The so-called "PNRR bis Decree" (Law Decree No. 19/2024, converted into Law No. 56/2024), which came into force on 1st May 2024, introduced an amendment to Article 110 of the Italian Privacy Code (Legislative Decree No. 196/2003), concerning the processing of personal data for medical, biomedical and epidemiological research purposes.

Article 110 identifies the cases in which the data subject's consent for the processing of data relating to health, for the purpose of medical, biomedical or epidemiological scientific research, is not necessary, i.e. when (i) the research is carried out on the basis of provisions of law or regulation or EU law (in accordance with Article 9, para. 2(j), of the GDPR) and an impact assessment is conducted and made public, or (ii) due to particular reasons, informing the data subjects proves impossible or involves a disproportionate effort, or is likely to render impossible or seriously undermine the achievement of the purposes of the research.

In such cases, the data controller must take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject and the research programme is subject to a reasoned favourable opinion of the competent ethics committee.

In the version of Article 110 prior to the amendment made by Law Decree No. 19/2024, converted into Law 56/2024, it was also provided that the data controller, before proceeding with the processing itself, should submit the latter to the prior consultation of the Italian Data Protection Authority (Garante per la protezione dei dati personali), pursuant to Article 36 of the GDPR. 

Art. 44 of the Law Decree No. 19/2024, converted in Law No. 56/2024, eliminated the requirement for prior consultation with the Italian Data Protection Authority, replacing it with the observance of the guarantees identified by the Authority, pursuant to article 106, para. 2(d), of the Italian Privacy Code.