EveryAILaw.comDoes Law on Artificial Intelligence require Data Governance?
Italy • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Data Governance across 1 provision:
- Eligible actors and purposes — Art. 8(1) declares processing by its listed public, nonprofit, IRCCS, and participating private health-sector actors to be of significant public interest when conducted for the provision's listed health and related AI-research purposes
- Secondary use permitted — For the same purposes and actors, secondary use of personal data lacking direct identifiers is authorized without further consent where consent was initially required by law, subject to the information duty and the exception where identity is unavoidable or necessary to protect health (Art. 8(2))
- Garante communication and standstill — Processing under Art. 8(1) and (2) must be communicated to the Garante with the information listed in Art. 8(5), and may begin after 30 days if it has not been blocked
- Data-subject information — The information duty remains applicable; Art. 8(2) permits a general notice on the controller's website, while Art. 8(3) requires notice under GDPR Article 13 for processing to anonymize, pseudonymize, or synthesize data
- GDPR qualification — Article 8 expressly operates within GDPR Article 9 and the Italian data-protection code; the applicable basis and safeguards depend on the actor and processing described in the provision
Health Data for AI Research
Article 8 establishes a health-research pathway for specified public, nonprofit, IRCCS, and participating private health-sector actors. For those actors and purposes, secondary use under paragraph 2 is limited to personal data lacking direct identifiers, preserves the information duty, and carries an exception where identity is unavoidable or necessary to protect health. Processing under paragraphs 1 and 2 must be communicated to the Garante and may begin after 30 days if the Garante has not blocked it.
Penalties qualification: Article 8(6) preserves the Garante's inspection, prohibition, and sanctioning powers. This entry does not assign a fixed penalty ceiling or infringement category to Article 8 conduct.
Institutional context (not a private requirement): Article 8(4) permits AGENAS, after consulting the Garante and considering international standards and the state of the art, to establish and update guidelines for anonymization procedures and synthetic data. The provision grants an institutional power; it does not itself impose a universal anonymization standard on every researcher.
Requirements
| Requirement | Details |
|---|---|
| Eligible actors and purposes | Art. 8(1) declares processing by its listed public, nonprofit, IRCCS, and participating private health-sector actors to be of significant public interest when conducted for the provision's listed health and related AI-research purposes |
| Secondary use permitted | For the same purposes and actors, secondary use of personal data lacking direct identifiers is authorized without further consent where consent was initially required by law, subject to the information duty and the exception where identity is unavoidable or necessary to protect health (Art. 8(2)) |
| Garante communication and standstill | Processing under Art. 8(1) and (2) must be communicated to the Garante with the information listed in Art. 8(5), and may begin after 30 days if it has not been blocked |
| Data-subject information | The information duty remains applicable; Art. 8(2) permits a general notice on the controller's website, while Art. 8(3) requires notice under GDPR Article 13 for processing to anonymize, pseudonymize, or synthesize data |
| GDPR qualification | Article 8 expressly operates within GDPR Article 9 and the Italian data-protection code; the applicable basis and safeguards depend on the actor and processing described in the provision |