The case involves media company RTI S.p.a

SEE ALSO Press Release dated August 7, 2026 [Web Doc. No. 10281021] Decision of July 23, 2026 Register of Decisions No. 577 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed with the Data Protection Authority, pursuant to Art. 77 of the Regulation, on XX, in which Mr. Enrico Ettore Mentana, represented by lawyers XX and XX, alleged the unauthorized use of his image by R.T.I. - Reti Televisive Italiane S.p.A., in its capacity as producer of the program “Striscia la Notizia,” which, beginning on XX, unlawfully reproduced the aforementioned image through the use of artificial intelligence systems in order to create “reports” – detailed in the complaint – in which he “appears (unwittingly) as the protagonist and is depicted in his role as News Director of La7’s news program (…) to perform a script written by the authors of the Mediaset television program, while also displaying the La7 News logo to make the staging appear even more credible”; he also noted that the full video footage was subsequently uploaded to the television program’s website and social media channels, as well as to the Mediaset Infinity platform, and requested the erasure of all improperly used images; RECITAL that the complainant specifically pointed out that: following a cease-and-desist letter sent on XX to both the broadcaster and the program’s editorial staff regarding the use of his image, the company’s attorneys argued that it was a lighthearted parody permitted by the right to satire and the laws that protect it; in response to this, the complainant noted that the broadcaster’s conduct went beyond the proper exercise of the right to satire, especially given that a great many people believed the videos—produced by Striscia la Notizia and disseminated on television and social media—were real; R.T.I., despite having justified its actions, proceeded to gradually remove the published videos from social media; however, it uploaded the episodes of the program to the Striscia la Notizia website via links different from those indicated by the defense attorneys in the cease-and-desist letter; The dissemination of the videos, in addition to constituting an unlawful commercial exploitation of the plaintiff’s image, violates the proper processing of personal data and, for all intents and purposes, constitutes the offenses of unlawful data processing, impersonation, as well as defamatory conduct aggravated by the medium used and the attribution of specific facts; Neither the indication on the Striscia la Notizia website that the published image is a deepfake nor the occasional mention of this fact during the broadcast constitutes a sufficient measure to legitimize the distorted use of the plaintiff’s image; the message acknowledging the use of the deepfake published on the website can be effective only for an attentive and well-informed viewer who understands how it works, bearing in mind that there are also viewers who happen to be watching the segment after it has already begun; the disputed content was further disseminated through the publication of excerpts on the program’s social media channels, which were subsequently removed following the cease-and-desist notice, but in most of these clips, there is no indication of the use of artificial intelligence or deepfake technology, leaving it up to the User to recognize the use of such technology; the comments posted by many users in response to the posts on the program’s social media channels—“stupid,” “ignorant,” “drunk,” “clown,” “sourpuss,” “coward” —reveal that many people are convinced the statements are authentic, thereby causing a very serious injury to the individual’s honor, reputation, and professional standing; the “new segment” created by Striscia la Notizia, in addition to exploiting the representative’s image for commercial and ratings purposes while labeling it as satire, “spreads rampant misinformation, as numerous web users can view the video without the rules of engagement being clarified, with effects that are severely damaging to the writer’s honor and reputation”; the deepfake was used to create “entertainment” and spread misinformation, thereby infringing upon the writer’s rights as well as the collective right to information; in this specific case, the publisher cannot even invoke the exemptions provided for the processing of data in a journalistic context, where the data subject’s consent is not required provided that the data is collected lawfully and the dissemination complies with the principle of the essential nature of the information regarding matters of public interest; The publisher, in fact, claimed to have created a “playful parody,” when in reality it went far beyond that, considering that satire is the “symbolic representation of reality expressed through paradox” and that, to qualify as such, it would have had to be inspired by a news story in which he himself is the protagonist, whereas in the case at hand, a digital forgery depicting him in his capacity as News Director was used to “break news” by disseminating ideas and thoughts he does not share; there is no informational need associated with the use of his image; rather, it is being used for obvious commercial purposes, infringing upon his rights and also violating the provisions of Art. 97 of the Copyright Law; HAVING REGARD TO the request for information dated March 28, 2025, by which the Authority, pursuant to Article 157 of the Code, asked R.T.I. – Reti Televisive Italiane S.p.A. to provide comments regarding the content of the complaint; HAVING REGARD TO the letter dated April 17, 2025, in which the broadcasting company, represented by lawyers XX, XX, XX, and XX, stated that: all audiovisual clips that are the subject of the complaint were licensed to R.T.I. by LA7, pursuant to a valid contract signed between the parties on March 9, 2021, and subsequently extended; LA7 itself, pursuant to the contract, holds the image rights of the complainant —who, until proven otherwise, has assigned said rights, including the right to exploit them, to his publisher—and has never refused consent to the use of the audiovisual clips by claiming the existence of “rights of a third party that prevent the granting of the requested license”; Furthermore, by virtue of that contract, LA7 was aware that the licensed audiovisual clips would be broadcast as part of the program Striscia La Notizia; R.T.I. provided a timely report regarding the use of the broadcast audiovisual clips, in response to which no objection was raised regarding unlawful and/or unauthorized use; the only action taken by R.T.I. was to have Dr. Mentana’s voice in the aforementioned footage dubbed with a different voice using specialized software; the purpose of the segments that are the subject of the complaint is to exercise the right to satire by imitating the complainant, with the sole difference that in this case, in light of technological advancements, the dubbing was performed using computer systems without the use of a human voice actor; R.T.I. removed the contested content and subsequently re-uploaded it to the webpage of the television program “Striscia la Notizia” and on the “Mediaset Infinity” platform for the sole purpose of further informing viewers, with additional disclaimers, that the broadcast videos contained artificial intelligence effects, specifically with regard to voice alteration; the company “could very well have omitted these additional warnings, having already made it clear to the public from the outset that it was certainly not the ‘real’ Enrico Mentana speaking” by publishing—as soon as the segments subject to the complaint were aired—a disclaimer regarding the use of artificial intelligence technologies, and by also including clear explanatory notes beneath each of the videos posted on the program’s official website to make it evident that they were deepfakes; in full compliance with the principle of transparency and applicable regulations, the satirical program’s announcement has also consistently highlighted, in a clear and explicit manner, that it was a deepfake, as shown in the image attached by way of example; As for the Mediaset Infinity platform, however, in addition to the indication in the title, the logos for “Striscia” and “Canale 5” are displayed and “an extremely explanatory on-screen caption directly on the video, which scrolls as an overlay, further clarifying that the person depicted is in no way the real Dr. Mentana”; on the Mediaset Infinity portal, all videos subject to the complaint include clear indications that they are deepfakes; Deepfakes, based on the provisions of the European Regulation on Artificial Intelligence, do not, in and of themselves, constitute a prohibited practice, although specific disclosure obligations apply to creators of this type of content in order to inform users that the content has been manipulated, specifying that these obligations are reduced when the content is part of a work or