Italy's government has written a decree that would let police collect the biometric data of everyone entering a location it designates as "sensitive" for public order and store that data for seven days. Its own data protection authority, the Garante, said in its formal opinion that the provision is "not coherent with the AI Act," the European regulation the decree exists to implement.
Public squares, stadiums, railway stations and streets during demonstrations, marches, sports events and concerts are the examples given in the parliamentary papers. Where the edge of a square or a street would be drawn, the draft does not say. Article 10 leaves the operating rules to a later decree from the interior minister, written after consulting the Garante.
Article 10 has the cameras at those places turn the faces of people coming in - everyone coming in - into biometric data automatically, at the moment of filming. The processing applies to everyone, suspected of nothing. If a crime is committed there inside the seven days, police can run the face of a person they already suspect against the stored crowd. Otherwise the data is deleted automatically once seven days from collection have passed.
Anyone who walks into that square has their face taken and held for a week.
Article 5(1)(h) of the EU AI Act has banned most law enforcement use of real-time remote biometric identification in publicly accessible spaces since February 2, 2025. Member states may opt into three narrow exceptions, for missing persons and victims of trafficking, imminent terrorist threats, and suspects in a listed set of serious offenses. The government's answer is that collection and recognition are two separate stages, and that biometric processing would take place only after an offense has been committed, according to Eunews.
The Garante said the AI Act allows post-event facial recognition "only for targeted searches." Processing should "occur exclusively on recordings already acquired and in the presence of a specific operational need, avoiding massive and preventive collections," the authority said. Its opinion on the rest of the decree was favorable, with conditions attached.
So a record of everybody who attended a named political demonstration exists for a week, whether or not a crime is ever committed there. The draft does carry limits. A decision with negative legal effects on a person has to rest on more than a facial recognition result, and the administration has to carry out a data protection assessment and consult the Garante before any of it runs. But none of that touches the collection, and the authorization to search what has been collected rests with a public security officer appointed by the police commissioner - not a judge - according to Il Sole 24 Ore.
What becomes of the stored faces of everyone on a march where a crime is committed an hour later?
A European Commission spokesperson said "facial recognition in publicly accessible spaces is a prohibited practice under the AI Act," while adding that they could not confirm the prohibition applies to the Italian text without scrutinizing it. Brando Benifei, a Member of the European Parliament and a rapporteur on the AI Act there, said the decree risks "allowing the mass collection of biometric data in public spaces, contrary to the spirit of European legislation." Benifei has announced an urgent question to the Commission asking what measures it intends to take.
The rights group Antigone has asked for the decree to be withdrawn for want of safeguards. It says prior authorization by an investigating judge should be written into Article 10, and that these systems should be forbidden outright at street demonstrations and strikes.
Angelo Bonelli, co-leader of the Greens-Left alliance, said AI-based mass profiling of citizens attending political events is "totally unacceptable" and raises "serious questions for the protection of fundamental freedoms." An official in Meloni's office told Ansa that "Italy will continue to comply with European regulations regarding facial recognition in accessible public spaces, starting with the AI Act, as it has done so far."
The interior minister, Matteo Piantedosi, said in June that "there is no generalised Big Brother," according to Il Sole 24 Ore. The debate followed rioting in Bologna and protests that turned violent in the Susa Valley, where - according to Ansa - "scores" of police were injured in both.
The Senate's European Affairs Committee cleared the text on July 29, with Democratic Party and Five Star Movement members walking out of the session. A vote in the Chamber's European Affairs Committee was postponed the following day after Forza Italia, a partner in the governing coalition, objected. More committee opinions are due at the Chamber and at other Senate committees before the decree returns to the Council of Ministers for final adoption, which has to happen by October 10. The delegation that lets ministers write these rules by decree at all, granted by Law 132 of 2025, runs out in October 2026.
