Italy Media Law Guide

Defamation, Privacy and Data Protection


Matteo Mangia

Matteo Mangia

Founder - Studio Legale Avv. Matteo Mangia


Defamation and Privacy Law in Italy

Contributors: Matteo Mangia (Founder, Studio Legale Avv. Matteo Mangia)

Defamation and Abuse

In Italy, the offence of defamation gives rise both to criminal and tortious liability.  Until January 2016, the legal system provided for two different crimes against a person’s honor, namely defamation (“diffamazione”) and abuse (“ingiuria”).

The difference between the two offences lies in the fact that abuse occurs whenever the offended party is present and perceives the defamatory statement. Whereas, the crime of defamation requires the absence of the offended person.

However, Legislative Decree No. 7/2016 has decriminalized the offence of abuse, which nowadays gives rise only to civil liability and is punished with a pecuniary sanction[1].

Criminal Law

The Claim

Since defamation is a crime which cannot be prosecuted ex officio, only the offended person can start a claim by presenting a formal complaint[2] (“querela”) to the Public Prosecutor within three months from the time he has become aware of the offence[3].

Not every statement which is perceived by the injured party as being offensive gives rise to criminal liability since the detrimental statements must objectively damage reputation.

Furthermore, in order to constitute the crime under examination in all its elements, the offending statement must be disclosed (communicated) by the offender and be understood and materially perceived by third parties.


The Criminal Code provides for a specific plea for the crime of defamation, which excludes the indictability of the illegal conduct if the fact has been committed because of a state of legitimate anger caused by an unfair conduct of the offended person[4].

The Italian legal system envisages also general “justifying circumstances”, such as the consent of the offended party, the exercise of a right or the action in the exercise of a duty[5] which could exclude the liability of the criminal conduct.

It’s appropriate to point out that the defendant can invoke the constitutionally[6] guaranteed “right to critique” whereas, if defamation has taken place in the press, journalists can also invoke the “right to inform”.

The exercise of such rights, if carried out within the limits of the expressive restraint (that is not excessively gross, aggressive or vulgar) the social interest of the information disclosed and its truth, justifies the otherwise illicit conduct.

It is appropriate to highlight that the truth of an allegation does not of itself provide a defense to a criminal charge of defamation[7].

Lastly, no criminal liability can arise if the detrimental statements are made in the context of proceedings before the judicial or administrative authority[8].

Punishment and Remedies

Pursuant to the first paragraph of Art. 595 of the Criminal Code defamation is punishable by imprisonment for up to one year or by a fine up to EUR 1032.

The subsequent paragraphs of Art. 595 provide for the following special circumstances which aggravate the sanctions:

(a) if the offence consists in the attribution of a specific and defined conduct/event/fact[9], the crime is punished with the imprisonment for up to two years or by a fine up to EUR 2065;

(b) if the offence is carried out by means of press or with any other mean of publicity, the crime is punished with the imprisonment for up to three years or by a fine not less than EUR 516;

(c) if the offence is directed to a Political, Administrative or Judicial body, the sanction is increased.

The offended party can choose whether to claim compensation for the criminal act of defamation before a civil Court or within the criminal proceedings.

In the latter case, the offended party should formally file a claim (“costituzione di parte civile”) before the Court where the criminal proceeding is pending. If the Judge finds that the crime has been committed, he can award the offended party with compensation or refer the quantification of damages to the civil Judge, which will determine the sum in a separate proceeding[10].

Procedural Aspects

For minor criminal conducts of defamation, the competence lies within the Justice of the Peace whereas the ordinary Court is competent for the aggravated cases[11].


With regards to criminal liability the limitation period is six years[12], which can increase up to a maximum of seven and a half years in the circumstance that some “interruptive acts”[13], such as the request of trial (“richiesta di rinvio a giudizio”) or the formal indictment (“decreto che dispone il giudizio”), occur.

Online defamation

In the last decade case law has shown several instances of defamation committed online and the Criminal Supreme Court has therefore clarified the circumstances in which such conduct can be sanctioned.

The Supreme Court[14] considers that online defamation which has been perpetrated via means like blogs, forums or social networks is aggravated because the offence is carried out by any other mean of publicity, whereas detrimental statements published on online newspapers (since they do not differ from traditional press) must be considered as aggravated by means of press.