program that is clearly artistic, creative, satirical, or fictional; R.T.I., in order to ensure maximum transparency in the information conveyed to the viewing public, has consistently complied with this disclosure obligation and even strengthened it, despite a regulatory framework that did not require it to do so, particularly given that the regulatory obligation will not take effect until August 2, 2026; the expressions contained within the videos—which were present even before the improvements implemented by the publisher, as compared to the basic ones already in place but sufficient for the purpose—would be sufficient to inform the viewing public that these are videos that have nothing to do with Dr. Mentana; expressions are used—which, incidentally, are cited in the complaint itself—such as “the director of the LA7 news program in a deepfake version” and “viewers of the satirical news program”; “Mentana-deepfake”—which, together with the program’s well-known characteristics, make the satirical nature of the content clear; the videos in question are likely to raise doubts in the mind of any viewer, even the most inattentive, to suspect the reliability of the broadcast content, immediately recognizing its true nature both due to the simultaneous presence of the La7 and Striscia la Notizia logos and in light of the hyperbolic and exaggerated statements made by Dr. Mentana’s avatar; Furthermore, the two programs were aired almost simultaneously; Everyone is familiar with the complainant’s professionalism and expertise, and—given that such tactics have long been used against other public figures—it is believed that no one could have genuinely thought they were watching the real Enrico Mentana, as is also evident from an examination of various User comments regarding the published posts; the exceptions and exemptions provided for by the legislation on the processing of personal data—with regard to processing carried out within the scope of freedom of expression—apply not only to the right to report news, as invoked by the complainant, but also to other forms of expression, such as the right to satire, the exercise of which does not require consent if properly exercised, as was the case here; satire, moreover, has much broader limits not only compared to the right to report news but also to the right to criticize, as it is characterized by paradox and provocation, transforming the seriousness of news reporting and criticism into mockery; for this reason, it is exempt from the obligation to report true facts, as by definition it is characterized by implausibility and hyperbole; “Striscia la Notizia” is not a news program or a documentary, but a notoriously sarcastic show focused on social commentary and satire, and anyone who watches its episodes is aware that it is a satirical news program; for this reason, it could not have escaped anyone’s notice that the Mentana featured in the segments that aired was not the real one, as also confirmed by consistent case law of the Court of Cassation, according to which “satire—an expression of the right to criticize through the exaggeration and distortion of reality —is exempt from the requirement of truth, in that it expresses an ironic judgment on a fact through implausibility and hyperbole, as well as through the use of expressions or images that are damaging to another’s reputation” (Civil Court of Cassation, Section III, Order No. 6960, March 14, 2024); technological advancements also allow artistic expression to evolve; in fact, before the advent of artificial intelligence, the caricatured imitation of a well-known figure required the skilled transformative abilities of an actor and/or a look-alike, whereas now these are no longer necessary to exercise the right to satire; the proof that this constitutes parody and satire lies in the history of the program, which was the first in Italy to use deepfakes for satirical purposes, employing various techniques as early as 2019 “featuring figures such as XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, etc.,” none of whom has ever complained; with regard to the alleged violation of the right to one’s image under Art. 10 of the Civil Code, this matter falls outside the Authority’s jurisdiction; furthermore, one must also consider the provisions of Art 97 of the Copyright Law, which does not require the consent of the person depicted for the dissemination of their image in a number of specific cases, among which the right to satire must certainly be included; HAVING REGARD TO the letter dated April 22, 2025, in which the data subject, in response to the reply provided by the controller, stated the following: the controller asserted—though without providing a copy—the existence of a contract between the company itself and the television network broadcasting the news program directed by the controller, which would govern the non-exclusive right to use audiovisual clips extracted from the “La7 library” and to which he is not a party; This is evidently a standard contract for the transfer of video footage that typically governs the relationships between various television broadcasters when they use clips from others’ programs; however, it should be noted that while La7 may certainly transfer audiovisual clips from its own television programs to other broadcasters, it certainly cannot “authorize” their modification to the detriment of the subjects featured in them; R.T.I. has, in fact, released a video clip that is quite different from the original, modifying the original footage using artificial intelligence; contrary to RTI’s claims, a great many users believed that “Striscia la Notizia” had used authentic footage from TG La7, to the extent that a large number of users asked TG La7 to account for the statements it appeared to have made and that were reported by the program; the result of the program’s editing appears as a sort of “blob” that compiles audio and video clips from previously aired TV programs—often featuring mistakes made by television personalities that are replayed—thereby making it extremely difficult for viewers to distinguish reality from fiction; if the fake created by Striscia la Notizia had been so blatant, there would have been no reason for the broadcaster to include—following the cease-and-desist letter he sent and for each clip—additional information about the technique used, given that, prior to that moment, the program’s social media profiles were full of videos that contained no indication whatsoever that they were deepfakes; the term “deepfake” is not a commonly used term known to the general public, nor is the program a platform dedicated exclusively to deepfakes, as it primarily publishes real images and news reports that are anything but false; in this specific case, neither the right to report news nor the right to satire can be invoked, since the Director of TG LA7 is not the protagonist of news events that are depicted in a grotesque manner, but rather his image is used to present news events, new and/or events that never occurred, in which he is, for all intents and purposes, not a participant; according to “the most recent judicial rulings,” satire is the symbolic representation of reality expressed through paradox, caricature, and surreal metaphor, an expression of the right to criticism through the exaggeration and distortion of reality; it is the ironic representation of an event, which, to be legitimate, must be subject to the limits of restraint and the appropriateness of the expressions used in relation to the pursued goal of social criticism”; the Supreme Court of Cassation has affirmed that in the formulation of critical judgment—and all the more so in satirical expression—expressions of any kind may be used, even those that are harmful to the reputation of others, provided they are instrumentally linked to the expression of a reasoned dissent regarding thetargeted opinion or behavior and do not amount to a gratuitous and destructive attack on the honor and reputation of the data subject (Supreme Court, Section 1, March 20, 2018, No. 6919; Court of Cassation, Section 6-3, Sept. 17, 2013, No. 21235; Court of Cassation, Section 3, Nov. 28, 2008, No. 28411; Court of Cassation, Section 3, Nov. 8, 2007, No. 23314; Court of Cassation, Section 3, May 29, 1996, No. 4993); he is not the subject of the news items that are the target of “satire,” but rather the person chosen by the program’s editorial staff to present selected and fabricated news items “that boil down to stupid, vulgar, and embarrassing statements.” In fact, through the contested clips, the program specifically aims to give viewers the impression that they have missed these “crazy” outbursts actually uttered by the Director during TGLA7”; the bounds of legitimate criticism and satire have been vastly exceeded, as there is neither restraint nor public interest, and his image has been created for purely speculative purposes—namely, the creation of a segment hosted by an “avatar” identical to him, exploiting his popularity; he never consented to the use of his image and voice on “Striscia la Notizia,” which took control of them to disseminate ideas and thoughts he does not share, thereby infringing not only on his privacy but also on his reputation and good name; R.T.I. also focuses on technological advancements and the fact that today impersonators can be replaced by artificial intelligence, failing to realize the gravity of the statements made because, no matter how skilled an impersonator may be, they do not use stolen images or appropriate the personal data of the person being portrayed—and distort them—but rather adopt the most distinctive characteristics of the person being imitated, “mimicking their facial features, voice, and mannerisms”; the “deepfake” technique uses artificial intelligence to create images, audio, and video, and the adjective “fake” refers precisely to the purpose attributed to this content—namely, to mislead those who view it, making the image entirely believable to the eyes and ears of Users; Deepfakes are not prohibited in an absolute sense, but their malicious use for purely speculative and defamatory purposes cannot be considered lawful; in the case at hand, there was also a violation of the right of publicity, given that a public figure’s fame does not, by itself, justify the indiscriminate use of their image; HAVING REGARD TO the Office’s notice of September 22, 2025, pursuant to Art. Pursuant to Article 166, paragraph 5, of the Code, the controller was notified of the initiation of proceedings for the possible adoption of the measures referred to in Article 58, para 2, of the Regulation, noting the alleged violation of Articles 5, para 1, subparagraphs (a), (b) and (c), 6, and 25 of the Regulation, as well as Article 137 of the Code; HAVING REGARD TO the defense brief dated October 22, 2025, in which the publishing company, while fully reiterating the content of its previous brief and also requesting a hearing before the Authority, specified that: the company had, from the very beginning, made it clear to Users that the disputed videos were not the work of the “real” Enrico Mentana, accompanying “both the titles of the program Striscia la Notizia and the individual segments aired with all necessary informational warnings, even though there was no such requirement, especially given that it is well known that the television program in question is purely satirical, as has also been recognized on multiple occasions by case law,” and that the disclosure requirement set forth in EU Regulation 2024/1689 (AI Act) will take effect on August 2, 2026; even before the complainant’s cease-and-desist letter dated XX, the company issued a Press Release to warn the viewing public that the episode airing on XX would feature a satirical deepfake of Dr. Mentana—which was widely circulated in all major news outlets and beyond, making the news public knowledge in a way that did not in any way give rise to “false expectations” – and, ever since the broadcast of the segments subject to the complaint, has published a disclaimer regarding the use of artificial intelligence technologies, as well as clear explanatory notes in the title and below each video posted on the program’s official website, in order to make it absolutely clear that the videos broadcast were deepfakes; finally, even in the promotional spot for the satirical program, RTI clearly stated the presence of deepfakes; With regard to the Mediaset Infinity platform, however, in addition to the indication in the title, both the “Striscia” and “Canale 5” logos are present, as well as an extremely explanatory on-screen caption that scrolls as an overlay directly within the video, further clarifying that the person depicted is not the real Dr. Mentana; it should also be noted that La7’s news program and Striscia la Notizia’s satirical news program are broadcast simultaneously, and it would therefore be impossible for Dr. Mentana to appear live on two different television channels at the same time; Numerous national press articles published prior to the cease-and-desist letter sent by the complainant, referring to specific episodes of the program, made it clear that it was not the “real Mentana” speaking, but rather his deepfake version, just as “nearly all users—including those on social media—have reiterated that the published videos are created for satirical purposes,” attaching some as examples; on the other hand, there are cases—also reported in the news—where deepfakes are used for illegal purposes (such as fraud), one of which actually involved Dr. Mentana himself; In such cases, “the seriousness of the statements made and their actual resemblance to real news, as well as the inability to verify the source (unlike in the case at hand, where the videos were broadcast by ‘Striscia la Notizia,’ a news program known for its satirical nature), can indeed instill in the viewing public a reasonable doubt as to whether the individuals depicted are real or fictional, to the extent that they may fall victim to scams resulting in financial losses and the disclosure of personal data to criminals”; R.T.I. has been and remains among the first companies in Italy to have undertaken, for over two years now, collaborations with the Postal Police, as well as taking action before judicial and administrative authorities to combat the phenomenon of illegal deepfakes, and has also been conducting awareness-raising activities on the subject through the satirical program “Striscia la Notizia” since 2020; the footage from the news program directed by the complainant was purchased by La7 S.p.A., which issued a proper invoice following receipt of payment, after the company provided a report detailing the use of the footage, specifying the manner in which it was used, and that “no objection of any kind has ever been raised by the licensing company (nor are there any known actions taken by Mr. Mentana against La7, another rather significant aspect)”; the exceptions to the general rules—which Art 85 of the Regulation provides may be introduced by the legislation of Member States with regard to data processing carried out for journalistic purposes—also apply to forms of expression other than the right to report news, including the right to satire, Therefore, when the latter is exercised, one may disregard both consent and the other legal bases set forth in Article 6 of the Regulation itself; the use of deepfakes for this purpose, which is lawful in and of itself, cannot therefore constitute unlawful data processing; “Satire is exempt from the requirement of factual accuracy, provided that the implausibility and hyperbole—as in the present case—are immediately apparent to the public”; the only action taken was to “dub Dr. Mentana’s voice with a voice other than his own, using computer systems, on video footage that he acquired under license and for which he paid in full”; the sole purpose of the complaints in question is to exercise the right to satire through imitation, with the sole difference that in this case, in light of technological advancements, the dubbing was carried out using computer systems, without resorting to the voice of a voice actor; with regard to the alleged violation of Article 25 of the Regulations, it is clarified that “the viewing audience had, from the very beginning, all the necessary information to understand that the published videos did not feature the real Mentana, but only a deepfake of him”; the negative comments from online users posted by the complainant to support his claims—in addition to being fewer in number than others from which one can infer an awareness that this is not the real editor-in-chief of TGLa7— “are clearly the work of users who, accustomed to posting comments with extreme ease, do not pay much attention to the actual substance of the published content”; It does not seem plausible that, given the audience of Striscia la Notizia—which is well aware of the program’s primarily satirical nature and the notoriety of its creators—anyone could have genuinely doubted that this was not the “real” Mentana; such a circumstance might perhaps have arisen had the footage been used in other contexts, such as TG1 or TG5, but not within the context of “a program that everyone knows is characterized by sarcasm, satire, and hyperbole”; nor is it clear what harm could have been caused to the data subject in question, given his notoriety and his indisputable status as a “public figure,” by virtue of which it is reasonable to assume that the complainant expects his personal data to be used for satirical purposes; Finally, regarding the alleged violation of Article 137 of the Code—specifically concerning the principle of the essential nature of information—the news reported in a satirical manner by the deepfake of Dr. Mentana “draw inspiration from actual news events or issues of public interest and current affairs, and are then transformed—as satire requires—into