In this interview, Bryan Wisotsky, founder of Sky SEO Digital, talks with Gianni Dell'Aiuto, a Rome‑based attorney with three decades of experience in corporate and digital law, about European data protection. Gianni explains the GDPR and the new Artificial Intelligence Act, emphasizing that personal data is a digital identity and must be protected. He contrasts EU privacy rules with the more permissive US approach, highlighting the EU’s requirement for explicit, informed consent for every data use and the prohibition on undisclosed profiling. The conversation covers enforcement, noting massive fines such as the €1.3 billion penalty on Meta and the temporary ban of ChatGPT in Italy, and warns that non‑compliance can lead to website blocking across the EU. Gianni describes how AI systems rely on large data sets, prompting the AI Act’s risk‑based classification (minimal, low, high) and stricter rules for high‑risk applications, especially involving children. Finally, he offers practical advice for US e‑commerce businesses seeking to operate in the EU: create GDPR‑compliant privacy notices, practice data minimization, ensure contractual safeguards, implement robust cybersecurity, and use compliance as a trust‑building differentiator.
Chapters
Good morning, everybody. My name is Bryan Wisotsky. I'm the founder of Sky SEO Digital. We offer digital marketing services including SEO, Google Ads, and web design here in sunny Miami. Today, I'm excited to be joined by Gianni Della Jutta. He is a digital and privacy attorney based in Rome, Italy. Welcome, Gianni.
Thank you very much, Bryan. Thank you for this opportunity and hi to everybody that is here with us.
Thank you. Maybe you can introduce yourself so people know who you are and a little bit more about yourself.
Thank you. My name is Gianni Dell'Aiuto. I'm an attorney in Rome, 30 years experience as attorney. I'm specialized in companies and recently in digital, the new laws of web, contracts of web. but mostly privacy and data protection. In Europe, we have a special regulation called GDPR for data protection and an Artificial Intelligence Act to protect everybody about their data and personal information. Be aware that your personal data that we put online is our digital personality, is our identity, and data They are— is the most ever stolen product, is the most ever worth product. And we have a real huge amount of data in our mobile smartphone, laptop. And every day we receive at least 2 or 3 personal attacks. So this law is to protect everybody, applies in Europe, but is useful everywhere. Right.
And kind of along that same vein, how do privacy laws in the US differ from privacy laws in the EU in a general way?
It's basically different because in European Union, we take care most of the citizens and try to make citizens aware. We— it's not more allowed the classic system that when you surf a website or you ask something, you automatically give all your data and all your information.
Right.
Every website must inform us why they need the data, how they use it, how they process it. And if I want to allow them to use it to profile for a better navigation, for to receive more customized information, I must be informed. I must explicitly say yes and not just with one finger accept everything. That's totally against the law. Every single click is a single action for every consent that we must give. And companies must use our data according to my consent. They cannot share without consent. They cannot profile. They cannot send me newsletter or quotation if I do not want. They must protect my data and inform me where they are. That's the basic difference.
Thank you. And because the laws are rather stringent in the EU, can you tell us a little bit more about the penalties for violating these laws?
Well, Meta/Facebook was fined €1.3 billion. ChatGPT was blocked in Italy for more than 2 months to do not accomplish regulations on data protection, mostly on children. Your website can be blocked eventually. You can be banned in all European Union and compete mostly in e-commerce. E-commerce European competitors can point nasty fingers and ask your website is blocked.
Wow.
Yes, you must understand that from selling you get a lot of information. If you sell me a shirt, you know where I live for delivery. But if I buy from you food or diaries or medicals, you know all my disease, my sickness, if I'm vegetarian or Jewish, or I have pets or other, if I have allergies. So that data I already told is really important. It's the fuel of internet, it's the gasoline of internet. So that's why companies need data. And we Google for it and we give and share a lot of information. We must be aware and who's getting my data must protect properly and use properly.
Okay, thank you. And then another question is, how has AI, how has artificial intelligence played a role in the data protection And how has it affected laws about around privacy in the EU?
Well, artificial intelligence is widely used and it needs a lot of data to profile. So we have even an Artificial Intelligence Act that is mandatory as well. And processing of data must be done according to this system. If they are very pervasive, if they are very strong system to use our data, we must have stronger information, mostly if they use children, if they are data of children, of young people. So every company dealing with artificial intelligence must be aware that their products, their solutions cannot be used in Europe if they use data not in the appropriate way, no, without information and without protection. We are, we are human beings and we cannot be in the hands of machines. We must know our personality because we are a physical individual with rights, but artificial intelligence is creating a double us that is online, that we create with every single click, every single navigation, every single action. So who is using artificial intelligence must be aware that he's managing and manipulating people. So all the system must be compliant to the regulation to do not make any use of data improperly. That's basic. The artificial act regulation is based on the 3 main levels. of danger for the people. Minimum, low, high. If data is manipulated with high risk for manipulation, is totally forbidden and needs special authorization from every single person to use data. I don't want to be so technical and do not want to talk like a lawyer, but try to be useful to understand.
Thank you. Thank you. And then I guess the final question is, if I'm a US business, excuse me, and I'm planning to do business in the EU, and maybe I'm in an e-commerce, I'm an e-commerce company, how do I take all of this into account and make sure that I'm compliant?
First of all, you need a privacy disclaimer according to European Union and to know how to manage data because everybody can eventually sue you for an improper use. Then according to your activity, you need some behavior, you need some action, positive action to protect the data. And it depends on data that you need because collecting data means even collect only what I really need, not just everything from me. If I ask you a quotation by mail, you do not need my telephone number. So minimization of data. Then according your activity, you need some advice and some attention and pay attention on contracts. And so you will be free to work in the European market legally without any problem. But I take the liberty to point that using GDPR and European regulation means build for every company digital trust. It's an extra value that you can offer to your digital customers and make them safe. Their data, their identity, their personality is protected and you do not share, you do not, you protect with cybersecurity. But protect even legally to— and do not sell or give for free to somebody else.
Right. Okay. Well, I appreciate you taking the time to meet with us and talk more about digital privacy and how that's affecting the European Union. So thank you, Gianni, for joining us. And—
Thank you very much, Bryan.
Thank you. And to everyone watching, you know, stay tuned for more content like this. Thank you.