Although the sanction envisaged is the same for both conducts, this distinction has some relevant implications: to the preventive measures applicable, since the seizure of the newspaper is generally not allowed[15] and to the application of Article 597 of the Criminal Code which sets forth the negligent criminal responsibility of the director which can be applied only to defamation made with the press.

Civil Law

Civil defamation action can be brought independently of any criminal proceeding.
Nevertheless, the main difference between criminal and civil tort lies within the intent: defamation is criminally indictable only if is intentional (“dolosamente”) whereas the civil tort might be committed even negligently (“colposamente”).[16]

The Claim

In contrast to criminal liability (where the burden of proof lies upon the Public Prosecutor) in case of civil proceedings it is duty of the claimant to prove the damage.

The claimant must demonstrate the defamatory character of the statement, the nature and extent of the damages claimed and its nexus with the defendant’s conduct.


As previously mentioned, if the defendant has published detrimental statements but the right to report or to critique exists and is exercised within its limits, the conduct will not constitute defamation[17].

Punishment and Remedies

The claimant has the right to obtain both “economic damages”, intended to restore the financial losses caused by the illegal conduct, and “non-economic damages”, to compensate the moral damages occurred.

No statutory limit applies to the maximum amount of damages that might be granted as compensation.

With specific regard to the civil offence of abuse, if the Judge finds the defendant guilty, beside the eventual compensation of damages he must inflict a pecuniary sanction from EUR 100 to 8000.

As with the crime of defamation, the illicit conduct of abuse is aggravated[18] if the offence consists in the attribution of a specific fact or is committed at the presence of more people.

Procedural Aspects

A civil claim must be first submitted to mediation before the proceedings are issued. Only if mediation is unsuccessful can the claim be validly presented before the civil Court.

The jurisdiction depends on the sum of compensation requested: if the amount exceeds EUR 5000 the competence lies within the Court, if lower, to the Justice of the Peace.


The limitation period in order to exercise the civil action in relation to tortious liability for defamation is five years.
The same period is envisaged for the civil liability claim in case of abuse.


Italian privacy law can mainly be found in a single statute, the Legislative Decree No. 196/2003 (“The Privacy Code”) which recognizes the protection of personal data and requires that its treatment (the gathering, processing, comparison, elimination, modification, communication) is carried out with respect to human dignity and to fundamental rights and freedoms of the individuals[19].

The Code has been considerably amended by Legislative Decree No. 101/2018 which has implemented the General Data European Regulation (GDPR).

The infringement of the provisions of the Code gives rise to criminal or to civil liability[20].

Criminal Law

The crime of illegal treatment of data[21], which arises in several cases of infringement of the provisions of the Code regulating the treatment, has been amended and its scope has been broadened by sanctioning various conduct aimed not only at gaining profit but also at causing harm to the other party.

The legislative intervention has also introduced new provisions[22] which sanction the fraudulent acquisition and the illicit disclosure of personal information contained on automatized archives that are subject to “large-scale” treatment, as well as conduct which interferes with the activities, even jurisdictional, carried out by the Data Protection Authority (“Garante della Privacy”)[23].

The last criminal provision introduced by Legislative Decree No. 101/2018 protects the right to privacy of employees sanctioning the violation of the dispositions regarding distance surveillance and investigations about their opinion[24].

The only provision directly regarding privacy that is envisaged by the Criminal Code is art. 615-bis, headed “Illegal interference in private life”, which sanctions those who illicitly obtain and disclose information or images regarding the private life of other subjects.

Claim and Procedural Aspects

Proceedings concerning a violation of a criminal provision in the Privacy Code can be started ex officio by the Public Prosecutor, which must be informed by the Data Protection Authority when an infringement is envisaged.

With regards to the violation of Art. 615-bis of the Criminal Code it is the offended party that must file a claim with the Public Authority[25].


The crimes envisaged by the Privacy Code are generally not committed if a) the conduct did not cause harm or damage to the data subject and b) the defendant acted without the intention either to make profit or to cause damage.

Additionally, for some provisions, the conduct is not indictable if it took place with the consent of the data subject.

