Implementation of a high-speed reporting channel for revenge porn victims

This article has been published in IRIS Legal Observations of the European Audiovisual Observatory and in IRIS 2022-4:1/22

Legislative Decree No. 196/2003 (“Italian Data Protection Code”) has been recently amended. Specifically, Law Decree No. 139/2021 (as enacted and amended by Law No. 205/2021) introduced Section 144-bis, which provides a high-speed reporting system for revenge porn victims.

Under Section 144-bis, part 1 of the Italian Data Protection Code, anyone, including minors over 14 years old, who has a well-founded reason to believe that audio recordings, images, videos or other IT documents with sexually explicit content concerning them, and intended to remain private, might be sent, delivered, transferred, published or disseminated through digital platforms without their consent is entitled to report such an instance to the Italian Data Protection Authority (Garante per la protezione dei dati personali). Of note, no later than 48 hours after receipt of the report, the Garante might exercise the powers set forth by Section 58 of the EU Regulation No. 679/2016 (GDPR), including corrective powers.

The Garante has amended the Regulation No. 1/2019 governing its internal functioning. According to these new provisions, once the Garante adopts measures to prevent any dissemination of the reported revenge porn content, such measures are notified to the digital platform providers, together with the reported content or the related hash print.

Once notified of the measures adopted by the Garante, digital platforms must retain the reported content for 12 months, for evidentiary purposes only and according to the specifications provided by the Garante, to prevent the data subjects from being directly identifiable.

Finally, providers of audiovisual content-sharing services available in Italy, wherever they are established, must (i) publish on their website the contact details to which the measures adopted by the Garante may be notified; or (ii) provide the Garante with this information without any delay. Should this obligation not be complied with, the Garante shall warn service providers to provide their contact information within 30 days. Failure to comply with the Garante warning is subject to administrative fines of up to EUR 10 million or, in case of undertakings, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.