Meloni's facial recognition decree worries EU experts

Giorgia Meloni's government is finalizing a legislative decree that authorizes Italian police to use artificial intelligence systems for real-time remote biometric identification in public or publicly accessible spaces. The measure, designed with concerts, protests and football matches in mind, transposes the EU's AI Act into Italian law — but several data protection experts warn its safeguards may not be enough to avoid a clash with EU legislation, El País reports.

What the decree actually allows

The 21-article text separates the use of biometric data in ongoing criminal investigations from its use for crime 'prevention' — the most contested part. Article 8 sets out when police may activate remote biometric identification: a specific, substantial and imminent threat to life or physical safety, a real threat of a terrorist attack, or the search for missing persons or victims of kidnapping, human trafficking or sexual exploitation.

Unlike an ordinary criminal investigation, which requires authorization from an investigating judge, preventive use is requested by the police chief (questore), the provincial commander of the Carabinieri or the Guardia di Finanza, and addressed to the district prosecutor. After the controversy in parliamentary committees, the government added a second layer of oversight: alongside the prosecutor, the preliminary investigations judge must now also sign off, according to the Italian outlet Linkiesta.

• The purpose pursued and the specific threat being prevented
• The duration, capped at 15 days, renewable
• The exact geographic area where the system will run
• The people sought or affected, when known
• The databases and technologies used

In urgent cases, police can activate the system without prior authorization, with a simple oral notice to the prosecutor, who has 48 hours to validate the operation. The decree also specifies that no permanent biometric database will be built, and that data gathered for preventive purposes cannot be used as evidence in criminal proceedings.

Why experts are alarmed

Italy's data protection authority, the Garante per la Protezione dei Dati Personali, ruled that the first version of the text was incompatible with the AI Act's restrictions on live facial recognition, forcing the government to postpone the vote in the Chamber of Deputies, according to trade publication Biometric Update. A European Commission spokesperson was blunt:

Facial recognition in publicly accessible spaces is a prohibited practice under European Union AI law.

The Court of Justice of the European Union has itself ruled that when national authorities' access to personal data risks a serious interference with fundamental rights, that access must be subject to prior review by a judge or an independent administrative body — the central argument behind adding the investigating judge as a second check.

The precedent is not minor: back in January 2023, the Meloni government already handed control of preventive wiretaps to the general prosecutor of the Rome Court of Appeal — without any judge involved. Tellingly, voices usually close to the government, such as the Camere penali lawyers' association, the Luigi Einaudi Foundation and Libertà Eguale, have joined critics of the new decree for weakening judicial safeguards.

The debate has been reignited by rioting in Bologna and violent protests in the Susa Valley, where dozens of officers were injured, according to the Italian news agency Ansa. Meloni's office insists Italy 'will continue to comply with European regulations on facial recognition in publicly accessible spaces, starting with the AI Act, as it has done so far.'

A direct clash with the EU's AI Act

The AI Act classifies real-time remote biometric identification in public spaces as an unacceptable-risk practice, banned except for three narrowly defined exceptions: searching for missing persons, an imminent terrorist threat, and locating suspects in specific serious crimes — the very exceptions Italy invokes to justify its decree. The European Commission pushed back, in May, to December 2027 the deadline for high-risk systems, such as police biometric identification tools, to fully comply with the regulation — a window Rome is using to finalize its own national law.

For companies that build or sell facial recognition systems, the Italian case is a preview of what compliance will require across the EU. The AI Act applies to any provider that places a biometric identification system on the European market, regardless of where the company is based: a firm marketing such technology to Italian police — or to any other member state — will have to demonstrate the same safeguards Rome is being pushed toward: a precisely defined purpose, proportionality, and prior judicial oversight. That work needs to be done before December 2027, when Brussels' extension for high-risk systems runs out.