Italy's data protection authority backs, with conditions, the draft decree transposing the EU platform work directive's algorithm rules

Key takeaways

• The Garante gave a favourable opinion with conditions and observations (parere no. 624) on a draft decree, not on a final rule.
• It calls the draft "complessivamente coerente" (overall consistent) with the directive and the delegation criteria, and sets four conditions on articles 6, 8, 9, 14 and 19.
• Its main observation is a risk of a double penalty track where decree violations overlap with GDPR violations.
• It suggests an absorption clause, or at least a clause coordinating sanction procedures between the labour inspectorate and the Garante.
• The opinion dates itself 16 September 2026, while the Garante newsletter reports 17 September 2026.

What did the Garante say about the draft platform work decree?

In opinion no. 624, the Garante expresses a favourable opinion under Article 36(4) GDPR on the draft legislative decree implementing Directive (EU) 2024/2831 on improving working conditions in platform work. It describes the draft as overall consistent with the directive and the delegation criteria, and says it suggests changes for better coordination with data protection law. The operative part has two limbs. Four conditions are set out in the "Ritenuto" part, and observations are set out in the "Considerato" part. The newsletter summary, which links to the opinion, states the aim as "L'obiettivo è rafforzare le tutele dei lavoratori e rendere più trasparente l'utilizzo dell'intelligenza artificiale e dei sistemi automatizzati" (the aim is to strengthen worker protections and make the use of artificial intelligence and automated systems more transparent).

The opinion records that the Government cited urgency tied to the deadline for exercising the legislative delegation and to the timing of parliamentary committee opinions. It also cites the Garante's internal rule that lets the president act where the board cannot be convened in time, with such acts losing effect unless ratified at the first useful meeting, to be held within 30 days. We did not check whether ratification occurred.

What are the four conditions?

The Garante's four conditions are textual. They are the part of the opinion that asks for specific amendments.

• Article 6(1)(d): reword the prohibition so that it follows the corresponding provision of the directive more closely.
• Article 8: add references to Articles 12, 13 and 14 GDPR and set out the timing for providing the information in paragraph 2.
• Article 9: clarify the reference to an "impact assessment" and specify that the human resources dedicated to oversight report directly to the company's top management. The opinion says the existing reference describes an activity that does not coincide with a data protection impact assessment under Article 35 GDPR.
• Articles 14 and 19: add the essential characteristics of the processing, since the opinion finds the draft does not define with enough precision the purposes of access, the categories of data, the data protection roles of the parties involved and the limits on reuse of information.

Why does the Garante warn about a double penalty track?

In the observations part, the Garante says the draft gives the labour inspectorate (Ispettorato nazionale del lavoro) its own concurrent inspection and sanction powers in articles 7, 8, 9, 10 and 16, in areas that touch and sometimes overlap data protection law. It pairs each article with a GDPR counterpart. Article 7 (data protection impact assessment) corresponds to Article 35 GDPR. Article 8 (algorithmic transparency) corresponds to Articles 13 and 14 GDPR. Article 9 (human oversight) and article 10 (explanation and contestation rights) correspond to Article 22 and related GDPR provisions. Article 16 (private communication channels for workers) corresponds in part to Article 32 GDPR. The Garante says the reservation of competence in its favour in some provisions is not enough on its own to resolve the doubts or to reduce the risk of "un possibile doppio binario sanzionatorio" (a possible double sanction track) for conduct that falls within data protection law.

What fix does the Garante suggest?

The opinion says the drafters should consider whether to draft an absorption clause for the offences, in line with the principles of specialty and proportionality, or at least a clause coordinating the sanction procedures that the labour inspectorate and the Garante can start. It gives, as an example of a coordination clause, article 14(2)(c) of legislative decree 138 of 2024. This sits in the observations limb, so it is a suggestion to the drafters and not one of the four conditions. Nothing in the sources we reviewed says whether the government accepted it.

What does it mean for platforms, employers and counsel in Italy?

The opinion itself does not impose obligations on platforms. GDPR obligations that already apply to them are unchanged by it. The draft decree's own duties would apply only if and when a final decree adopts them, and the final wording may differ from the draft the Garante reviewed. For employment and privacy counsel, the opinion shows how the privacy authority reads the overlap between the draft decree and the GDPR, and that it asks the drafters to address which penalty regime applies. Unions and works councils dealing with algorithmic management can read the condition on article 9 as a statement that oversight staff should report to top management, which the opinion ties to the effectiveness of human intervention under Article 22(3) GDPR. Our article on the Dutch Uber fine over automated driver deactivation covers a related GDPR enforcement matter, which is separate from this Italian draft.

What dates matter?

What should platform operators and counsel do now?

Treat the opinion as a signal about the draft and not as a compliance deadline. These are our suggestions, not steps the opinion requires.

• Follow the final decree text, and note any absorption or coordination clause that the drafters add.
• List the automated systems that assign, rate, pay or deactivate workers, and note which already have a GDPR impact assessment.
• Check whether your transparency notices and human review steps for those systems are documented and consistent with each other.
• Ask counsel which authority would act first if one incident engaged both the GDPR and a decree duty.

What we did not verify

What we opened on 2026-10-25: the text of opinion no. 624 on the Garante website (doc. web 10297373) and the Garante Newsletter no. 552 of 30 September 2026 (doc. web 10300466).

What we did not open: the draft legislative decree itself, Directive (EU) 2024/2831, the delegation law, any later version of the decree, and any government response. We did not check whether the decree has since been adopted, changed or published, whether the president's act was ratified by the Garante, or the directive's transposition deadline. The newsletter dates the opinion 17 September 2026 and the opinion dates itself 16 September 2026. We use the opinion's date and have not resolved the difference. "Labour inspectorate" is our rendering of Ispettorato nazionale del lavoro.

What we refuse to claim: that the decree has been adopted, that any penalty amount or effective date exists, that the government accepted the conditions or observations, or that the opinion is binding on the government.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• Dutch AP fine on Uber over automated driver deactivation
• Italy Garante opinions on the AI Act decrees
• Italy AI law 132 implementing decrees
• CJEU SCHUFA ruling on automated decisions under GDPR Article 22