Italian police can now identify faces in real time from street cameras

Since September 30, Italian police can identify people by their faces in real time through cameras in public places. Legislative Decree 160/2026 of September 9, which brings Italian law in line with the EU AI Act, has entered into force. The decree adds Article 359-ter to the Code of Criminal Procedure, covering real-time remote biometric identification.

A person can be searched for this way if suspected of an offence listed in Annex II of the AI Act that carries a maximum sentence of at least four years in prison. The list includes terrorism, human trafficking, drug trafficking, organised crime and the sexual exploitation of children. The preliminary investigations judge grants a 15-day authorisation, which can be renewed, at the prosecutor's request. According to La Legge per Tutti's analysis, the law allows matching by iris and gait as well as by face.

When police switch the cameras on before a judge

For urgent cases the decree sets out three steps. The prosecutor can start the system with a reasoned order and inform the judge within 24 hours. If there is no time to wait for the prosecutor, the police can switch recognition on themselves and request authorisation within 12 hours. The judge must confirm or cancel the decision within 48 hours. If the judge refuses, the data collected is deleted and cannot be used in the case.

There is also a preventive mode under Article 8 of the decree, with no criminal case involved. Here the prosecutor, not a judge, gives the authorisation, again for up to 15 days. Grounds can be a specific terrorist threat or a search for missing people, abduction victims and victims of trafficking. The lawyers at La Legge per Tutti call the absence of a judge in this mode one of the decree's most contested points.

Stadiums and mass events

The most controversial part of the draft survived into the final text. Article 10 allows places and events with "particular public order needs" to record the faces of everyone present and keep them for 7 days, together with ticket data and seat numbers. The images are processed biometrically only after a crime has been committed, to find a specific suspect.

On July 31, while the draft was before parliament, a European Commission spokesperson noted that the AI Act prohibits real-time biometric identification in public spaces except in strictly limited cases. Italy's data protection authority, the Garante, called the definition of such places too broad and warned of a risk of mass surveillance. MEP Brando Benifei, one of the European Parliament's rapporteurs on the AI Act, said the decree could allow mass collection of biometric data in public spaces, against the spirit of the European law.

The decree does contain limits. Databases built by scraping photos from the internet are banned, the method Clearview uses to build a dossier from a single photo. No decision with legal consequences may be based on a recognition result alone. Data is kept for 7 days, and the system's logs for 5 years.