The Privacy Qualification of the Relationship Between the Legislative Assemblies of the Regions and of the Autonomous Provinces of Trento and Bolzano and Their Guarantor Bodies Pursuant to European Data Protection Law, as Defined by the Gdpr

ABSTRACT This paper aims, without claiming to be exhaustive, to explore the relationship between legislative assemblies of the regions and of the autonomous provinces of Trento and Bolzano and their respective regional/provincial guarantor bodies, in the context of personal data processing. The paper examines the various possible qualifications, particularly considering the recent Opinion of 23 March 2024, issued by the Italian Data Protection Authority on this matter.

KEYWORDS Data processing - Administration - Guarantor bodies - Legislative assemblies

TABLE OF CONTENTS 1. Introduction. – 1.1. Foreword. – 1.2. Overview of the role and functions of regional/provincial legislative assemblies. – 1.3. A look at the nature of the guarantor bodies of regional/provincial councils. – 1.4. (continued) Case law and administrative decisions on the subject. – 2. The perspective of the Italian Data Protection Authority on the subject. – 2.1. The potential privacy frameworks of the relationship: joint controllers, autonomous controllership or other? – 2.2. Between practice and law. Experiences of regional/provincial councils on the privacy configuration of the relationship: the case of the Ombudsman. – 2.3. Between practice and law. Different European viewpoints. – 2.4. The Opinion of 23 March 2024; the subject of the requested decision. – 2.5. (continued) The Garante’s assessments and decision. – 3. Concluding remarks and reflections. – 3.1. Observations on the Garante’s Opinion, together with an assessment of the decision’s scope and implications. – 3.2. Future perspectives and possible scenarios on the qualification of the relationship