Personal data protection, regulatory compliance and digital risk management.

The protection of personal data, information security and proper data governance are essential components of the operational continuity, reputation and reliability of any organisation. Technological development, the spread of digital and cloud services, the interconnection of systems, the use of analytics and profiling tools, and the growing reliance on IT infrastructure require an integrated approach based on risk assessment and on the organisation’s ability to demonstrate compliance over time.

Cugia Cuomo & Associati assists companies, regulated operators, public and private entities in designing, implementing and updating the legal and organisational safeguards relating to personal data protection, information security, data sharing and digital risk management.

Areas of assistance

Privacy compliance and accountability

The Firm assists clients in establishing and maintaining privacy compliance programmes, including:

• analysing processing activities and identifying the roles and responsibilities of controllers, joint controllers and processors;
• preparing, updating and reviewing the Record of Processing Activities;
• identifying and documenting legal bases, purposes, retention periods and processing methods;
• preparing and reviewing privacy notices, internal procedures, policies and operational instructions;
• establishing procedures for managing data subject requests and exercising the rights provided for by applicable law;
• analysing transfers of personal data to third countries and the relevant safeguards;
• reviewing contracts and privacy clauses in dealings with clients, suppliers, technology partners and cloud service providers;
• appointing and updating authorised persons, processors and any joint controllers;
• supporting staff training and awareness programmes;
• conducting documentary audits and assisting in preparing the evidence required to demonstrate compliance.

Risk assessment, security and data breaches

The Firm assists clients in assessing the risks associated with processing activities and in defining the necessary legal and organisational safeguards, also in coordination with the client’s technical and security functions.

In particular, the assistance may include:

• privacy risk assessments and analysis of the impact of processing activities on the rights and freedoms of data subjects;
• preparing and updating Data Protection Impact Assessments, including in relation to processing activities based on new technologies, profiling, systematic monitoring, video surveillance or the processing of special categories of personal data;
• verifying consistency between processing activities, system architectures, technical and organisational measures, and the level of risk;
• reviewing procedures relating to access management, authentication, logging, systems administration, encryption, pseudonymisation, data retention and deletion;
• preparing and updating procedures for managing security incidents and personal data breaches;
• assisting in assessing whether a breach notification to the Italian Data Protection Authority is required and, where necessary, whether the affected data subjects must be informed;
• supporting the management of relationships with ICT suppliers, cloud providers and entities responsible for security;
• assisting during audits, inspections and requests for information from supervisory authorities.

DPO and data protection governance

The Firm can make available to clients a team of professionals to perform the functions of Data Protection Officer (DPO), where the conditions for appointing a DPO are met or where the client voluntarily chooses to make use of this role.

Websites, apps, cookies and digital services

The Firm assists clients in reviewing the privacy and regulatory aspects of websites, applications and digital services, including:

• privacy notices and cookie policies;
• the legal and documentary framework for cookies and other tracking technologies;
• mechanisms for obtaining, recording and withdrawing consent;
• analytics, advertising, remarketing and preference-management tools;
• relationships with platform, hosting, cloud and digital service providers;
• consent mechanisms and notices for commercial, promotional and profiling activities;
• assessment of processing activities carried out through artificial intelligence, automated systems and data analytics tools, in coordination with the applicable European regulatory framework.

Marketing, electronic communications and profiling

The Firm provides assistance in relation to direct marketing, commercial communications and profiling, with particular regard to:

• legal bases, privacy notices and consent;
• campaigns conducted by e-mail, SMS, messaging services, telephone and other digital channels;
• telemarketing and unsolicited communications;
• the Italian Public Register of Oppositions and the management of data subjects’ objections;
• the acquisition and management of lists and databases for commercial purposes;
• customer profiling and the use of automated assessment systems;
• campaigns carried out through social networks, advertising platforms and third-party providers;
• reviewing processes for the retention, updating and deletion of contact details.

Electronic communications, telecommunications and digital content

The Firm assists electronic communications operators, providers of online content and services, and companies using networks or information systems addressed to the public, in relation to the privacy and security obligations connected with the services they provide.

The assistance may include, among other matters:

• the processing and retention of traffic data and data relating to communications;
• users’ access to data and the management of requests provided for by applicable law;
• billing and the management of customer relationships;
• system security, strong authentication, access logging and remote administration;
• the management of requests from public authorities and the related cooperation obligations;
• coordination between privacy legislation, electronic communications rules and applicable sector-specific requirements.

Video surveillance, biometrics and identification technologies

The Firm assists clients in designing and reviewing video-surveillance systems, including systems integrated with automated analytics tools, as well as in using biometric data and recognition or authentication systems.

The activities include:

• assessing the lawfulness, necessity and proportionality of processing activities;
• preparing privacy notices and internal documentation;
• reviewing retention periods, access levels and security measures;
• assisting with Data Protection Impact Assessments and, where necessary, managing relations with employee representatives and the competent authorities;
• analysing the use of biometric recognition, biometric signatures and other identification tools;
• updating technical rules and operational procedures;
• assessing the applicability of the restrictions and requirements laid down by national and European law for facial-recognition systems and similar technologies.

Regulated sectors

The Firm assists operators and organisations that process data in sectors characterised by specific regulatory obligations or particular risks for data subjects, including:

• debt collection companies;
• commercial information companies;
• banks, financial intermediaries and entities managing credit information systems;
• entities operating in the consumer credit sector and in the assessment of creditworthiness and payment reliability;
• insurance companies and entities using data for risk-assessment purposes;
• electronic communications operators and digital service providers;
• publishers, journalists, platform operators, bloggers and social-network operators.

Data Act, data sharing and cloud services

The Firm assists companies in complying with Regulation (EU) 2023/2854 (the Data Act), concerning access to and use of data generated through the use of connected products and related services, data sharing between businesses and with public-sector bodies, interoperability, and switching between data-processing services.

Further European and digital legislation

Depending on the relevant sector, the services provided and the processing activities carried out, the Firm coordinates privacy advice with other applicable European legislation concerning data, digital services, cybersecurity, artificial intelligence, electronic communications, online platforms, data sharing and interoperability.

The analysis is conducted on a case-by-case basis in order to identify the obligations that actually apply, the competent authorities, the interaction between the different regulatory frameworks and any action required in relation to contracts, processes, systems and corporate documentation.

Data subject rights, reputation and the right to be forgotten

The Firm assists individuals, companies and organisations in managing the rights provided for by privacy legislation and in related protective activities concerning the circulation of information online, including:

• access, rectification, erasure, restriction of processing and objection;
• data portability and the management of automated decision-making;
• exercising rights against controllers, processors and platforms;
• requests for delisting and protection of the right to be forgotten;
• removal of, or objections to, content that damages a person’s or organisation’s reputation and is disseminated through websites, blogs, social networks and other online services;
• assistance in preparing complaints, reports and applications;
• coordination between administrative remedies, judicial protection and the tools provided for by sector-specific legislation.

Assistance in dealings with the Italian Data Protection Authority and other authorities

The Firm assists clients in dealings with the Italian Data Protection Authority and other competent authorities, both in and out of court. This assistance is provided through an integrated approach combining legal analysis, document review, organisational support and coordination with the client’s technical, security and compliance functions.