After Trento, the Garante scrutinised Rome’s metro and Turin’s “intelligent” cameras. Meanwhile, the Italian moratorium on the use of facial recognition in public places has been extended to 31 December 2027, and the AI Act has set directly applicable prohibitions, from the scraping of facial images to real-time remote biometric identification. The updated map of what cities cannot do.
With the fine against the Municipality of Trento for its “intelligent” surveillance projects (decision of 11 January 2024), the Garante inaugurated a line of oversight set to consolidate. Algorithmic video-surveillance in urban spaces is an open construction site, and it deserves an updated map of the rules — bearing in mind a datum still missed by many operators: the Italian moratorium did not expire at the end of 2025.
The investigations: Rome and Turin
On 9 May 2024 the Authority announced it had “sent a request for information to Roma Capitale on a video-surveillance project in the metro stations”, specifying that the administration had 15 days to provide “a technical description of the facial-recognition functions, the purpose and legal basis of that processing of biometric data, and a copy of the data-protection impact assessment”. On 19 July 2024 it was Turin’s turn: the Garante, “resuming previous exchanges, sent a request for information to the Municipality of Turin on a new video-surveillance system that, according to press reports, would also use Artificial Intelligence”, considering — “given the potential risk that activating such ‘intelligent’ video-surveillance systems could entail for the private life of thousands of citizens” — to ask for every useful element, including “the advanced functions the cameras would be equipped with […] and the purposes and legal basis of the processing”. The Trento-Rome-Turin triptych draws a now stable line of oversight: AI-enhanced urban surveillance is a matter of systematic, not episodic, scrutiny.
The Italian moratorium: extended to 31 December 2027
Domestically, the keystone remains Article 9 of Decree-Law No. 139 of 8 October 2021, converted by Law 205/2021, under which “the installation and use of video-surveillance systems with facial-recognition functions operating through the use of biometric data […] in public places or places open to the public, by public authorities or private entities, are suspended until the entry into force of a legislative discipline of the matter and in any case no later than 31 December 2027”. Here is the datum to fix: the deadline, originally 2023 and then brought to 31 December 2025 by Decree-Law 51/2023, was further extended to 31 December 2027 by Decree-Law No. 200 of 31 December 2025, converted with amendments by Law No. 26 of 27 February 2026. The exceptions provided by law remain, including processing by competent authorities for the prevention and prosecution of offences under the conditions of law, subject to the favourable opinion of the Garante.
The European limits: Article 5 of the AI Act
Onto the domestic moratorium is superimposed, from 2 February 2025, the AI Act’s prohibitions regime. As regards urban spaces, four provisions of Article 5(1) deserve mention: points (e), (f), (g) and (h), relating respectively to facial scraping, emotion recognition, biometric categorisation and “real-time” remote biometric identification. As to scraping, point (e) prohibits “the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial-recognition databases through the untargeted scraping of facial images from the internet or CCTV footage” — a provision that directly touches the information assets generated by urban video-surveillance. As to remote biometric identification, point (h) prohibits “the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary” for one of the listed objectives: the targeted search for victims of abduction, trafficking or sexual exploitation and for missing persons; the prevention of a “specific, substantial and imminent” threat to life or physical safety, or of a terrorist attack; the localisation or identification of suspects of serious offences punishable by a custodial sentence of at least four years. Even in the exceptional cases, use is surrounded by strict procedural conditions and permitted “only to confirm the identity of the specifically targeted person”.
The overall picture for local authorities
The combined effect is severe: until 31 December 2027 the domestic moratorium suspends, in general, the installation and use of facial recognition in public places; the AI Act prohibits certain practices outright and subjects real-time remote biometric identification to an exceptionality regime that does not contemplate the ordinary needs of urban security; and the GDPR continues to require legal basis, impact assessment and effective measures against re-identification, as the Trento affair showed. Anyone designing today a “safe city” based on the biometric analysis of public spaces is, in substance, designing outside the perimeter of the law in force.
Conclusions
The season of carefree experimentation is over: between the extended moratorium, directly applicable European prohibitions and the Garante’s systematic oversight, facial recognition in Italian public spaces is, and will remain at least until 2027, a supervised exception, not an ordinary administrative tool. In the light of the above, one wonders whether the three years separating us from the moratorium’s expiry will be used by the legislator to build that “legislative discipline of the matter” awaited since 2021, defining a transparent balance between urban security and fundamental freedoms, rather than merely deferring the decision once again, so as to preserve public spaces as places of freedom and not of surveillance filing.