Italian and European law build a wall around a journalistic source that is, on paper, among the highest any person can have. It is worth looking at closely, because its very height explains why the way it gets bypassed has nothing to do with climbing over it.
What Article 200 actually protects
Article 200 of the Italian code of criminal procedureopens in a new tab lists who may refuse to testify about what they learned by reason of their profession. The third paragraph extends that right to professional journalists on the register, and draws its limits: it concerns the names of the people from whom they received information in confidence in the exercise of their profession.
The clause that matters comes next, and is usually quoted badly. Secrecy does not stop at the word that spells the name: it covers anything that could lead to identifying the source. That is a technical difference with enormous practical consequences, because it moves the object of protection from a single field to a set. In an internal document that set is everywhere: who was copied in, which office filed it, which staff number appears at the foot, which shift, which revision date. None of those is a name. All of them together, in a company where five people could have held that file, are a name spelled more carefully.
The protection is not absolute in front of a judge either. Where the information is indispensable to proving the offence being prosecuted and its truth can only be established by identifying the source, the judge orders the journalist to name them. It is a narrow limit, and it is still a limit: the wall has one opening, and a magistrate controls it.
The EMFA raises the wall, and says against whom
Since 8 August 2025, Regulation (EU) 2024/1083opens in a new tab, the European Media Freedom Act, has applied. Article 4 is the provision on protecting journalistic sources and confidential communications, and it reads as a list of things member states must refrain from doing: compelling journalists or those working with them to disclose sources, detaining, sanctioning, intercepting, searching or seizing their material in order to get to a source. It also bars intrusive surveillance software against them, save in exceptional cases (serious crime, terrorism, organised crime) authorised case by case by an independent judicial authority and governed by necessity and proportionality.
It is a strict, well-made rule, and worth reading for what it is: a list of prohibitions aimed at whoever might come to take the document. It governs interference. It has nothing to say, and it is not its job to, about a file a journalist uploads to a private supplier’s service on their own initiative.
Italian Law 69/1963 on the professionopens in a new tab looks from the same side: it makes respect for professional secrecy about a source a duty of the journalist. A duty is something you discharge, and discharging it means making sure the information stays where it arrived.
Neither rule contemplates handing it over voluntarily
Put together, the three rules say that nobody may come and take the source: not by search, not by interception, not by spyware, and in front of a judge only under the very narrow conditions of the third paragraph. Then it is Tuesday evening, there are four hundred pages to read by tomorrow, and the four hundred pages end up in a chat window with a request to summarise them.
At that moment none of the rules we have just read has been breached, and that is precisely the problem. There was no interference to resist and no testimony to refuse: there was a voluntary transfer to a third-party company, which received it, kept it for as long as it decides, and (under the contract almost nobody reads) possibly used it for training. From then on the information no longer sits only with you, and the one safeguard that kept it safe, namely that it sat only with you, is gone. The wall has no doors. You opened the window.
The GDPRopens in a new tab reaches the same conclusion by another route, with the publisher as controller. Sending a supplier the personal data in a document is processing with a recipient, and it has to stand up: a legal basis, a relationship with that supplier, an assessment of the transfer if it sits outside the Union, measures appropriate to the risk. The special regime for journalistic purposes loosens some duties towards the data subject; it does not turn a supplier into a neutral place.
Who else has seen that document
There is a detail in Article 200 that newsrooms underrate, and it decides more than it seems: the right to refuse is written for journalists on the professional register. The collaborator who transcribed the audio, the trainee who did the research, the fixer who translated the annex, the intern who converted the PDF: they saw the same document and, in front of a judge, do not have that right.
What follows is unromantic and very operational. Protecting a source is not a quality of the journalist who met them, it is a property of the material and of how many identifiable copies are in circulation. Every extra person who sees the full document is one more person who can be asked what they saw, and one more copy on another computer.
Why anonymisation is the technical form of the same duty
If secrecy covers anything that leads to identifying the source, then stripping those things out before the document goes anywhere is not extra caution: it is the only shape that duty can take when the document has to be worked on. It is the same reason a black rectangle is not enough: covering the name leaves the other five lines that lead there anyway, and in a PDF it often does not even remove the name: that stays in the text layer under the rectangle.
The difference with substitution is that placeholders survive reading. A text where the source is “[FULLNAME_1]” and the office is “[ORG_2]” can be summarised, translated and questioned exactly like the original, because the questions you actually put to a model (summarise, find the contradictions, list the dates) are questions about the structure of a text, not about people. And the map between placeholder and real value stays on your computer, encrypted, so the answer goes back in place when it returns.
What stays inside a file after the text has been cleaned (the author in the metadata, the text layer under a scan, the revisions in a .docx) is a separate and serious problem, and it is in the piece on metadata.
Three questions, before uploading
One: in this document, what narrows the field? Not “is there a name”: is there a staff number, an office, a shift date, a signature at the foot, a filing number. If three of those together point at five people, the document does not go out as it is.
Two: does the question I am about to ask need those details? Almost never. None of the questions you really put to a model get better because the model knows what the person is called.
Three: after publication, what remains reconstructable? It is the question nobody asks beforehand and everybody asks afterwards. If the map between placeholders and names lives in a file that can be deleted, then from that moment the worked text leads back to nobody, not even if somebody asks the newsroom to hand over everything it holds.