How to file a report to the Privacy Authority with AI

The steps

1. 1.

   Assessment of legal grounds

   A report can be filed by anyone observing a violation, without the need to prove direct personal harm as required for a formal complaint. It must be verified that the contested processing falls within the scope of the GDPR or the updated Italian Privacy Code. The subject of the report must be detailed and concern specific conduct, including systemic practices, carried out by a data controller or processor. It is advisable to preliminarily assess whether the conduct violates the principles of lawfulness, fairness, and transparency set forth in Art. 5 of the GDPR. The use of AI through targeted prompts can assist in quickly identifying the legal references between Art. 144 of the Code and the GDPR.

2. 2.

   Identification of the parties

   The document must contain the full identification details of the reporter and the elements necessary to uniquely identify the data controller or data processor. It is necessary to indicate the company name, registered office, or address of the reported party to allow the Authority to start the investigation. If the reporter requests confidentiality regarding their identity, they must explicitly state the reasons, bearing in mind that the Authority must still guarantee the counterpart's right of defense. The lack of identification data for the controller may render the report inadmissible due to the impossibility of proceeding.

3. 3.

   Detailed description of facts

   An analytical narration of events must be provided, specifying times, places, and methods of the data processing deemed unlawful. It is fundamental to attach any available documentary evidence, such as screenshots, emails, system logs, or contracts, to provide objective confirmation. The description must not be vague but must allow the Authority to understand exactly which processing operation is being complained about. A precise factual reconstruction is necessary to allow the office to exercise the investigative powers provided by Regulation no. 1/2019. AI tools can be used to chronologically summarize the facts starting from the collected documentation.

4. 4.

   Identification of non-compliance

   The professional must link the stated facts to violations of the GDPR or the Privacy Code, explicitly citing the provisions assumed to be breached. Although the Authority performs its own legal assessment, solid technical reasoning facilitates the acceptance of the report and guides the oversight activity. It must be highlighted whether the violation concerns the lack of a proper legal basis, failure to provide notice, or non-compliance with data subject rights. The analysis should take into account the case law and guidelines of the European supervisory authorities. Through specific prompts, AI can support the identification of specific violations based on the description of the facts.

5. 5.

   Request for Authority intervention

   In this phase, the Authority is formally requested to exercise the corrective and punitive powers under Art. 58 of the GDPR. One can request measures such as reprimands, orders to bring processing into compliance, or a temporary or definitive ban on data processing. It is useful to specify the urgency of the intervention if the unlawful processing risks causing serious and irreparable harm to the community or categories of data subjects. The request must be formulated consistently with the powers granted by law to avoid improper or excessive petitions.

6. 6.

   Submission and signature

   The report must be dated and signed by the reporter, preferably using a digital signature to guarantee its integrity and authorship. Submission must be via Certified Email (PEC) to the Authority's institutional address or via registered mail with return receipt. It is necessary to ensure that all attachments are in readable formats and that the size of the digital file does not exceed technical limits. Submission via PEC ensures legal certainty of the filing date. Pursuant to Art. 11 of the Authority's Regulation no. 1/2019, the office performs a preliminary admissibility assessment and decides whether to start the investigation, unlike a complaint where fixed time limits apply for informing the applicant (3 months to communicate the status or outcome pursuant to Art. 77 GDPR), which constitutes a fundamental difference compared to a report.

Legal basis: art. 144 D.Lgs. 196/2003art. 57 GDPRart. 58 GDPR