The Italian Data Protection Authority has mandatory time limits for exercising its sanctioning powers, according to the Court of Rome

The Court of Rome, in its ruling of January 22, 2026, overturned Decision No. 621 of October 23, 2025, by which the Italian Data Protection Authority (the “Authority”) had sanctioned Rai (Italy’s public service broadcaster) in connection with the broadcast, during an episode of Report (an Italian investigative television programme), of audio clips from a private conversation between the then Minister of Culture and his wife. The ruling stands out for its careful analysis of the balance between data protection and freedom of the press; in particular, it focuses on the nature of investigative journalism, concluding that, in this specific case, the public interest in information prevailed.

The case originated from the airing, on December 8, 2024, of a report titled “Travolti da un insolito destino” (“Swept Away by an Unusual Fate”), concerning an incident that had taken on clear public and political significance. The Authority did not challenge the lawfulness of the disclosure of the facts themselves, but rather the manner in which the information was made public, finding that the broadcast of the audio clips violated the applicable privacy regulations and, in particular, the requirement that personal data disclosed for journalistic purposes must be essential to the information being conveyed. The Authority therefore ordered a ban on any further processing of the personal data contained in those audio excerpts and imposed an administrative fine of EUR 150.000, one of the highest ever inflicted on editors for processing of personal data for journalistic purposes.

Rai challenged the decision on several grounds, arguing, among other things, the late conclusion of the proceedings, the incorrect application of the principle of the essential nature of the information, the disproportionate nature of the fine, and the illegality of the ban on preserving the report in the historical archive of the broadcaster.

In deciding the case, the Court expressly referred to the case law of the Court of Cassation, which described the investigative journalism as the “highest and noblest expression of journalistic activity”, as it is characterized by the journalist’s independent, direct, and active acquisition of news. On this basis, the Court observed that, precisely in light of the nature of investigative journalism, the balance between freedom of information and individual rights must be struck by taking due account of the essential role that such journalism plays in shaping public opinion and, more generally, in ensuring the proper functioning of a democratic system.

Based on this framework, the judgment ruled out any violation, in the present case, of the principle of the essential nature of the information. The Court held that, although the events in question undoubtedly concerned aspects pertaining to the personal sphere of the individuals involved, they went beyond the mere private dimension, as they raised the question of whether institutional decisions might have been influenced by personal dynamics. From this perspective, the content of the disclosed conversation was directly relevant to the news story and crucial for enabling the public to understand the substantive core of the facts under investigation.

Particularly significant is the passage in which the Court stated that the full and original disclosure of the conversation was justified by the need to convey “the historical fact in its immediacy”, thereby avoiding any risk of creating in the viewer the impression of a partial, manipulated, or otherwise inaccurate reconstruction of the events. From this perspective, the broadcast of the audio material was not considered an excessive or sensationalist way of presenting the news, but rather a necessary means of ensuring its perceptible authenticity and, consequently, its full comprehensibility to the public. The ruling thus aligns with the case law holding that the right to report news, while never exempt from respecting the limits imposed to protect dignity, honor, and privacy, may legitimately prevail where the requirements of truthfulness, relevance, and moderation are met, and where the information – even in its most detailed form – proves indispensable in light of the public interest in the disclosure of the facts.

Although the Court considered the substantive merits of the case to be decisive, it also briefly addressed what is arguably the most significant procedural aspect of the ruling, namely the time limits governing the Italian Data Protection Authority’s sanctioning powers. In particular, the Court stated that the time limits for the conclusion of sanctioning proceedings must be regarded as mandatory, since the punitive nature of such powers requires strict compliance with defined procedural deadlines in order to ensure legal certainty and the effective exercise of rights of defence. In the judgment at issue, the Court referred specifically to the time limits laid down by Article 143 of the Italian Privacy Code and by the Authority’s Regulation No. 2/2019, noting that, for complaints, decisions must in principle be adopted within 9 months from receipt of the complaint, extendable to 12 months only where justified by specific investigative needs previously communicated to the interested party, which, according to the Court, had not occurred in the case at hand.

This reasoning is consistent with the approach recently endorsed by the Court of Cassation in judgment No. 984 of 17 January 2026, which affirmed the mandatory nature of the separate 120-day time limit applicable to the sanctioning phase. As clarified by the Court, that 120-day period does not begin with the initiation of the assessment procedure, but with the completion of the preliminary investigation phase, that is, with the act whereby the Authority notifies its preliminary findings on the alleged infringement of data protection law to the controller or processor. Read together, the two rulings confirm a broader point of clear practical relevance: the Authority’s sanctioning powers are not temporally open-ended, and failure to comply with the applicable procedural time limits may provide regulated entities with a concrete ground on which to challenge and seek the annulment of sanctioning decisions.

Considering the foregone, the Court upheld the appeal, set aside the Authority’s decision, and, consequently, annulled the sanctions imposed therein.