hyperbolic statements which, while respecting the principle of measured reporting, can never be taken as true”; in light of this clarification, R.T.I. cannot be held liable for violating the aforementioned provision; HAVING REGARD TO the minutes of the hearing held on February 27, 2026, in which the broadcasting company reiterated certain defensive arguments, clarifying that the right to satire does not apply solely to the subject, but also through the character itself, and that the program made the use of artificial intelligence systems for such purposes widely known, both through a press conference presenting the program for the year XX and through specific disclaimers included during the presentation of segments containing the deepfake of Enrico Mentana; the owner also reiterated that the images used were not obtained through web scraping but were acquired for a fee from La7 S.p.A., also noting the awareness-raising efforts undertaken regarding the malicious use of deepfakes; RECITAL that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, shall be liable pursuant to Art. 168 of the Code, “False statements to the Data Protection Authority and obstruction of the Authority’s duties or powers”; Recital 1 states that the data processing covered by this provision must be regarded as falling within the scope of activities carried out in the exercise of freedom of expression and that, therefore, Articles 136–139 of the Code, relating to data processing in the context of journalistic activity and other forms of expression of thought, apply to it, which also includes the right to satire; NOTING that—as the Authority has repeatedly maintained—in order to balance individual rights (in particular the right to confidentiality) with the freedom of expression, data protection regulations provide for specific safeguards and precautions in the case of processing carried outthe context of freedom of expression, confirming the lawfulness of such processing even where it takes place without the consent of the data subjects, provided that it is carried out in a manner that respects the rights, fundamental freedoms, and dignity of the individuals to whom the processed data relate (see Articles 136 et seq. and Article 102, paragraph 2, subparagraph (a), of the Code); NOTING that: the complaint filed by the data subject concerns the use—deemed improper—of his professional image as a journalist for the purpose of introducing, during certain episodes of the program “Striscia la Notizia,” segments based on events involving various public figures, accompanied by various comments delivered by a deepfake of the complainant, dubbed using artificial intelligence systems; in the case in question, the complainant’s actual image was used—filmed, moreover, inside the television studio from which he hosts an evening newscast—and its authenticity was altered through dubbing carried out using tools that did not make the existence of said alteration clearly perceptible; Furthermore, the statements attributed to the complainant—which relate to the news events covered in the individual reports—appear, at first glance, truthful, as they are not characterized—contrary to what the controller has claimed—by a degree of exaggeration sufficient to make it evident that they are “false”; it is also necessary to consider the “real” context in which the data subject operates in his capacity as a professional journalist—namely, the studio from which the news program he directs is broadcast daily—a circumstance that makes the processing particularly insidious with regard to his personal identity, further amplifying the risk of turning it into a vehicle for misinformation to the public, as confirmed by the numerous messages of mockery and/or insults received by the complainant via social media; such use of the data subject’s information does not appear to comply with the principle of fairness enshrined in the European General Data Protection Regulation, pursuant to which controllers are required to take into account, when designing the processing of personal data, the risk of harm that such processing—or the methods chosen to carry it out—may cause to the data subject, particularly in light of the impact that, as in the present case, this may have on the users of the service; In addition to the above observations, it must be considered that the processing carried out with the characteristics described—which, in and of themselves, are sufficient to make the broadcast content appear authentic—is not accompanied by sufficiently clear disclaimers, at least with regard to the technological knowledge of an average or, in any case, inattentive audience; the contextual data, together with the content spoken by the deepfake of a well-known journalist, would in fact have required the use of more explicit communications, making them more prominent at various points during the broadcast of the reports so as to reach even the least attentive Users or those who had tuned in after the program had already begun; CONSIDERING, in light of the foregoing, that the processing described constitutes a violation of the principles of lawfulness, fairness, and transparency in data processing set forth in Article 5 of the Regulation, as well as Article 25 concerning data protection by design and by default, in relation to the failure to adopt adequate technical and organizational measures aimed at effectively implementing the general principles of data protection and safeguarding the rights of data subjects; HAVING DETERMINED that it is necessary to order R.T.I. Reti Televisive Italiane S.p.A., pursuant to Art. 58(2)(f) of the Regulation, to cease further processing of the complainant’s data in the manner described above, except for the mere storage of such data for the purpose of their possible use in legal proceedings; NOTING that, in the event of non-compliance with the prohibition on processing ordered by the Data Protection Authority, the criminal penalty provided for in Art. 170 of the Code may apply, in addition to the administrative penalty provided for in Art. 83(5)(e) of the Regulation; CONSIDERING, with respect to the established violations—given that this is a legal issue characterized by novelty, arising from the application of recently introduced technological tools whose scope, particularly with regard to their use within entertainment programs and thus attributable to artistic expression—it is necessary to consider proportionate, pursuant to Article 58(2)(b) of the Regulation, the measure of issuing a warning to the controller for failure to comply with the provisions governing data processing, with particular regard to the measures to be adopted to ensure compliance with the general principles of lawfulness, fairness, and transparency; CONSIDERING that the conditions are met to make an entry in the Authority’s internal register referred to in Art. 57(1)(u) of the Regulation, regarding the measures adopted in this case against R.T.I. Reti Televisive Italiane S.p.A., in accordance with Article 58(2) of the same Regulation; HAVING CONSIDERED the documentation on file; HAVING CONSIDERED the observations submitted pursuant to Article 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Ginevra Cerrina Feroni; NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Art. 57, para 1, subparagraph (f), of the Regulation; a) pursuant to Article 58, para 2, subparagraph f) of the Regulation, hereby prohibits any further processing of the complainant’s data in the manner described above, except for the mere storage of such data for the purpose of their possible use in legal proceedings; b) pursuant to Article 58(2)(b) of the Regulation, orders, with regard to the violations ascertained during the proceedings, that a warning be issued to R.T.I. Reti Televisive Italiane S.p.A. for failure to comply with the provisions governing data processing, with particular regard to the measures to be adopted to ensure compliance with the general principles of lawfulness, fairness, and transparency; c) Pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the Authority orders that the measures adopted against R.T.I. Reti Televisive Italiane S.p.A. in accordance with Article 58(2) of the same Regulation. The Data Protection Authority requests, pursuant to Article 157 of the Code and Article 58(1)(a) of the Regulation, R.T.I. Reti Televisive Italiane S.p.A. to report, within thirty days of the date of receipt of this order, on the measures taken to fully implement the provisions set forth herein. Please note that failure to comply with the above request is punishable by the administrative penalty provided for in Art. 166 of the Code and Art. 83(5)(e) of Regulation (EU) 2016/679. