Law note · Italy
Garante Provvedimento n. 146/2019, Genetic, Health, and Biometric Data Prescriptions
The Garante's Provvedimento n. 146/2019 imposes specific security measures for genetic data (documented physical-access controls, encrypted or pseudonymized storage, controlled transmission), consent requirements for genetic testing and for processing genetic data to protect a third party's health, and a research-retention rule limiting secondary use of health data to cases where equivalent research cannot be done on data from consenting subjects.
The Garante's leading biometric enforcement action is Provvedimento n. 50 del 10 febbraio 2022 against Clearview AI: a EUR 20 million fine, an EU-wide processing ban on Italy-related facial-recognition data, and an order to delete data and designate an EU representative, for scraping and processing facial images with no valid legal basis.
No dedicated Garante decision or guidance on voiceprints specifically, or on employer fingerprint or facial-recognition timekeeping, was located in this pass; these are genuine gaps, not confirmed absences, since the Garante's own thematic search pages could not be queried through this session's tooling.
What it asks of an app
- Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.
- Do not scrape or process publicly posted facial images to build a biometric identification database without a valid General Data Protection Regulation (GDPR) Article 9 basis; the Garante fined Clearview AI EUR 20 million for exactly that and banned further collection.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Garante Provvedimento n. 146/2019 (direct read)
Garante Provvedimento n. 50/2022 and its 9 March 2022 press release (direct read)