In Italy, companies authorized to set up and operate networks for public use, as well as the more traditional telecommunications operators that offer electronic communications services for public use, must comply with the so-called Mandatory Services, as required by art. 57 of the Electronic Communications Code.
By Mandatory Services we mean those services paid by the subjects with general authorization identified by the art. 57 of the Electronic Communications Code (Legislative Decree 259/2003), updated following the entry into force on 24 December 2021 of Legislative Decree 8 November 2021, n. 207 (hereinafter “Code”), to be guaranteed towards the judicial authorities and national security agencies. The aim is, for example, to track both Internet connections and the technical identity of the user who connects, storing them in accordance with the provisions of the Privacy Code, for the purposes of detecting and suppressing crimes and for national security. When requesting general authorisation, the Operators declare that they fully accept the provisions of the Code, very often self-certifying in an unconscious manner albeit in good faith, that they have implemented every technical, organizational and managerial measure necessary to cover the services provided for by the ‘art. 57 of the Code. This declaration represents the only form of guarantee for compliance with the provisions of the Code, as in our country there is no office, body or authority responsible for effectively verifying, both preventively and continuously, the coverage of mandatory benefits.
In cases where non-compliance with these requirements is evident, ie when the person who requested the general authorization has not in fact implemented any envisaged measures, the Ministry of Business and Made in Italy, formerly MISE and today MIMIT, requested by the authorities to whom these services must be guaranteed and, as required by art. 30 paragraph 16 of the Code, imposes a pecuniary administrative sanction which can be between 170.000 euros and 2.500.000 euros. If the violation of obligations is particularly serious or repeated more than twice in a five-year period, the Ministry may additionally order the suspension of the activity for a period not exceeding two months or the revocation of the general authorization.
Article 57 – Mandatory services (ex art. 96 Code 2003)1. They are mandatory for subjects authorized to set up and operate electronic communications networks and services for public use, as well as for operators who provide the services identified by article 3 of Legislative Decree 30 May 2008, n.109, for international traffic transit operators, the services carried out in response to requests for information from the competent judicial authorities and agencies responsible for national security. The times and methods are agreed with the aforementioned Authorities. Without prejudice to the provisions of the decree referred to in paragraph 6 regarding requests made by judicial authorities.2. Services for the purposes of justice and prevention of serious crimes carried out in response to interception requests by the competent judicial authorities are mandatory for persons authorized to set up and operate electronic communications networks and services for public use. The times and methods are established by the decree referred to in paragraph 6.3. The subjects authorized for machine-to-machine communications – IoT (Internet-of-Things) and for Edge Computing services are exempted from the obligations referred to in paragraphs 1 and 2, limited to the provision of such services and with the exclusion of cases in where the use of such services can contribute to providing interpersonal communication services.4. It is mandatory for parties authorized to set up and operate electronic communications networks and services for public use, including international traffic transit operators, to prepare tools for monitoring and combating threats, including in real time. cybernetics and prompt collaboration in response to requests for information and intervention to protect national security by the competent state authorities. The times and methods are agreed with the aforementioned authorities.5. When events are detected that may affect the security of information systems, electronic communications operators shall immediately inform the National Cyber Security Agency. The Agency, when it is aware of a threat that could affect the security of information systems, in order to prevent the threat, orders the electronic communications operators who have set up the tools provided for in paragraph 4, to activate the tools contrast using, where appropriate, technical markers indicated by the same.6. The flat-rate annual fee for the mandatory services referred to in paragraphs 1 to 4 is identified by decree of the Minister of Justice and the Minister of Economic Development, in agreement with the Minister of Economy and Finance. The decree:a) regulates the types of mandatory services and determines their tariffs, taking into account the evolution of costs and services, so as to achieve cost savings of at least 50 percent compared to the tariffs charged. The tariff includes the costs for all services simultaneously activated or used by each network identity;b) identifies the subjects required to provide mandatory interception services, including among service providers whose infrastructures allow access to the network or the distribution of information or communication contents, and those who in any capacity provide electronic communication services or applications , even if usable through non-own access or transport networks;c) defines the obligations of the subjects required to perform the mandatory services and the methods of carrying them out, including the observance of homogeneous IT procedures in the transmission and management of communications of an administrative nature, also with regard to the preliminary phases to the payment of the same services.7. In case of failure to comply with the obligations contained in the decree referred to in paragraph 6, article 32, paragraphs 2, 3, 4, 5 and 6 and article 30, paragraph 16 apply.8. For the purposes of providing the services referred to in paragraph 6, operators are obliged to negotiate the interconnection methods between themselves, in order to guarantee the supply and interoperability of the services themselves. The Ministry can intervene if necessary on its own initiative or, in the absence of agreement between the operators, at the request of one of them.9. Pending the adoption of the decree referred to in paragraph 6, the provisions in force, including those of a regulatory nature, continue to apply.