Legal basis

Legislative Decree 51/2018 (Italy's implementation of the EU Law Enforcement Directive). The Garante treated SARI Enterprise as automating an existing AFIS search rather than creating a new category of processing, so it rests on the same legal basis as the pre-existing manual search.

Oversight

Garante per la protezione dei dati personali issued a favourable opinion in 2018. No dedicated ongoing independent oversight of the AFIS-SSA database composition or of SARI Enterprise use has been identified.

SARI Enterprise performs retrospective facial recognition searches, submitting a facial image against the AFIS photographic database and returning a ranked candidate list for human examination. Approved by Italy's data protection authority, the Garante, in 2018, and described in Italian police documentation as an established system used by the Scientific Police. A point the police's own explanation makes explicitly, and worth recording because it is the distinction this tracker exists to draw: the result is not itself a legally determinative identification. A trained operator assesses the candidates, and the output is an investigative lead rather than courtroom evidence. Recorded separately from SARI Real Time, which is a distinct live version of the system with a different and unresolved legal status. Sourcing and detail, verified August 2026. The Garante's approval is provvedimento n. 440 of 26 July 2018 (doc. web 9040256). Its reasoning is worth recording precisely: the Garante concluded SARI Enterprise did not constitute a new processing operation distinct from the manual AFIS search it replaced, but rather automated operations that previously required manual entry of identifying features, returning a priority-ordered list of similar photographic records. That reasoning is why the system rests on the same legal basis as the manual process rather than requiring its own. Scale of the reference database: in a written parliamentary response the Interior Ministry stated AFIS then held 17,592,769 photographic records corresponding to 9,882,490 individuals. The database includes people charged with offences in Italy, but also irregular migrants and anyone required to renew or convert a residence permit, which means the searchable gallery extends well beyond people suspected of crime. Contested, and recorded because it bears directly on verifiability: a FOIA-based investigation by StraLi and Privacy Network running from April 2025 to April 2026 reported that the Interior Ministry does not measure the system's effectiveness or its error rate, and criticised the 2018 Garante opinion as brief, not setting out its reasoning in full, and citing documents that were never made public. Italy has separately extended a moratorium on facial recognition in public places pending organic legislation that has still not been passed.

Source: Garante per la protezione dei dati personali, provvedimento n. 440 of 26 July 2018 · last checked 2026-08-24

Legal basis

The Italian Data Protection Authority (Garante) examined the system as designed and found it unlawful for lack of an adequate legal basis and the potential for blanket surveillance

Oversight

Italian Data Protection Authority (Garante per la protezione dei dati personali)

SARI Real Time was designed to analyse live camera feeds against a predefined watchlist of up to 10,000 faces and alert operators on a match. The Garante's review found it was not yet active and ruled it unlawful as designed. This is exactly the kind of regulatory finding this tracker exists to document: a live facial recognition system blocked by a data protection authority before deployment, not after.

Source: Garante per la protezione dei dati personali, decision of 16 April 2021 · last checked 2026-08-24