{"id":2136,"date":"2026-04-15T08:00:00","date_gmt":"2026-04-15T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2136"},"modified":"2026-10-21T14:16:10","modified_gmt":"2026-10-21T13:16:10","slug":"italie-li-framework-garante-agcom","status":"publish","type":"post","link":"https:\/\/ic-services.io\/fr\/resources\/blog\/italy-li-framework-garante-agcom\/","title":{"rendered":"Italy’s LI Framework: Prosecutors, the Codice and What Foreign Operators Miss"},"content":{"rendered":"

Le cadre r\u00e9glementaire italien en mati\u00e8re d'interception l\u00e9gale (LI) recouvre un environnement r\u00e9glementaire complexe que les op\u00e9rateurs \u00e9trangers doivent appr\u00e9hender avec prudence. L'approche italienne en mati\u00e8re d'interception l\u00e9gale compte parmi les plus actives d'Europe. Italienne services charg\u00e9s de l'application de la loi<\/a> have historically been significant users of telecommunications surveillance tools, and the regulatory framework reflects this through detailed legal provisions, institutional oversight structures, and technical requirements that can be unfamiliar to operators entering the market from other EU member states. For foreign operators \u2014 particularly MVNOs and OTT providers expanding into Italy \u2014 the combination of the Codice di Procedura Penale, the Codice delle Comunicazioni Elettroniche and the decentralised Procura model creates a compliance environment that demands careful attention.<\/p>\n\n\n\n

Comprendre le cadre de la LI en Italie ne consiste pas simplement \u00e0 traduire les normes famili\u00e8res de l'ETSI dans un contexte italien. Le syst\u00e8me juridique du pays, ses dispositions institutionnelles et son approche pratique de l'interception pr\u00e9sentent tous des caract\u00e9ristiques distinctives que les op\u00e9rateurs doivent conna\u00eetre pour \u00e9viter des erreurs co\u00fbteuses. Cet article pr\u00e9sente une vue d'ensemble du paysage italien de la LI, en mettant l'accent sur les domaines dans lesquels les op\u00e9rateurs \u00e9trangers rencontrent le plus souvent des difficult\u00e9s.<\/p>\n\n\n\n

Le cadre LI de l'Italie : Aper\u00e7u de la r\u00e9glementation<\/h2>\n\n\n\n

The legal basis for lawful interception in Italy is found primarily in the Codice di Procedura Penale (Code of Criminal Procedure), specifically Articles 266 through 271. These provisions define the circumstances under which interceptions may be authorised, the types of communications that can be intercepted, and the procedural safeguards that must be observed. The public prosecutor (Pubblico Ministero, PM) orders the interception after authorisation by the preliminary investigations judge (Giudice per le Indagini Preliminari, GIP); in urgent cases the PM orders it directly and the GIP must validate it within 48 hours (art. 267 c.p.p.). Orders must relate to serious criminal offences as defined by the Code.<\/p>\n\n\n\n

Italy has a notably broad scope of interception powers compared to some other EU member states. The range of offences for which interception can be authorised includes not only terrorism, organised crime, and drug trafficking, but also corruption and other serious offences against the public administration. This breadth means that Italian operators handle a relatively high volume of interception requests, and their systems must be capable of managing multiple concurrent intercepts efficiently. Since 24 April 2025 an interception may in principle last no more than 45 days in total (art. 267 (3) c.p.p., as amended by Law 47\/2025), with exceptions for organised crime. Operators should expect frequent short orders and extensions rather than open-ended intercepts.<\/p>\n\n\n\n

The Codice delle Comunicazioni Elettroniche (Electronic Communications Code), which transposes the EU’s EECC into Italian law, establishes the general obligations for telecommunications operators, including the duty to cooperate with lawful interception requests. The general authorisation is obtained by notifying the Ministry of Enterprises and Made in Italy (MIMIT) (art. 11 of the Codice). Every authorised operator must then provide the ‘prestazioni obbligatorie’, including interception for the judicial authorities, under art. 57 of the Codice (formerly art. 96). AGCOM \u2014 the Autorit\u00e0 per le Garanzie nelle Comunicazioni \u2014 is the national regulatory authority for the communications market, but it has no authorisation or oversight role for lawful interception.<\/p>\n\n\n\n

Authorisation, Mandatory Services and Compensation<\/h2>\n\n\n\n

The day-to-day execution of interception orders falls to the Procura della Repubblica (public prosecutor’s office) and the operators themselves. The types of mandatory service, the execution modalities and the uniform IT procedures are set nationally by the decree provided for in art. 57 (6) of the Codice.<\/p>\n\n\n\n

