
3. The rules concerning the organization and functioning of the office of the Guarantor, as well as those aimed at regulating the collection of secretarial fees and the management of expenses, also in derogation from the provisions on the general accounting of the State, are adopted with a regulation issued by decree of the President of the Republic, within three months from the date of entry into force of this law, following a resolution of the Council of Ministers, having consulted the Council of State, on the proposal of the President of the Council of Ministers, in agreement with the Ministers of the Treasury, of Justice and of the Interior, and with the assent of the Guarantor himself. The same regulation also provides for the rules concerning the procedure before the Guarantor referred to in article 29, paragraphs 1 to 5, according to methods such as to ensure, in the speed of the procedure itself, full compliance with the adversarial process between the parties involved, as well as the rules aimed at specifying the methods for exercising the rights referred to in article 13, as well as the notification referred to in article 7, by electronic means or by magnetic medium or registered letter with acknowledgment of receipt or other suitable system. The opinion of the Council of State on the draft regulation is given within thirty days of receipt of the request; after this term, the regulation can in any case be issued.
4. In cases where the technical nature or the delicacy of the problems require it, the Guarantor may make use of the work of consultants, who are remunerated on the basis of current professional rates.
5. To carry out its duties, the Guarantor's office may make use of automated computer processing systems and its own telematic tools or, safeguarding the guarantees provided for by this law, belonging to the Authority for IT in the public administration or, in case of unavailability, to affiliated public bodies.
6. The personnel in charge of the office of the Guarantor and the consultants are bound to secrecy on everything they become aware of, in the exercise of their functions, in relation to databases and processing operations.

Chapter VIII
SANCTIONS
Article 34
Omitted or unfaithful notification
1. Whoever fails to provide the notifications prescribed by articles 7 and 28, or indicates in them incomplete or untruthful information, is punished with imprisonment from three months to two years. If the fact concerns the notification envisaged by article 16, paragraph 1, the penalty is imprisonment up to one year.
Article 35
Unlawful processing of personal data
1. Unless the fact constitutes a more serious offence, whoever, in order to obtain profit for himself or for others or to cause damage to others, proceeds to the processing of personal data in violation of the provisions of articles 11, 20 and 27, is punished with imprisonment of up to two years or, if the fact consists in communication or diffusion, with imprisonment from three months to two years.
2. Unless the fact constitutes a more serious crime, whoever communicates or disseminates personal data in violation of the provisions of articles 21, 22, 23 and 24, or of the prohibition referred to in article 28, paragraph 3, in order to obtain profit for himself or for others or to cause damage to others, is punished with imprisonment from three months to two years.
3. If damage arises from the facts referred to in paragraphs 1 and 2, imprisonment is from one to three years.
Article 36
Failure to adopt measures necessary for data security
1. Whoever fails to adopt the necessary measures to guarantee the security of personal data, in violation of the provisions of the regulations referred to in paragraphs 2 and 3 of article 15, is punished with imprisonment up to one year. If harm arises from the act, the penalty is imprisonment from two months to two years.
2. If the act referred to in paragraph 1 is committed through negligence, imprisonment of up to one year is applied.
Article 37
Failure to comply with the provisions of the guarantor
1. Whoever fails to comply with the provision adopted by the Garante pursuant to article 22, paragraph 2, or article 29, paragraphs 4 and 5, is punished with imprisonment from three months to two years.
Article 38
accessory penalty
1. The conviction for one of the crimes envisaged by this law entails the publication of the sentence.
Article 39
Administrative penalties
1. Anyone who fails to provide the information or produce the documents required by the Guarantor pursuant to articles 29, paragraph 4, and 32, paragraph 1, is punished with the administrative sanction of payment of a sum ranging from one million to six million lire.
2. The violation of the provisions referred to in articles 10 and 23, paragraph 2, is punished with the administrative sanction of payment of a sum ranging from five hundred thousand to three million lire.
3. The body competent to receive the report and to impose the sanctions referred to in this article is the Guarantor. The provisions of the law of 24 November 1981, n. 689, and subsequent amendments.

