Introduction

On 24 June 2026, the Italian government transmitted to the President of the Senate the Draft of legislative decree No. 418, concerning the use of artificial intelligence technologies for police activities and for the pursuit of criminal and civil liability. The draft, which was preliminarily approved by the Council of Ministers on 10 June 2026, was transmitted to the Senate to obtain the approval of the relevant Parliamentary Commissions. It is part of a series of governmental efforts to accelerate the Italian implementation of the Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence — commonly known as the Artificial Intelligence (AI) Act. The decree was subsequently adopted in its final form as Legislative Decree No. 160/2026 on 9 September 2026, published in the Official Gazette on 15 September 2026 and in force from 30 September 2026.  

Although it was presented as a measure requiring urgent consideration in light of public order and security objectives, the draft had drawn criticism from the opposition, the media, the Italian Data Protection Authority (the so-called “Privacy Guarantor”), and the European Commission itself. At the centre of the controversy lie the provisions on integrating video surveillance systems with artificial intelligence components and on the treatment of biometric data for facial recognition in the context of police activities and crime prevention. 

Remote biometric identification under the EU Artificial Intelligence Act

The underlying legal framework, the EU Artificial Intelligence Act, adopts a risk-based approach that establishes different regulatory regimes based on the risks associated with specific AI practices and uses. It distinguishes between prohibited practices, high-risk AI systems and more limited transparency obligations. For the purposes of the present case, the most relevant provisions of the AI Act are those concerning biometric data and surveillance. Article 5 prohibits, among other practices, the untargeted scraping of facial images to create or expand facial-recognition databases and the use of real-time remote biometric identification (RBI) in publicly accessible spaces for law-enforcement purposes, subject to narrowly defined exceptions. By contrast, certain post-remote biometric identification systems are classified as high-risk rather than prohibited.

The Regulation’s treatment of biometric data builds on the concept already established by Article 4(14) of the General Data Protection Regulation (GDPR), which refers to “data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”. Article 3(34) AI Act adopts a closely related definition, although it does not expressly include the requirement that the data “allow or confirm the unique identification” of the individual. The AI Act consequently regulates a wider range of biometric applications, including biometric identification, verification, categorisation and emotion recognition systems. 

Of particular significance is remote biometric identification (RBI): under Article 3 AI Act, an RBI system identifies a natural person without their active involvement, typically by comparing biometric data obtained from an individual with a reference database. The Regulation distinguishes between real-time RBI, where the capture, comparison and identification occur without significant delay, and post-remote RBI, where the identification takes place subsequently rather than in real time. 

Far from being a simple technicality, this distinction produces markedly different legal consequences. Article 5(1)(h) AI Act establishes a general prohibition on the use of real-time RBI in publicly accessible spaces for law enforcement purposes, with narrowly defined exceptions: certain searches for victims or missing persons, the prevention of specified serious threats, and the identification of persons suspected of certain serious offences. Even in those cases, the use must be necessary, proportionate, limited to the specifically targeted individual, and subject to additional safeguards. The AI Act therefore treats real-time facial identification in public spaces as an exceptionally intrusive practice rather than as an ordinary investigative tool.

Post-remote RBI, on the other hand, is classified in the AI Act as a high-risk AI system under Annex III, point 1(a), insofar as its use is permitted by EU or national law. Article 26(10) AI Act nevertheless imposes specific restrictions on its deployment: law enforcement authorities may not use post-remote RBI in an untargeted manner without a link to a criminal offence or proceeding, a genuine, present, or foreseeable threat of a criminal offence, or the search for a specific missing person. Its use must be documented, made available to the relevant authorities upon request, and reported annually. As with real-time RBI, no adverse legal decision may be based solely on its outputs. The AI Act also separately prohibits AI systems that create or expand facial recognition datasets through the untargeted scraping of the internet or CCTV footage, which could otherwise facilitate indiscriminate identification.

Critics of the Regulation, such as Sandra Wachter on the Yale Journal of Law & Technology, have argued that the final list of prohibited practices does not go far enough in addressing biometric surveillance, challenging the assumption that the distinction between prohibited real-time identification and regulated post-remote identification provides sufficient protection to privacy, freedom of expression, protest and assembly.

The Privacy Guarantor’s opinion and the Legislative Decree No. 160/2026

Against this background, Government Legislative Decree Draft No. 418 – now Legislative Decree 160/2026 – established the Italian rules governing the use of artificial intelligence by the police and adapted domestic legislation to the AI Act in the field of law enforcement. The draft legislative decree distinguishes between real-time RBI, addressed primarily by Article 8, and post-remote facial recognition integrated into existing video-surveillance systems, addressed in Article 10.

Article 8 follows the architecture of Article 5 of the AI Act: it permits real-time RBI for specified preventive purposes, including the prevention of serious threats and the search for missing persons or victims of certain crimes, and limits its use to confirming the identity of specifically targeted persons or conducting targeted searches. It also requires an appropriate reference database and expressly excluded databases created through untargeted scraping or in violation of data protection law. In its final form, this preventive track was joined by a separate investigative track, inserted into the Code of Criminal Procedure as Article 359-ter, subject to judicial authorisation by the investigating judge rather than the prosecutor. 

Article 10, on the other hand, concerns the subsequent use of facial recognition on video-surveillance material for the investigation of crimes. In its original form, this provision allowed facial-recognition technology to be activated after the footage was recorded and limited its stated purpose to identifying persons already suspected on the basis of photographic or video material and objective, verifiable elements. Crucially, however, Article 10(3) also provided for the local storage of the biometric data of persons entering certain places or events, together with corresponding identifying information, so that those data could subsequently be compared if a crime occurred. Under the proposed framework, the state police could effectively collect the biometric representations of everyone entering a stadium, concert, demonstration, station or other designated location before any particular crime had occurred or any particular suspect had been identified.