Punishment and Remedies

The sanction for the criminal provisions envisaged in the Code is the imprisonment from a minimum of three months up to a maximum of six years, whereas the violation of Art. 615-bis is sanctioned with the imprisonment from six months to three years.


The limitation period with regards to the criminal provisions envisaged by the Privacy Code and the Criminal Code is six years, that can increase to a maximum of seven and a half years in case of “interruptive acts”[26].

Civil and Administrative Law

The GDPR establishes the right for the damaged data subject[27] to obtain compensation if the treatment of their data has violated the dispositions of the Privacy Code.

Claim and Procedural Aspects

When an infringement of the provisions set by the Code is envisaged, the data subject has recourse to the Data Protection Authority or to the ordinary Court.

The party can seek relief, independently from the criminal proceedings, from the Data Protection Authority which can award injunctive remedies intended to stop the violation, or technical measures that might limit, suspend or block the data treatment.

The claimant must demonstrate that a violation of the Code has occurred and that such infringement has caused them damage.


Since both administrative and civil offences are negligently indictable, the defendants can avoid liability only if they can prove that their wrongdoing was the result of unavoidable accidents or that any reasonable and suitable measure to prevent the damage has been undertaken.

Punishment and Remedies

Both injunctive relieves and the award of compensation may be granted, whereas the Authority can also impose very severe administrative sanctions in case of violation of the provisions of the GDPR.


In relation to tortious liability, the limitation period to claim compensation is five years.

Contributor: Matteo Mangia (Founder)
Studio Legale Avv. Matteo Mangia
Via G. Leopardi 5
20123 Milano

The material in this Guide is for general information only and does not constitute legal advice.

[1] With the judgement No. 37 of the 6th March 2019, the Constitutional Court has considered the decriminalization lawful.
[2] Art. 597 of the Criminal Code.
[3] Art. 124 of the Procedural Criminal Code.
[4] Art. 599 of the Criminal Code. The first paragraph of the Article, which excluded the punishability of the conduct in case of mutual abuse between two persons, has been repealed by the Legislative Decree No. 7/2016.
[5] Arts. 50 and 51 of the Criminal Code.
[6] Art. 25 of the Constitution.
[7] Nevertheless, Art. 595 of the Criminal Code provides for some exceptions to this general rule.
[8] Art. 598 of the Criminal Code.
[9] If the detrimental conducts consist in the attribution of a determinate fact and are carried out by means of press, pursuant to Art. 13 of Law 47/1948 the sanctions are furtherly increased up to a maximum of six years of imprisonment.
[10] In this case, the sentence of the Civil Judge cannot affect the criminal judgement.
[11] Like those sanctioned pursuant to the third and fourth paragraphs of Art. 595 of the Criminal Code.
[12] Art. 157 and following of the Criminal Code.
[13] Pursuant to Art. 159 of the Criminal Code, in some cases the effectiveness of the limitation period might also be suspended.
[14] Italian Criminal Supreme Court, Sect. V, February 19th 2019, No. 16751 and Criminal Supreme Court, Sect. V, January 11th 2019, No. 1275.
[15] See Criminal Supreme Court, Plenary Session, 17th July 2015, No. 31022.
[16] Criminal Supreme Court, 15th January 2005, No. 729.
[17] In this case, the burden of proof rests on the defendant, Supreme Court, 23rd July 2003, No. 11455.
[18] With a pecuniary sanction from EUR 200 to 12000.
[19] Art. 1 of the Privacy Code as amended by Legislative Decree No. 101/2018.
[20] As well as administrative responsibility prosecutable by the DPA.
[21] Art. 167 of the Privacy Code.
[22] Artt.167-bis and 167-ter of the Criminal Code.
[23] The already existing provision which sanctioned the non-compliance with the measures taken by the DPA is still envisaged by the Code.
[24] Art 171. of the Privacy Code.
[25] Except for conducts carried out by Public officials, which are prosecutable ex officio.
[26] With the exemption of Art. 170 for which the limitation period is four years, that can increase to a maximum of five years.
[27] The subject defined by Art. 4 of the GDPR whose personal data are protected.

Our Newsletter