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an objection to this decision may be filed with the ordinary courts, by filing an appeal, either with the court of the place where the controller resides or has its registered office, or with the court of the data subject’s place of residence, within thirty days from the date of notification of this decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori SEE ALSO Press Release of August 7, 2026 [Web Doc. No. 10281021] Decision of July 23, 2026 Register of Decisions No. 577 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed with the Data Protection Authority, pursuant to Art. 77 of the Regulation, on XX, in which Mr. Enrico Ettore Mentana, represented by lawyers XX and XX, alleged the unauthorized use of his image by R.T.I. - Reti Televisive Italiane S.p.A., in its capacity as producer of the program “Striscia la Notizia,” which, beginning on XX, unlawfully reproduced the aforementioned image through the use of artificial intelligence systems in order to create “reports” – detailed in the complaint – in which he “appears as an (unwitting) protagonist and is depicted in his role as News Director of La7 (…) to perform a script written by the authors of the Mediaset television program, while also displaying the La7 News logo to make the staging appear even more credible”; he also noted that the full video footage was subsequently uploaded to the television program’s website and social media channels, as well as to the Mediaset Infinity platform, and requested the erasure of all improperly used images; Recital 2: The complainant specifically pointed out that: following a cease-and-desist letter sent on XX to both the broadcaster and the program’s editorial staff regarding the use of his image, the company’s attorneys argued that it was a lighthearted parody permitted by the right to satire and the laws that guarantee it; in response to this, the complainant noted that the broadcaster’s conduct went beyond the proper exercise of the right to satire, especially given that a great many people believed the videos—produced by Striscia la Notizia and disseminated on television and social media—were real; R.T.I., despite having justified its actions, proceeded to gradually remove the published videos from social media; however, it uploaded the episodes of the program to the Striscia la Notizia website via links different from those indicated by the defense attorneys in the cease-and-desist letter; The dissemination of the videos, in addition to constituting an unlawful commercial exploitation of the plaintiff’s image, constitutes a data breach and, for all intents and purposes, constitutes the offenses of unlawful data processing, impersonation, as well as defamatory conduct aggravated by the medium used and the attribution of specific facts; Neither the indication on the Striscia la Notizia website that the published image is a deepfake nor the occasional mention of this fact during the broadcast constitutes a sufficient measure to legitimize the distorted use of the claimant’s image; the message acknowledging the use of the deepfake published on the website can be effective only for an attentive and well-informed viewer who understands how deepfakes work, bearing in mind that there are also viewers who happen to be watching the segment after it has already begun; the disputed content was further disseminated through the publication of excerpts on the program’s social media channels, which were subsequently removed following the cease-and-desist letter, but in most of these clips, there is no indication of the use of artificial intelligence or deepfake technology, leaving it up to the User to recognize its use. or of that technology; the comments posted by many Users in response to posts on the program’s social media channels—“stupid,” “ignorant,” “drunk,” “clown,” “sourpuss,” “coward” —reveal that many people are convinced the statements are authentic, thereby causing a very serious injury to the individual’s honor, reputation, and professional standing; the “new segment” created by Striscia la Notizia, in addition to exploiting the representative’s image for commercial and ratings purposes while labeling it as satire, “spreads rampant misinformation, as numerous web users can view the video without the rules of engagement being clarified, with effects that are severely damaging to the writer’s honor and reputation”; the deepfake was used to create “entertainment” and spread misinformation, infringing upon the writer’s rights as well as the collective right to information; in this specific case, the publisher cannot even invoke the exceptions provided for the processing of data in a journalistic context, where the data subject’s consent is not required provided that the data is collected lawfully and the dissemination complies with the principle of the essential nature of the information regarding matters of public interest; The publisher, in fact, claimed to have created a “humorous parody,” when in reality it went far beyond that, given that satire is the “symbolic representation of reality expressed through paradox” and that, to qualify as such, it would have had to be inspired by a news story in which the individual in question is the protagonist, whereas in the case at hand, a digital forgery depicting him in his capacity as News Director was used to “break news” by disseminating ideas and thoughts he does not share; there is no informational need associated with the use of his image; rather, it is being used for obvious commercial purposes, infringing upon his rights and also violating the provisions of Art. 97 of the Copyright Law; HAVING REGARD TO the request for information dated March 28, 2025, by which the Authority, pursuant to Article 157 of the Code, asked R.T.I. – Reti Televisive Italiane S.p.A. to provide comments regarding the content of the complaint; HAVING REGARD TO the letter dated April 17, 2025, in which the broadcasting company, represented by lawyers XX, XX, XX, and XX, stated that: all audiovisual clips subject to the complaint were licensed to R.T.I. by LA7, pursuant to an appropriate contract signed between the parties on March 9, 2021, and subsequently extended; LA7 itself, pursuant to the contract, holds the image rights of the complainant —who, until proven otherwise, has assigned said rights, including the right to exploit them, to his publisher—and has never refused consent to the use of the audiovisual clips by claiming the existence of “rights of a third party that prevent the granting of the requested license”; Furthermore, precisely by virtue of that contract, LA7 was aware that the licensed audiovisual clips would be broadcast as part of the program Striscia La Notizia; R.T.I. provided a timely report regarding the use of the broadcast audiovisual clips, in response to which no objection was raised regarding unlawful and/or unauthorized use; the only action taken by R.T.I. was to have Dr. Mentana’s voice in the aforementioned footage dubbed with a voice other than his own, using specialized software; the purpose of the segments that are the subject of the complaint is to exercise the right to satire by imitating the complainant, with the sole difference that in this case, given technological advancements, the dubbing was performed using computer systems without the use of a human voice actor; R.T.I. removed the contested content, then re-uploaded it to the website of the television program “Striscia la Notizia” and on the “Mediaset Infinity” platform for the sole purpose of further informing viewers, with additional disclaimers, that the broadcast videos contained artificial intelligence elements, specifically regarding voice alteration; the company “could very well have omitted these additional warnings, having already made it clear to the public from the outset that it was certainly not the ‘real’ Enrico Mentana speaking” by publishing—as soon as the segments subject to the complaint aired—a disclaimer regarding the use of artificial intelligence technologies, and by including clear explanatory notes beneath each of the videos posted on the program’s official website to make it evident that they were deepfakes; in full compliance with the principle of transparency and applicable regulations, the satirical program’s announcement also consistently highlighted, in a clear and explicit manner, that it was a deepfake, as shown in the image attached by way of example; As for the Mediaset Infinity platform, however, in addition to the indication in the title, the “Striscia” and “Canale 5” logos are displayed and “an extremely explanatory on-screen caption directly on the video, which scrolls as an overlay, further clarifying that the person depicted is in no way the real Dr. Mentana”; on the Mediaset Infinity portal, all videos subject to the complaint include clear indications that they are deepfakes; Deepfakes, based on the provisions of the European Regulation on Artificial Intelligence, do not in and of themselves constitute a prohibited practice, although specific disclosure obligations apply to creators of this type of content in order to inform users that the content has been manipulated, specifying that these obligations are reduced when