Italy's data protection authority has used its opinion on the platform-work decree to make a point that applies well beyond delivery riders: overlapping rules enforced by different regulators can penalise the same conduct twice.
What the Garante said
The Garante per la protezione dei dati personali gave a favourable opinion, with remarks, on the draft legislative decree transposing Directive (EU) 2024/2831 on platform work. This is opinion n. 624, issued at the request of the Presidency of the Council of Ministers. The Garante's own document is dated 16 September 2026. Its 30 September newsletter, and press coverage of it, give 17 September. We use the authority's own document where they differ.
The opinion has two parts. The first is a set of conditions. The Garante wants the ban in Article 6(1)(d) reformulated to track the directive more closely. It wants Article 8 to cross-refer to GDPR Articles 12 to 14 on information duties. It wants Article 9 to clarify what "impact assessment" means and to require that the staff supervising automated systems report directly to the company's top management. It also wants Articles 14 and 19 to state the essential features of the data processing they authorise.
The second part is an observation that goes to enforcement. According to coverage of the opinion, several violations defined in the decree overlap with GDPR obligations the Garante already sanctions. These are the data protection impact assessment, algorithmic transparency, human oversight and security measures. Without a fix, the same conduct could be penalised once by the Ispettorato nazionale del lavoro (INL) and again by the Garante. The Garante proposes either an absorption clause based on specialty and proportionality, or a clause coordinating the two sanction proceedings. It also asks for tighter rules on sharing data with public authorities, covering purposes of access, categories of usable data, the roles of the administrations involved, and limits on reuse.
The case for the decree
The strongest argument for strict platform-work rules is real. Algorithmic management can hire, rank, discipline and deactivate workers with little explanation, and a general data protection law was not written with that employment relationship in mind. The directive responds with a rebuttable presumption of employment, limits on processing sensitive data, and duties to oversee automated systems. Under the EUR-Lex summary, member states must transpose it by 2 December 2026. A Garrigues analysis adds that workers are entitled to a written statement of reasons when an automated system restricts, suspends or terminates their account. A regulator that treated these duties as optional would let platforms keep the accountability gap they have exploited.
Why the double-penalty point matters
The Garante's objection is not an attack on those protections. It is a point about regulatory design, and it is correct for three reasons.
- Duplicate duties create duplicate exposure. If a platform's impact assessment is inadequate, it can fail both the GDPR duty and the new labour-law duty. Two regulators can then fine one deficiency, with no rule saying how the penalties relate.
- Uncertainty falls hardest on smaller firms. A large platform can staff separate compliance teams for the data protection authority and the labour inspectorate. A domestic delivery start-up cannot, and ambiguity about which regulator leads pushes costs towards the firms with the least capacity.
- Proportionality is a rule-of-law principle, not a favour to industry. Absorption by the more specific rule is a familiar tool in penal and administrative law. The Garante is asking the legislature to apply it deliberately instead of leaving it to litigation after fines are issued.
A clear division of powers between the Garante and the INL also protects workers. A worker who has been deactivated by an algorithm needs to know where to complain. A system in which two authorities each assume the other is leading is one in which enforcement stalls.
Where the opinion could go further
Absorption and coordination clauses are necessary, but they do not by themselves make the regime workable. Three further points follow from the opinion's logic.
First, "human oversight" needs a standard that a regulator can test. The Garante's request that supervisory staff report to top management is a concrete, auditable condition. It is better than a vague duty to "ensure oversight", which invites box-ticking.
Second, data sharing with public authorities is where worker privacy and enforcement ambitions collide. Authorities can reasonably want platform data to detect misclassification or undeclared work. Purpose limitation and reuse limits are what keep a labour-inspection tool from becoming a general surveillance channel. This is the same discipline we apply to any state access to private platform data.
Third, Italy is an early mover. A May 2026 report cited by one directive tracker said Italy was the only member state with a draft decree under parliamentary review, though that status may have changed. How Rome handles regulatory overlap will be a reference point for countries that transpose later. A clean coordination clause would be a useful template. A decree that leaves both regulators free to fine the same algorithm would teach other governments the wrong lesson.
What lawmakers should do
The government and Parliament should adopt the Garante's conditions and add an explicit absorption or coordination rule before the 2 December deadline. Doing so would not weaken workers' rights. It would make them enforceable at lower cost to compliant firms and with fewer jurisdictional disputes. Platform regulation works best when each duty has one clear owner and one proportionate penalty. The opinion is a reminder that the quality of enforcement design matters as much as the ambition of the substantive rules.
A caveat on scope: this analysis rests on the Garante's opinion and the directive's published provisions. We have not reviewed the full text of the draft decree, so provisions beyond those the opinion discusses are outside this assessment.