Italy

According to the Decree No. 196/2003, which is still in force, breaches of data protection lead to criminal and administrative sanctions.
More precisely, from article 167 to article 172 of the Decree, it is expressly provided for criminal penalties in cases of:
- unlawful data processing (where breaches concern, for example, information notice, consent, sensitive data, traffic data, location data, unsolicited communications and so on);
- untrue declarations and notifications submitted to the Italian Personal Data Protection Authority;
- failure to comply with the security measures set out by the Decree No. 196/2003;
- failure to comply with provisions issued by the Italian Personal Data Protection Authority and other mandatory obligations referring to employees’ personal data protection.
Furthermore, the Decree expressly states that being convicted of any of the offences above shall always entail publication of the relevant judgment.