For foreign operators, one of the first steps in entering the Italian market is the notification to MIMIT. Italy has no licence for electronic communications services: the operator notifies MIMIT and can start activity, but must be able to provide the mandatory interception services from day one. This applies to MVNOs and smaller operators just as it does to the large networks.<\/p>\n\n\n\n

Italy has a system of compensated interception. Operators are compensated for mandatory interception services under a joint decree of the Ministry of Justice and MIMIT (with the Ministry of Economy and Finance), which sets the service types, tariffs and administrative procedures (art. 57 (6) of the Codice). Understanding and correctly invoicing under this system is an important operational consideration for operators with significant interception volumes.<\/p>\n\n\n\n

Le Garante per la Protezione dei Dati Personali<\/h2>\n\n\n\n

The Garante \u2014 Italy’s data protection authority \u2014 occupies a unique position in the Italian LI landscape. While the Garante does not directly oversee the execution of interceptions, it exercises significant influence over how intercepted data is handled, stored, and protected. The Garante’s detailed interception-security measures (2013) bind the prosecutors’ interception centres and the police, not the operators. Operators are bound by the GDPR and, for traffic data retained for justice purposes, by the Garante’s 2008 measure on the security of telephone and internet traffic data: two-factor authentication, physically separate systems, encryption and tamper-proof audit logs.<\/p>\n\n\n\n

One of the Garante’s most significant interventions in the LI space was its prescriptive ruling on the security of the prosecutors’ interception centres. Following inspections at several prosecutors’ offices, the Garante prescribed physical and logical security measures for their interception centres in 2013: controlled and logged access to listening and server rooms, video surveillance and encryption.<\/p>\n\n\n\n

For operators\u2019 LI systems, the benchmark is GDPR art. 32: strict access control, logging and protection for gestion des mandats<\/a>, data storage and the transmission of intercepted material to law enforcement. Operators that fail to meet these standards risk enforcement action from the Garante, which can include significant fines and orders to suspend processing activities.<\/p>\n\n\n\n

Foreign operators often underestimate the Garante’s role, assuming that data protection compliance in the LI context is limited to general GDPR obligations. In Italy, the Garante’s sector-specific measure on retained traffic data creates additional requirements that must be addressed explicitly. Operators entering the Italian market should review the Garante’s published decisions and guidance on traffic-data security and ensure that their systems and processes are fully aligned.<\/p>\n\n\n\n

Exigences techniques et mod\u00e8le Procura<\/h2>\n\n\n\n

Italy’s technical approach to lawful interception has some distinctive features that differentiate it from other European markets. One of the most important is the Procura model, under which the public prosecutor’s office \u2014 rather than a single national receiving platform \u2014 serves as the primary recipient of intercepted communications. By law, interceptions are carried out with equipment installed at the prosecutor’s office (art. 268 c.p.p.), the ‘Centro Intercettazioni Telecomunicazioni’ (CIT); for internet interception the prosecutor may also use privately owned equipment. Operators may need to deliver intercepted data to multiple different Procure depending on which office has issued the warrant. Storage of the interception archives is due to move to interdistrict digital infrastructures under Decree-Law 105\/2023; their mandatory use has been postponed several times, currently to the end of 2027.<\/p>\n\n\n\n

This decentralised model means that operators may have to connect to several Procure, each with its own connectivity arrangements, while the execution modalities are set nationally by the decree under art. 57 of the Codice. Delivery goes to the prosecutor’s interception centre, whose equipment is often supplied and maintained by private companies (‘fornitori’).<\/p>\n\n\n\n

The fornitore model is a distinctive feature of the Italian market. These companies supply and maintain the equipment of the interception rooms (sale ascolto) used by prosecutors and the judicial police, and provide the technology platforms for managing and analysing intercepted communications. Operators must be able to deliver to the interception centres of different Procure under these uniform national rules. For an operator entering the Italian market, understanding how the Procure and their fornitori receive data is an essential step.<\/p>\n\n\n\n

L'infrastructure technique doit permettre la fourniture en temps r\u00e9el d'IRI et de CC. Les interceptions vocales doivent \u00eatre d\u00e9livr\u00e9es sous forme de flux audio en temps r\u00e9el, tandis que les interceptions de donn\u00e9es doivent capturer et transmettre le trafic IP correspondant. Le volume \u00e9lev\u00e9 d'interceptions en Italie signifie que les syst\u00e8mes des op\u00e9rateurs doivent \u00eatre dimensionn\u00e9s pour g\u00e9rer d'importantes charges d'interception simultan\u00e9es sans affecter la qualit\u00e9 des donn\u00e9es intercept\u00e9es ou les performances du r\u00e9seau commercial.<\/p>\n\n\n\n