the content is part of a work or program that is clearly artistic, creative, satirical, or fictional; R.T.I., in order to ensure maximum transparency in the information conveyed to the viewing public, has consistently complied with this disclosure obligation and even strengthened it, despite a regulatory framework that did not require it to do so, particularly given that the regulatory obligation will not take effect until August 2, 2026; the phrases contained within the videos—which were also present prior to the improvements implemented by the broadcaster, as compared to the basic ones already in place but sufficient for the purpose—would be sufficient to inform the viewing public that these videos have nothing to do with Dr. Mentana; expressions are used—which are, moreover, cited in the complaint itself—such as “the director of TG LA7 in a deepfake version”; “viewers of the satirical news program”; “Mentana deepfake”—which, together with the program’s well-known characteristics, make the satirical nature of the content clear; the videos in question are likely to raise to suspect the reliability of the broadcast content, immediately recognizing its true nature—both due to the simultaneous presence of the La7 and Striscia la Notizia logos and in light of the hyperbolic and excessive statements made by Dr. Mentana’s avatar; Furthermore, the two programs aired almost simultaneously; Everyone is familiar with the complainant’s professionalism and expertise, and, given that such tactics have long been used against other public figures as well, it is believed that no one could have genuinely thought they were watching the real Enrico Mentana—as is also evident from an examination of various User comments regarding the published posts; the exceptions and exemptions provided for by the legislation governing the processing of personal data—with regard to processing carried out within the scope of freedom of expression—apply not only to the right to report news, as invoked by the complainant, but also to other forms of expression, such as the right to satire, the exercise of which does not require consent if properly exercised, as was the case here; satire, moreover, has much broader limits not only compared to the right to report news but also to the right to criticize, as it is characterized by paradox and provocation, transforming the seriousness of news reporting and criticism into mockery; for this reason, it is exempt from the obligation to report true facts, since by definition it is characterized by implausibility and hyperbole; “Striscia la Notizia” is not a news program or a documentary, but a notoriously sarcastic show focused on social criticism and satire, and anyone who watches its episodes is aware that it is a satirical news program; for this reason, it could not have escaped anyone’s notice that the Mentana featured in the segments that aired was not the real one, as also confirmed by established case law of the Court of Cassation, according to which “satire—an expression of the right to criticize through the exaggeration and distortion of reality —is exempt from the requirement of truth, in that it expresses an ironic judgment on a fact through implausibility and hyperbole, as well as through the use of expressions or images that are detrimental to another’s reputation” (Civil Court of Cassation, Section III, Order No. 6960, March 14, 2024); technological evolution also allows artistic expression to change; in fact, before artificial intelligence, the caricatured imitation of a well-known figure required the skilled transformative abilities of an actor and/or a look-alike, whereas now these are no longer necessary to exercise the right to satire; the proof that this constitutes parody and satire lies in the history of the program, which was the first in Italy to use deepfakes for satirical purposes, employing various techniques as early as 2019 “featuring figures such as XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, etc.”—none of whom have ever complained; with regard to the alleged violation of the right to one’s image pursuant to Art. 10 c.c., this matter falls outside the Authority’s jurisdiction; furthermore, it is necessary to consider the provisions of Art. 97 of the Copyright Law, which does not require the consent of the person depicted for the dissemination of their image in a number of specific cases, among which the right to satire must certainly be included; HAVING REGARD TO the letter dated April 22, 2025, in which the data subject, in response to the reply provided by the controller, represented the following: the controller asserted—though without providing a copy—the existence of a contract between the company itself and the television network broadcasting the news program directed by the controller, which would govern the non-exclusive right to use audiovisual clips extracted from the “La7 library” and to which he is not a party; This is evidently a standard contract for the transfer of video footage that typically governs relationships between various television stations when they use clips from others’ broadcasts; however, it should be noted that while La7 may certainly transfer audiovisual excerpts from its own television programs to other stations, it certainly cannot “authorize” their modification to the detriment of the individuals featured in them; R.T.I. in fact released footage that was quite different from the original, modifying the original material using artificial intelligence; contrary to RTI’s claims, a great many people believed that “Striscia la Notizia” had used authentic footage from TG La7, to the extent that a large number of Users questioned the program about statements the program appeared to attribute to it; the result of the program’s editing appears as a sort of “blob” that compiles audio and video clips from previously aired TV programs—often featuring mistakes made by TV personalities that are replayed—thereby making it extremely difficult for viewers to distinguish between what is real and what is fabricated; if the fake created by Striscia la Notizia had been so crude, there would have been no reason for the broadcaster to include—following the cease-and-desist letter he sent and for each clip—additional information about the technique used, given that, prior to that moment, the program’s social media profiles were full of videos that contained no indication whatsoever that they were deepfakes; the term “deepfake” is not a commonly used term known to the general public, nor is the program a platform dedicated exclusively to deepfakes, as it primarily publishes real images and news reports that are anything but false; in this specific case, neither the right to report news nor the right to satire can be invoked, since the Director of TG LA7 is not the protagonist of news events that are depicted in a grotesque manner; rather, his image is used to present news events, new and/or events that never occurred, in which he is, for all intents and purposes, not a participant; according to “the most recent judicial rulings,” satire is the symbolic representation of reality expressed through paradox, caricature, and surreal metaphor, an expression of the right to criticism through the exaggeration and distortion of reality; it is the ironic representation of an event, which, to be legitimate, must be subject to the limits of restraint and the appropriateness of the expressions used in relation to the purpose of social criticism being pursued”; the Supreme Court of Cassation has affirmed that in the formulation of critical judgment—and all the more so in satirical expression—expressions of any kind may be used, even those harmful to the reputation of others, provided they are instrumentally linked to the expression of a reasoned dissent regarding thetargeted opinion or behavior and do not amount to a gratuitous and destructive attack on the honor and reputation of the data subject (Supreme Court, Section 1, March 20, 2018, No. 6919; Court of Cassation, Section 6-3, Sept. 17, 2013, No. 21235; Court of Cassation, Section 3, Nov. 28, 2008, No. 28411; Court of Cassation, Section 3, November 8, 2007, No. 23314; Court of Cassation, Section 3, May 29, 1996, No. 4993); he is not the subject of the news items that are the object of “satire,” but rather the person chosen by the program’s editorial staff to present selected and fabricated news items “that amount to stupid, vulgar, and embarrassing statements.” In fact, through the contested clips, the program specifically aims to give viewers the impression that they have missed these “crazy” outbursts actually uttered by the Director during TGLA7”; the bounds of legitimate criticism and satire have been greatly exceeded, as there is neither restraint nor public interest, and his image has been created for purely speculative purposes—namely, the creation of a segment hosted by an “avatar” identical to him, exploiting his popularity; he never gave his consent to the