The Data Protection Authority gives the green light to the It-Wallet

The Data Protection Authority has given its approval to the draft decree issued by the Head of the Department for Digital Transformation at the Prime Minister’s Office, which sets out the technical and organisational measures to be adopted within the framework of the Italian digital wallet (It-Wallet), by means of Provision 631 of 23 September 2026.

The Authority’s guidance covered the definition of the roles of the various parties involved, the measures to be taken where special categories of data are processed, and the handling of requests from users for the deletion of personal data. The Data Protection Authority also examined the data protection impact assessment (DPIA) accompanying the draft decree, which will be made available to those involved in the IT-Wallet system as a reference for the adoption of the technical and organisational measures falling within their respective remit. At the same time, it drew attention to the obligations incumbent upon all parties involved in the system, in accordance with the principle of accountability under the GDPR.

Since yesterday, the following have also been available on the Data Protection Authority’s website: the FAQs on credit information systems (SICs), private databases which collect information on loans and payment behaviour from banks and financial intermediaries, enabling the assessment of customers’ creditworthiness. The SICs are managed by specialised private companies and regulated by the Code of Conduct for information systems managed by private entities concerning consumer credit, creditworthiness and payment punctuality, approved by the Data Protection Authority (Provision 324 of 6 October 2022) – unlike the public Central Credit Register, which is managed by the Bank of Italia and governed by sector-specific legislation. Telephone companies, insurance companies and energy suppliers may also access the SICs, solely for the purpose of consulting the information held there. Data processing is generally based on legitimate interest and does not require the consent of the individual.

In the event of the first late payment, a warning notice is to be sent to the person concerned at least 15 days before the late payment appears in the database. The retention periods range from 90 days to 60 months, depending on the type of data. Citizens may request access to, rectification of, or erasure of their data and, in the event of infringements or unsatisfactory responses, may contact the monitoring body for the SICs or the Data Protection Commissioner.