• data minimisation
• data protection
• principle of necessity
• Privacy

Privacy is a concept that has evolved a lot in the past century: from the original right to seclusion and to one’s own self-determination without external invasion of private spaces, the technological changes occurred in society have transformed it into a complex set of rights to provide individuals with some degree of control over the processing and the flow of their own personal data. After a long delay in adopting data protection laws when compared to other countries, Italy put up a steep pace and introduced a novelty in the law currently in force, d.lgs. 196/03: the principle of necessity. This provision, significantly located among the three “top principles” in data protection, imposes on data controllers a limitation on the use of personal data, requiring the processing of anonymous data whenever possible. The principle has been in force since 2003, and the Italian authority for the protection of personal data is firm in its enforcement, invoking it in many decisions. The present work slowly zooms in on the principle of necessity: it starts from a broad history of the concept of privacy up to the current times; then it surveys the various approaches to a privacy law in the international scene, with a major attention to the European context; a timeline of the Italian legislation, with a summary of the current discipline, follows. Finally, the focus is centered on art. 3 of the law, containing the principle of necessity: from a general explanation to theoretical literature on the subject, not forgetting the application performed so far by the Guarantor with a number of examples in several fields. The conclusive analysis tries to highlight the strengths and weaknesses of the provision by putting it in the perspective of its natural application field: a society where information, and even more the Internet, have dramatically changed the business models and favored the birth of new, opposing interests.