use of his image and voice on “Striscia la Notizia,” which took control of them to disseminate ideas and thoughts he does not share, thereby infringing not only on his privacy but also on his reputation and good name; R.T.I. also focuses on technological advancements and the fact that today impersonators can be replaced by artificial intelligence, failing to realize the gravity of the statements made because, no matter how skilled an impersonator may be, they do not use stolen images or appropriate the personal data of the person being portrayed—and distort them—but rather adopt the most distinctive characteristics of the person being imitated, “mimicking their features, voice, and mannerisms”; the “deepfake” technique uses artificial intelligence to create images, audio, and video, and the adjective “fake” refers precisely to the purpose attributed to this content—namely, to mislead those who view it, making the image entirely believable to the eyes and ears of Users; Deepfakes are not prohibited in an absolute sense, but their malicious use for purely speculative and defamatory purposes cannot be considered lawful; in the case at hand, there was also a violation of the right of publicity, given that a public figure’s fame does not, by itself, justify the indiscriminate use of their image; HAVING REGARD TO the Office’s notice dated September 22, 2025, by which, pursuant to Article 166, paragraph 5, of the Code, the controller was notified of the initiation of proceedings for the possible adoption of the measures referred to in Article 58, para 2, of the Regulation, noting the alleged violation of Articles 5, para 1, letters a), b), and c), 6, and 25 of the Regulation, as well as Article 137 of the Code; HAVING REGARD TO the defense brief dated October 22, 2025, in which the publishing company, while fully reiterating the content of its previous brief and also requesting a hearing before the Authority, specified that: the company had, from the very beginning, made it clear to Users that the disputed videos were not the work of the “real” Enrico Mentana, by including “all necessary disclaimers in both the titles of the program Striscia la Notizia and the individual segments represented on air, even though this was not required, especially given that it is well known that the television program in question is purely satirical, as has also been recognized on multiple occasions by case law,” and that the disclosure requirement set forth in EU Regulation 2024/1689 (AI Act) will take effect on August 2, 2026; even before the complainant’s cease-and-desist letter dated XX, the company issued a Press Release to warn the viewing public that the episode airing on XX would feature a satirical deepfake of Dr. Mentana—which was widely circulated in all major news outlets and beyond, making the news public knowledge in a way that did not in any way give rise to “false expectations” – and, ever since the broadcast of the segments subject to the complaint, has published a disclaimer regarding the use of artificial intelligence technologies, as well as clear explanatory notes in the title and below each of the videos posted on the program’s official website, in order to make it entirely clear that the videos broadcast were deepfakes; finally, even in the announcement for the satirical program, RTI clearly stated the presence of deepfakes; With regard to the Mediaset Infinity platform, however, in addition to the indication in the title, both the “Striscia” and “Canale 5” logos are displayed, along with an extremely explanatory on-screen caption that scrolls across the video as an overlay, further clarifying that the person depicted is not the real Dr. Mentana; it should also be noted that La7’s news program and Striscia la Notizia’s satirical news program are broadcast simultaneously; therefore, it would not be possible for Dr. Mentana to be live on two different television channels at the same time; Numerous national press articles published prior to the cease-and-desist letter sent by the complainant, referring to specific episodes of the program, made it clear that it was not the “real Mentana” speaking, but rather his deepfake version, just as “virtually all users—including those on social media—have reiterated that the published videos were created for satirical purposes,” providing some as examples; on the other hand, there are cases—also reported in the news—where deepfakes are used for illegal purposes (such as fraud), one of which involved Dr. Mentana himself; In such cases, “the seriousness of the statements made and their actual resemblance to real news, as well as the inability to verify the source (unlike in the case at hand, where the videos were aired by ‘Striscia la Notizia,’ a news program known for its satirical content), can effectively instill in the viewing public a reasonable doubt regarding the real or fictitious identity of the individuals depicted, to the extent that they may fall victim to scams resulting in financial losses and the disclosure of personal data to criminals”; R.T.I. It has been and remains one of the first companies in Italy to have, for over two years now, collaborated with the Postal Police, as well as taken action before judicial and administrative authorities to combat the phenomenon of illegal deepfakes, and has also carried out awareness-raising activities on the issue through the satirical program Striscia La Notizia since 2020; the footage from the news program directed by the complainant was purchased by La7 S.p.A., which issued a proper invoice following receipt of payment, after the company had provided a report detailing the use of the footage, specifying the manner in which it was used, and that “no objection of any kind has ever been raised by the licensing company (nor are there any known actions taken by Mr. Mentana against La7, another rather significant aspect)”; the exceptions to the general rules—which Art 85 of the Regulation provides may be introduced by the legislation of Member States with regard to data processing carried out for journalistic purposes—also apply to forms of expression other than the right to report news, including the right to satire, therefore, when the latter is exercised, one may disregard both consent and the other legal bases referred to in Article 6 of the Regulation itself; the use of deepfakes for this purpose, which is lawful in and of itself, cannot therefore constitute unlawful data processing; “Satire is exempt from the requirement of factual accuracy, provided that the implausibility and hyperbole—as in the present case—are immediately perceptible to the public”; the only action taken was to “dub Dr. Mentana’s voice with a voice other than his own, using computer systems, on video footage that he acquired under license and for which he paid in full”; the sole purpose of the segments subject to the complaint is to exercise the right to satire through imitation, with the sole difference that in this case, in light of technological advancements, the dubbing was carried out using computer systems, without resorting to the voice of a voice actor; with regard to the alleged violation of Article 25 of the Regulations, it is clarified that “the viewing audience had access from the very beginning to all the information necessary to understand that the published videos did not feature the real Mentana, but only a deepfake of him”; the negative comments from online users posted by the complainant to support his claims—in addition to being fewer in number than others that suggest awareness that this is not the real editor-in-chief of TGLa7— “are clearly the work of users who, accustomed to posting comments very readily, do not pay much attention to the actual substance of the published content”; It does not seem plausible that, given the audience of Striscia la Notizia—which is well aware of the program’s primarily satirical nature and the notoriety of its creators—anyone could have genuinely doubted that this was not the “real” Mentana; such a circumstance might perhaps have arisen had the footage been used in other contexts, such as TG1 or TG5, but not within the context of “a program that everyone knows is characterized by sarcasm, satire, and hyperbole”; nor is it clear what harm could have been caused to the data subject in question, given his notoriety and his indisputable status as a “public figure,” by virtue of which it is reasonable to assume that the complainant expects his personal data to be used for satirical purposes; Finally, regarding the alleged violation of Article 137 of the Code, with particular reference to the principle of the essential nature of information, the news reported in a satirical manner by Dr. Mentana’s deepfake “draw inspiration from actual news events or issues of public interest and current affairs, and are then transformed—as satire requires—into hyperbolic statements which, while respecting the principle of moderation in reporting, can never be taken as