It is this latter mechanism that attracted the most significant objection from the Italian Data Protection Authority. In its opinion of 14 July 2026, the Privacy Guarantor considered the draft decree overall coherent with the AI Act but requested a series of amendments to strengthen safeguards against the processing of personal data. The principal objection concerns Article 10(3): according to the Guarantor, the automatic processing of the biometric data of all persons entering designated places or events is not consistent with Article 26(10) of the AI Act, which permits post-remote facial recognition only for the targeted ex-post searches of persons suspected or convicted of an offence. The Guarantor therefore requested that biometric processing should not occur automatically and indiscriminately when CCTV footage is recorded; instead, biometric analysis should take place only subsequently, on the recorded material, when a specific operational need arises. Additionally, the broad reference to places and events presenting public order or security requirements could legitimise the mass and preventive collection of biometric data.

The subsequent Legislative Decree incorporated most of the Guarantor’s recommendations on this aspect: images captured at places and events with particular public order requirements are now stored locally without biometric processing, and biometric matching is triggered only after a crime has been committed. 

The Guarantor also requested safeguards against the gradual expansion of reference databases used for real-time RBI, including minimum data-quality requirements, security and deletion rules, and guarantees of “non incrementality”: a database created for one operation should not progressively be broadened through successive authorisations. It further called for clearer rules regarding the deletion of unlawfully acquired data, a separate data protection impact assessment and an express prohibition on the use of databases obtained through untargeted scraping or in violation of data protection law. The final decree took up most of these requests by introducing an explicit non-incrementality requirement for reference databases, a dual impact assessment – a fundamental rights impact assessment under Article 27 AI Act alongside a data protection impact assessment under the domestic law implementing the Law Enforcement Directive – and a prohibition on databases built through untargeted scraping.

Beyond privacy: biometric surveillance and democratic participation

The Privacy Guarantor’s opinion raises a question that extends beyond the protection of personal data — facial recognition can transform participation in public events into an identifiable and traceable activity. A person attending a demonstration may reasonably expect to be visible to other participants and to law enforcement officers; this is, however, substantially different from having their face automatically converted into biometric data, matched against a database and retained for possible future identification.

This concern is particularly relevant to freedom of assembly and expression. In Glukhin v. Russia (2023), the European Court of Human Rights (ECtHR) considered the case of a man who had staged a solo protest in the Moscow underground, and found violations of Article 8 and 10 of the European Convention on Human Rights (ECHR). The State investigators had unjustifiably processed personal biometric data by using highly intrusive facial recognition technology to identify, locate, and arrest the individual. Significantly, the matter of surveillance and the identification of the protester was assessed not merely as a data protection issue but rather in light of the democratic importance of freedom of expression. The ECtHR has subsequently continued to cite Glukhin as an example of the need for safeguards against disproportionate facial recognition systems.

Human rights organisations have also documented the growing use of facial recognition in the policing of demonstrations. Amnesty International reported in 2024 that law enforcement facial recognition was already being used in 11 countries examined in its research and warned that identification of demonstrators could amount to indiscriminate mass surveillance capable of deterring people from exercising their right to protest. In Hungary, legislation adopted in 2025 enabled the use of facial recognition to identify participants in prohibited assemblies, including Budapest Pride. A coalition including European Digital Rights (EDRi), the Hungarian Civil Liberties Union and the European Centre for Non-profit Law (ECNL) argued that the measure violated the AI Act and created a chilling effect for freedom of assembly and expression. A more recent report by the European Agency for Fundamental Rights (FRA) has further emphasised the need for a clear, specific and comprehensive legal basis for the use of RBI for law enforcement purposes, as broad or insufficiently defined purposes and categories undermine transparency and make oversight more difficult. A study published in October 2026 by the OSCE Office for Democratic Institutions and Human Rights also accounted for how surveillance introduced or justified for one purpose can be repurposed to identify, prosecute or deter peaceful protesters for conduct of comparatively minor gravity.

Similarly, during the July 2026 parliamentary hearing on the draft legislative decree itself, concerns were raised that remote biometric identification would affect not only data protection but also freedom of assembly, association and expression. These risks are particularly acute when demonstrations themselves are designated as locations in which biometric information could be collected. Recent coverage has likewise connected the controversy over AI-powered facial recognition to the use of surveillance footage by the Turin Prosecutor’s Office to identify protesters following the July 2026 ‘No TAV’ protests in Val di Susa. 

Readers seeking a comparative view of how other European jurisdictions are approaching facial recognition may find it useful to consult Federica Paolucci's FRTracker, an independently maintained tracker of FRT-related legislation across Europe.

Conclusion

Draft legislative decree No. 418 illustrated the difficulty of translating the AI Act's risk-based architecture into operational police practice. While Article 8 of the Draft largely mirrored the Regulation's narrow exceptions for real-time identification, Article 10(3) exposed a more structural tension: the broad, open-ended definition of the places and events to which it applies effectively hollows out the targeting requirement set by Article 26(10) of the AI Act, turning a nominally targeted collection into one that can reach anyone entering entire categories of public spaces. This aspect has remained unchanged in the approved Legislative Decree, despite concerns that it could justify preventive, large-scale collection. The Guarantor’s objections confirm the well-foundedness of this risk, grounded in the underlying ambiguity in the AI Act, which leaves considerable discretion to national legislators. 

What the Italian case adds to the broader European debate is a reminder that these questions cannot be resolved through data protection analysis alone. As the Russian and Hungarian precedents suggest, biometric identification in public spaces bears directly on the exercise of freedom of assembly and expression. The potential application of mass facial recognition procedures in policing any kind of demonstration indicates that the stakes of this legislative process extend well beyond the technical calibration of an AI compliance regime.