Constitutional Court: Regions cannot autonomously regulate the processing of personal data.

A regional regulation governing the processing of personal data in the installation of video-surveillance systems is unconstitutional on the grounds that it infringes the obligations arising from Italy's membership of the European Union and encroaches on the State's exclusive legislative powers in the field of 'civil order'. This is what is stated in sentence no. 69/2024 by which the Constitutional Court declared article 3 of Apulia Region law no. 13 of 2023 to be constitutionally illegitimate due to its conflict with article 117, first and second paragraphs of the Constitution.

The Court noted that the European Union, in the exercise of the competence set out in Article 16 of the Treaty on the Functioning of the European Union, lays down complex rules on the processing of personal data, which 'are completed and supplemented by national sources'. According to the Court, the Region cannot regulate the matter autonomously, nor can it make a selection of sources and provisions, "which, within the complex set of rules contemplated both by the European Union and by the State legislature, are called upon to regulate this complex and delicate matter", because in so doing it 'not only overlaps with the European Union and State legislation, exceeding its own competences, but moreover makes an arbitrary choice, whose prescriptive content is tantamount to considering binding only the rules identified by the regional legislature and not also the others', dictated by the European Union and the State legislature.