Pi\u00e8ges courants pour les op\u00e9rateurs \u00e9trangers<\/h2>\n\n\n\n

Foreign operators entering the Italian market frequently encounter several common difficulties in achieving LI compliance. The first is underestimating the volume and pace of interception activity. Italy carries out a high number of interceptions every year, and operators must be prepared for a significant number of concurrent intercepts, particularly if they operate in urban areas with large subscriber bases.<\/p>\n\n\n\n

Le deuxi\u00e8me \u00e9cueil courant consiste \u00e0 ne pas tenir compte des exigences de la Garante en mati\u00e8re de s\u00e9curit\u00e9. Les op\u00e9rateurs qui se concentrent uniquement sur la capacit\u00e9 technique d'intercepter et d'acheminer les communications, sans tenir compte des aspects li\u00e9s \u00e0 la s\u00e9curit\u00e9 et \u00e0 la protection des donn\u00e9es, se retrouveront en situation de non-conformit\u00e9, m\u00eame si leurs syst\u00e8mes d'interception fonctionnent correctement d'un point de vue technique.<\/p>\n\n\n\n

La troisi\u00e8me difficult\u00e9 consiste \u00e0 s'orienter dans le mod\u00e8le d\u00e9centralis\u00e9 de Procura et fornitore. Les op\u00e9rateurs habitu\u00e9s \u00e0 traiter avec une seule autorit\u00e9 centrale pour la fourniture d'interceptions doivent s'adapter \u00e0 un paysage plus fragment\u00e9 en Italie, o\u00f9 de multiples interfaces techniques et accords de fourniture peuvent \u00eatre n\u00e9cessaires. Cela a des cons\u00e9quences sur la conception du syst\u00e8me, les essais et la gestion op\u00e9rationnelle continue.<\/p>\n\n\n\n

A fourth issue is the cost recovery mechanism. While Italy’s compensated interception model is beneficial for operators, compensation follows the national tariff decree and its uniform administrative procedures, so operators need accurate per-order records to support the payment process.<\/p>\n\n\n\n

Consid\u00e9rations sur les MVNO<\/h2>\n\n\n\n

MVNOs in Italy face the standard challenge of bearing legal responsibility for interception while often lacking direct control over the network infrastructure. The Italian framework does not exempt MVNOs from interception obligations: every operator authorised under the Codice must be able to provide the mandatory interception services (art. 57) and demonstrate a viable capacit\u00e9 d'interception<\/a>. Les op\u00e9rateurs mobiles virtuels (MVNO) doivent donc soit d\u00e9ployer leurs propres syst\u00e8mes d'interception l\u00e9gale, soit conclure des accords complets avec leurs op\u00e9rateurs mobiles h\u00f4tes (MNO) couvrant l'ensemble des exigences en mati\u00e8re d'interception.<\/p>\n\n\n\n

The delivery to the prosecutors’ interception centres is also important. MVNOs must ensure that they can deliver intercepted data to the interception centre of whichever Procura has issued the order, under the uniform national execution modalities. This may still require supporting several connections simultaneously. For MVNOs with limited technical resources, partnering with a LI g\u00e9r\u00e9<\/a> service provider can be an effective strategy, provided it can deliver to the Italian prosecutors’ interception centres.<\/p>\n\n\n\n

Conclusion<\/h2>\n\n\n\n

Italy’s lawful interception framework is among the most demanding and distinctive in Europe. The combination of broad interception powers, high operational volumes, the mandatory services under art. 57 of the Codice, the decentralised Procura model, and the 45-day duration cap creates a compliance environment that requires careful preparation and ongoing attention. For foreign operators \u2014 and MVNOs in particular \u2014 success in the Italian market depends on understanding these local specificities and investing in the legal, technical, and operational capabilities needed to meet them. The MIMIT notification, a delivery capability ready from day one, GDPR-grade security of the LI systems, and accurate records for the compensation process are the foundations of a compliant and sustainable LI operation in Italy.<\/p>\n\n\n\n

Le cadre de la LI en Italie exige des op\u00e9rateurs qu'ils entretiennent des relations suivies avec les autorit\u00e9s de r\u00e9gulation. Il est essentiel pour tout op\u00e9rateur desservant des clients italiens de comprendre en d\u00e9tail le cadre LI de l'Italie.<\/p>\n\n\n\n

Articles connexes<\/h2>\n\n\n\n

Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n