Trento: privacy regulator gives conditional backing to public AI

According to Diritto Bancario’s article “Il Garante su addestramento e uso IA per l’attività amministrativa”, Italy’s data protection authority has issued a favourable opinion subject to conditions on the Autonomous Province of Trento’s draft regulation for developing, training and using AI systems in administrative activity. The draft provides for a supporting role under human oversight and excludes solely automated administrative decisions. It would also govern personal data processing for the institutional functions of the Province and its public instrumental bodies. The opinion and draft have not been consulted directly; the report does not confirm final adoption of the regulation.

Diritto Bancario reports that one requested amendment concerns the legal instrument specifying the processing of special categories of personal data and data relating to criminal convictions and offences. In the authority’s assessment, application sheets approved unilaterally by individual administrative units do not meet the requirements of Articles 2-sexies and 2-octies of Italy’s Privacy Code. The processing details should be specified through an instrument with at least regulatory status or, solely for special categories of personal data, through a general administrative act of the Province.

Also according to Diritto Bancario, the other concern is whether rectification and erasure rights remain effective after training. Correcting or deleting the original document might be insufficient if the data continue to influence the model’s parameters or outputs. The authority therefore requires measures to make these rights effective under Articles 16 and 17 GDPR. The report distinguishes this requirement from the recommendation to introduce a specific provision ensuring that the additional rights under Articles 15–22 also operate effectively in relation to models that have already been trained.