Italy’s new police biometrics framework took effect on September 30, establishing targeting, authorization and data-handling rules for facial recognition and other biometric identification used in law enforcement.
Legislative Decree 160/2026 aligns national police use of artificial intelligence with the EU AI Act. Its biometric provisions distinguish real-time identification for specified preventive and protective purposes from retrospective facial recognition applied to images already acquired.
For preventive real-time use, the decree covers specified serious threats and searches for missing people or victims of kidnapping, trafficking and sexual exploitation. Comparisons must target identified or identifiable people connected to the threat or search, using reference databases assembled for each authorization rather than reusable, expanding watchlists.
These uses normally require authorization from the district public prosecutor, with a defined exception for urgent cases. Approvals must specify the people, territory, duration and relevant event. They last only as long as necessary, up to 15 days, with justified renewals when the conditions remain satisfied.
The framework requires fundamental-rights and data-protection impact assessments before those real-time uses. Operations must generate nonmodifiable logs, retained for five years, to support legality checks, internal oversight and criminal proceedings.
Retrospective recognition follows a separate approval route. For targeted searches for known suspects, prosecutors must request authorization from an investigating judge without delay and within 48 hours of activation. The judge has a further 48 hours to decide. Initial identification of a potential suspect after a crime is exempt from that requirement when grounded in objective, verifiable evidence directly connected to the offence.
The decree also allows facial images to be stored locally at specified sites or events without prior biometric processing. Biometric comparisons may follow a crime. Personal data in those reference databases must be automatically deleted after seven days, a limit distinct from the five-year retention of operational logs.
Generic or indiscriminate biometric identification disconnected from a specific offence or criminal proceeding is prohibited. Decisions producing adverse legal effects cannot rest solely on facial recognition results.
Police biometrics legislation has prompted scrutiny elsewhere in Europe. Civil-liberties groups have questioned safeguards in Ireland’s proposed Garda biometric powers, including the definitions governing identification and categorization.
In the United Kingdom, Scotland’s biometrics commissioner has renewed calls for primary legislation on live facial recognition. His annual report supports proportionate use within a legal framework establishing protections and oversight.
Sources: Gazzetta Ufficiale
–
By the ID Tech Editorial Team