Chapter IX
TRANSITIONAL AND FINAL PROVISIONS AND REPEALS
Article 40
Communications to the guarantor
1. Copy of the provisions issued by the judicial authority in relation to the provisions of this law and of the law of 23 December 1993, n. 547, is sent, by the Registry, to the Guarantor.
Article 41
Transitional provisions
1. Without prejudice to the exercise of the rights referred to in articles 13 and 29, the provisions of this law which require the consent of the interested party do not apply with reference to personal data collected prior to the date of entry into force of the law itself, or whose processing began before that date. The application of the provisions relating to the communication and dissemination of data provided for by this law remains unaffected.
2. For the processing of personal data started before 1 January 1998, the notifications prescribed by articles 7 and 28 are made from 1 January 1998 to 31 March 1998 or, for the treatments referred to in article 5 concerning data other than those referred to in articles 22 and 24, as well as for those referred to in article 4, paragraph 1, letters c), d) and e), from 1 April 1998 to 30 June 1998.
3. The minimum security measures referred to in article 15, paragraph 2, must be adopted within the term of six months from the date of entry into force of the regulation envisaged therein. Until the expiry of this term, personal data must be kept in such a way as to avoid an increase in the risks referred to in article 15, paragraph 1.
4. The measures referred to in article 15, paragraph 3, must be adopted within the term of six months from the date of entry into force of the regulations envisaged therein.
5. In the eighteen months following the date of entry into force of this law, the processing of data referred to in article 22, paragraph 3, by public entities, excluding public economic entities, and in article 24, may be continued even in the absence of the provisions of the law indicated therein, subject to notification to the Guarantor.
6. During the first application of this law, until the election of the Guarantor pursuant to article 30, the functions of the Guarantor are performed by the president of the Authority for information technology in public administration, with the exception of the examination of the appeals referred to in article 29.
7. The provisions of this law which provide for an authorization from the Guarantor are applied, limited to the same authorization and with the exception of the provision referred to in article 28, paragraph 4, letter g), starting from 30 November 1997. The same provisions can be applied by the Guarantor also through the issue of authorizations relating to certain categories of data controllers or treatments.
7-bis. In the first application of this law, the information and communications referred to in articles 10, paragraph 3, and 27, paragraph 2, can be given by 30 November 1997.
Article 42
Changes to current provisions
1. Article 10 of the law of 1 April 1981, n. 121, is replaced by the following:

“Art. 10 – Controls 1. Control over the Data Processing Center is exercised by the Guarantor for the protection of personal data, in the manner prescribed by law and regulations.
2. The data and information stored in the archives of the Center may be used in judicial or administrative proceedings only through the acquisition of the original sources indicated in the first paragraph of article 7, without prejudice to the provisions of article 240 of the criminal procedure code. When the erroneous or incompleteness of the data and information, or the illegitimacy of their treatment, is detected during a judicial or administrative proceeding, the proceeding authority informs the Guarantor for the protection of persons and other subjects with regard to the processing of personal data.
3. The person to whom the data refer may ask the office referred to in letter a) of the first paragraph of article 5 for confirmation of the existence of personal data concerning him, their communication in an intelligible form and, if the data are processed in violation of current provisions of law or regulation, their cancellation or transformation into anonymous form.
4. Once the necessary checks have been carried out, the office communicates to the applicant, no later than twenty days from the request, the decisions adopted. The office may omit to act on the request if this could jeopardize actions or operations for the protection of public order and safety or the prevention and repression of crime, informing the Guarantor for the protection of personal data.
5. Anyone who becomes aware of the existence of personal data concerning him, processed even in a non-automated form in violation of the provisions of the law or regulation, can ask the court of the place where the data controller resides to carry out the necessary investigations and to order the rectification, integration, cancellation or transformation into anonymous form of the data. The court provides in the ways set out in articles 737 and following of the code of civil procedure".
2. Paragraph 1 of article 4 of legislative decree 12 February 1993, n. 39, is replaced by the following:

