Italy's data protection authority has attached two conditions to a small regional AI project. They raise a question for every public-sector AI deployment in Europe: what does it mean to delete a person's data once a model has learned from it?
According to the Garante's newsletter of 29 October 2026, on 7 October 2026 it gave a favourable opinion (provvedimento n. 760) on the Autonomous Province of Trento's draft regulation on AI systems supporting administrative activity. The first system covered is the Province's protocol and document-management system. The opinion carries conditions. The essential elements of the processing, including special-category and criminal-conviction data, must rest on legal sources of at least regulatory rank, not only on the technical sheets of individual offices. The Garante also noted that correcting or deleting data at source does not necessarily change an already-trained model. It asked for technical and organisational measures that guarantee effective rectification and erasure rights, whatever AI system or model is used. I could not retrieve the opinion text itself, so this analysis rests on that published summary.
The strongest case for the Garante
The argument for strictness is serious. A public administration processes data that citizens cannot refuse to hand over, and that data can include health, political or criminal-record information. In that setting, a rule buried in an office's technical sheet is not law. The Garante's first condition applies a familiar principle: when the state interferes with rights, the rule should be public, foreseeable and adopted at the right level. Anyone affected can then read and challenge it.
The second condition addresses a real technical gap. GDPR Articles 16 and 17 give people rights to rectification and erasure. If an error is fixed in the source database but the model trained on it keeps the old pattern, the right exists on paper only. The European Data Protection Board took this seriously in Opinion 28/2024, published in December 2024. According to a CMS summary, the Board said anonymity of a model must be assessed case by case. Extracting training personal data must be negligible, and unlawful development can affect later use. Authorities may then order corrective measures, including retraining.
Where the opinion is right
The first condition is sound and cheap to meet. A provincial regulation that names the categories of data, the purposes and the safeguards costs a drafting exercise. In return it gives staff, citizens and courts one stable text. Pro-innovation voices should welcome this. Public AI projects built on clear legal footing are less likely to be suspended halfway through.
The focus on this deployment is also sensible. Document management and protocol systems are routine back-office work with modest risk compared with, say, benefit-eligibility scoring. The Garante approved the project and set conditions. It did not block it. That is the proportionate posture.
Where the standard is still open
The weakness lies in the phrase "effective rectification and erasure, whatever model is used." Machine unlearning is an active research field, not a settled engineering practice. If the standard means a model must never reflect a deleted record, the practical answer is retraining after every request. For a provincial administration that is likely unaffordable, and it may push officials toward not using AI at all. If the standard means a model need not be touched provided outputs cannot reveal the person and the data is purged from training sets, that is achievable. Which reading applies matters a great deal, and the opinion as reported does not settle it.
The Garante's enforcement record shows why vagueness is costly. In December 2024 it fined OpenAI €15 million and ordered a six-month public information campaign, citing the lack of a legal basis for training and failures of transparency. That release now carries a note that the decision was removed from the Garante's site after Tribunale di Roma judgment No. 4153/2026, published on 18 March 2026, upheld OpenAI's opposition. I have not read that judgment and draw no conclusions beyond the note. It does show that disputes over how GDPR applies to model training end up in court, and a regulator's reading is not final. The Garante's earlier temporary limitation of ChatGPT in March 2023 was the first in this line of cases. It also threatened fines of up to €20 million or 4% of worldwide turnover.
Public bodies are a different case from a global model developer. They cannot walk away from an unclear duty, and they have little legal budget. For them, ambiguity leads to paralysis. For vendors, it leads to contracts that load all the risk on the administration.
What would help
- A defined test. The Garante, ideally with the EDPB, should say what evidence shows erasure is effective: output testing, exclusion from future training sets, scheduled retraining intervals, or documented anonymity assessments.
- Proportion to risk. A protocol system sorting correspondence should not face the same erasure burden as a model scoring individuals.
- Procurement terms. Provinces and municipalities should require vendors to show how a deletion request is carried through the model lifecycle, so the duty does not fall on small offices.
- Publication of the conditions. Other Italian regions drafting similar rules will want to know exactly what the Garante required. Prompt publication of the full opinion would speed that learning.
Bottom line
Trento's draft is a good test case: low-risk, well-bounded and public. The Garante has correctly asked for legal grounding and for rights that work in practice. The next step is to define "effective" so a small administration can comply without abandoning useful tools. Rules that are testable protect citizens better than rules that can only be satisfied by not building the system.