Garante per la protezione dei dati personali — Centro Nazionale Opere Salesiane — Scuola (CNOS-Scuola)
On 3 June 2026 the Garante privacy sent a request for information to the Centro Nazionale Opere Salesiane — Scuola after learning that Salesian schools had begun a structured trial of generative AI systems involving more than 1,600 teachers and nearly 29,000 students. The Authority gave 20 days to supply the pre-launch assessments, the processing methods for pupils' and staff data, the list of participating institutes, the technology suppliers and any data protection impact assessment, noting the high risks to those involved and the presence of automated decision-making, and recalling that data protection law applies equally to public and private bodies.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text (in IT, the document's language).
- Decided by
- Garante per la protezione dei dati personali
- Parties
- Garante per la protezione dei dati personali v. Centro Nazionale Opere Salesiane Scuola
- Decision date
- June 3, 2026
- Remedy
- Centro Nazionale Opere Salesiane Scuola was instructed to respond within 20 days detailing its data processing methods, risk evaluations, technology providers, and data protection impact assessment.
- Appeal
- Appeal status not stated
Key holdings
The Italian Data Protection Authority sent a formal request for information to Centro Nazionale Opere Salesiane Scuola regarding the use of generative artificial intelligence in education.
“Il Garante per la protezione dei dati personali ha inviato una richiesta di informazioni al Centro Nazionale Opere Salesiane Scuola in merito all’impiego dell’intelligenza artificiale in ambito formativo.” — paragraph 1
Data protection rules apply equally to public and private entities processing personal data while delivering educational services.
“la normativa privacy si applica allo stesso modo ai soggetti pubblici e privati che effettuano trattamenti di dati personali nell’ambito dell’erogazione dei servizi educativi e didattici.” — paragraph 2
The target entity must provide detailed information within 20 days regarding pre-project evaluations, data processing methods, participating schools, technology suppliers, and impact assessments.
“Il Centro Nazionale Opere Salesiane Scuola dovrà fornire riscontro entro 20 giorni, indicando le valutazioni effettuate prima dell’avvio del progetto” — paragraph 3
In plain English
On 3 June 2026, the Italian Data Protection Authority, Garante per la protezione dei dati personali, sent a request for information to Centro Nazionale Opere Salesiane Scuola concerning its use of generative artificial intelligence in educational activities. Press reports indicated that several Salesian schools had launched a structured trial of generative artificial intelligence tools involving over 1,600 teachers and almost 29,000 students, in collaboration with Google. The regulator emphasized that data protection rules apply equally to public and private entities offering educational services. Furthermore, when data processing poses high risks to individuals, such as through automated decision-making processes, specific protections and requirements must be fulfilled. The regulator ordered Centro Nazionale Opere Salesiane Scuola to respond within 20 days. The organization must provide details regarding prior assessments conducted before launching the project, how student and staff personal data is processed, which schools are participating, which technology providers are involved, and whether a data protection impact assessment was carried out. This action highlights regulatory oversight on deploying artificial intelligence systems in educational environments involving minors and educational personnel.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.