“1. The Authority for information technology in the public administration has been established, called the "Authority" for the purposes of this decree; this Authority operates in full autonomy and with independence of judgment and assessment”.
3. Paragraph 1 of article 5 of legislative decree 12 February 1993, n. 39, is replaced by the following:

“1. The rules concerning the organization and functioning of the Authority, the establishment of the role of personnel, the relative legal and economic treatment and the organization of careers, as well as the management of expenses within the limits established by this decree, also in derogation from the provisions on the general accounting of the State, are adopted with a regulation issued with a decree of the President of the Republic, following a resolution of the Council of Ministers, having consulted the Council of State, on the proposal of the President of the Council of Ministers, in agreement with the Minister of the Treasury and with the assent of the Authority itself. The opinion of the Council of State on the draft regulation is given within thirty days of receipt of the request, after which the regulation can in any case be issued. The economic treatment foreseen for the personnel of the Guarantor for publishing and broadcasting or of the body that should take over the relative functions is applied, without prejudice to the overall maximum limit of one hundred and fifty units. The allocations of the chapters referred to in paragraph 2 also remain unchanged, as determined for 1995 and taking into account the increase limits established for category IV for the three-year period 1996-1998".
4. In articles 9, paragraph 2, and 10, paragraph 2, of the law of 30 September 1993, n. 388, the words: "Data Protection Guarantor" are replaced by the following: "Guarantor for the protection of persons and other subjects regarding the processing of personal data".
Article 43
repeals
1. The provisions of law or regulation incompatible with this law and, in particular, the fourth paragraph of article 8 and the fourth paragraph of article 9 of the law of 1 April 1981, n. 121. Within six months from the date of issue of the decree referred to in article 33, paragraph 1, of this law, the Minister of the Interior transfers to the Guarantor's office the information material collected on that date in implementation of the aforementioned article 8 of law n. 121 of 1981.
2. The provisions of the law of 20 May 1970, n. 300, and subsequent amendments, as well as, as compatible, the provisions of the law of 5 June 1990, n. 135, and subsequent amendments, of the legislative decree 6 September 1989, n. 322, as well as the current rules on access to administrative documents and state archives. The provisions of the law which establish more restrictive prohibitions or limits on the processing of certain personal data also remain unchanged.
3. For the treatments referred to in article 4, paragraph 1, letter e), of the present law, the obligation to provide data and information referred to in article 6, first paragraph, letter a) of the law of 1 April 1981, n. 121.

Head X
FINANCIAL COVERAGE AND ENTRY INTO FORCE
Article 44
financial coverage
1. The cost deriving from the implementation of this law, valued at 8,029 million lire for 1997 and at 12,045 million lire starting from 1998, is provided for by means of a corresponding reduction in the allocation entered, for the purposes of the three-year budget 1997-1999, in chapter 6856 of the estimates of the Ministry of the Treasury for the year 1997, for this purpose using, for 1997, as for 4,553 million lire, the provision relating to the Ministry of Foreign Affairs and, as regards 3,476 million lire, the provision relating to the Presidency of the Council of Ministers and, for the years 1998 and 1999, as regards 6,830 million lire, the projections for the same years of the provision relating to the Ministry of Foreign Affairs and, as regards 5,215 million lire, the projections for the same years of the acca provision concerning the Presidency of the Council of Ministers.
2. The Minister of the Treasury is authorized to make the necessary budget changes with his own decrees./p>
Article 45
Entry into force
1. This law enters into force one hundred and twenty days after its publication in the Official Gazette. For treatments carried out without the aid of electronic or automated means which do not concern any of the data referred to in articles 22 and 24, the provisions of this law will apply starting from 1 January 1998. Without prejudice to the provisions of article 9, paragraph 2, of law 30 September 1993, n. 388, this law enters into force on the day following that of its publication in the Official Gazette, limited to the processing of data carried out in execution of the agreement referred to in article 4, paragraph 1, letter a) and the appointment of the Guarantor.