true”; in light of this clarification, R.T.I. cannot be held liable for violating the aforementioned provision; HAVING REGARD TO the minutes of the hearing held on February 27, 2026, during which the broadcasting company reiterated certain defensive arguments, clarifying that the right to satire does not apply solely to the subject of the satire, but also through the character itself, and that the program had widely publicized the use of artificial intelligence systems for these purposes, both through a press conference presenting the program for the year XX and through specific disclaimers included during the presentation of segments containing the deepfake of Enrico Mentana; the owner also reiterated that the images used were not obtained through web scraping but were acquired for a fee from La7 S.p.A., while also noting the awareness-raising efforts undertaken regarding the malicious use of deepfakes; RECITAL that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, shall be liable pursuant to Art. 168 of the Code, “False statements to the Data Protection Authority and obstruction of the Authority’s duties or powers”; CONSIDERING that the data processing addressed in this order must be classified as falling within the exercise of freedom of expression and that, therefore, Articles 136–139 of the Code—relating to data processing in the context of journalistic activity and other forms of expression—apply to it, which also includes the right to satire; NOTING that—as the Authority has repeatedly maintained—in order to balance the rights of the individual (in particular, the right to confidentiality) with the freedom of expression, the regulations governing data protection provide for specific safeguards and precautions in cases of processing carried out within the scope of freedom of expression, confirming the lawfulness of such processing, even where such processing takes place without the consent of the data subjects, provided that it is carried out in compliance with the rights, fundamental freedoms, and dignity of the individuals to whom the processed data relate (see Articles 136 et seq. and Article 102, paragraph 2, subparagraph a), of the Code); NOTING that: the complaint filed by the data subject concerns the alleged improper use of his professional image as a journalist to introduce, during certain episodes of the program “Striscia la Notizia,” segments based on events involving various public figures, accompanied by various comments delivered by a deepfake of the complainant dubbed using artificial intelligence systems; in the case in question, the complainant’s actual image was used—filmed, moreover, inside the television studio from which he hosts an evening newscast—and its authenticity was altered through dubbing carried out using tools that made the existence of said alteration not clearly perceptible; Furthermore, the statements attributed to the complainant—which refer to the news events covered in the individual reports—appear, at first glance, truthful, as they are not characterized—contrary to what the controller has asserted—by an instance of exaggeration that is sufficient to make it evident that they are “false”; it is also necessary to consider the “real” context in which the data subject operates in his capacity as a professional journalist—namely, the studio from which the news program he directs is broadcast daily—a circumstance that makes the processing particularly insidious with regard to his personal identity, further amplifying the risk of turning it into a vehicle for disinformation aimed at the public, as confirmed by the numerous messages of mockery and/or insults received by the complainant via social media; such use of the data subject’s information does not appear to comply with the principle of fairness enshrined in the European General Data Protection Regulation, pursuant to which controllers are required to take into account, when designing the processing of personal data, the risk of harm that such processing—or the methods chosen to carry it out—may cause to the data subject, particularly in light of the impact that, as in the present case, this may have on the users of the service; In addition to the above observations, it must be considered that the processing carried out with the characteristics described—which, in and of themselves, are sufficient to make the broadcast services appear truthful—is not accompanied by sufficiently clear disclaimers, at least with regard to the technological knowledge of an average or, in any case, inattentive audience; the contextual data, together with the content spoken by the deepfake of a well-known journalist, would in fact have required the use of more explicit communications, making them more prominent at various points during the broadcast of the reports so as to reach even the least attentive Users or those who had tuned in after the program had already begun; CONSIDERING, in light of the foregoing, that the processing described constitutes a violation of the principles of lawfulness, fairness, and transparency in data processing set forth in Article 5 of the Regulation, as well as Art 25 concerning data protection by design and by default, in relation to the failure to adopt adequate technical and organizational measures aimed at effectively implementing the general principles of data protection and safeguarding the rights of data subjects; CONSIDERING that it is necessary to issue an order against R.T.I. Reti Televisive Italiane S.p.A., pursuant to Article 58, para 2, subparagraph (f) of the Regulation, the prohibition on further processing of the complainant’s data in the manner described above, except for the mere storage of such data for the purpose of their possible use in legal proceedings; NOTING that, in the event of non-compliance with the prohibition on processing ordered by the Data Protection Authority, the criminal penalty provided for in Art. 170 of the Code may apply, in addition to the administrative penalty provided for in Art. 83, para. 5, subparagraph e), of the Regulation; CONSIDERING, with respect to the established violations—given that this is a novel legal issue arising from the application of recently introduced technological tools whose scope, particularly with regard to their use within entertainment programs and thus attributable to artistic expression—it must be considered proportionate, pursuant to Article 58, para 2, subparagraph b) of the Regulation, the warning to be issued to the controller for failure to comply with the provisions governing data processing, with particular regard to the measures to be adopted to ensure compliance with the general principles of lawfulness, fairness, and transparency; CONSIDERING that the conditions are met to make an entry in the Authority’s internal register referred to in Art. 57(1)(u) of the Regulation, regarding the measures adopted in this case against R.T.I. Reti Televisive Italiane S.p.A., in accordance with Article 58(2) of the same Regulation; HAVING CONSIDERED the documentation on file; HAVING CONSIDERED the observations submitted pursuant to Article 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Ginevra Cerrina Feroni; NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Art. 57, para 1, letter f), of the Regulation; a) pursuant to Article 58(2)(f) of the Regulation, orders that the complainant’s data may no longer be processed in the manner described above, except for the mere storage of such data for the purpose of their possible use in legal proceedings; b) pursuant to Article 58(2)(b) of the Regulation, in light of the violations ascertained during the proceedings, issues a warning to R.T.I. Reti Televisive Italiane S.p.A. for failure to comply with the provisions governing data processing, with particular regard to the measures to be adopted to ensure compliance with the general principles of lawfulness, fairness, and transparency; c) Pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the Authority orders that the measures adopted against R.T.I. Reti Televisive Italiane S.p.A., in accordance with Article 58(2) of the same Regulation. The Data Protection Authority requests, pursuant to Article 157 of the Code and Article 58(1)(a) of the Regulation, R.T.I. Reti Televisive Italiane S.p.A. to report, within thirty days of the date of receipt of this order, on the measures taken to fully implement the provisions set forth herein. Please note that failure to comply with the above request is punishable by the administrative sanction provided for in Art. 166 of the Code and Art. 83, para. 5, subparagraph e), of Regulation (EU) 2016/679. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an objection to this order may be filed with the ordinary courts, by filing an appeal, alternatively, with the court of the place where the controller resides or has its registered office, or with the court of the place of residence of the data subject, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori