The Garante per la protezione dei dati personali (Italian Data Protection Authority) has identified the first guarantees to be observed for the processing of personal data concerning health for scientific research purposes, if informing the data subjects and acquiring their consent proves impossible, requires a disproportionate effort or risks making it impossible or seriously prejudicing the pursuit of the research purposes, in accordance with Art. 110 of Legislative Decree No. 196/2003 (Privacy Code), recently amended by Art. 44 of Law Decree No. 19/2024, converted into Law No. 56/2024 (see the news of 10th May 2024 https://www.studiolegaleastolfi.it/in-primo-piano/en_798_privacy-amended-article-110-of-the-italian-privacy-code-on-the-processing-of-data-for-scientific-research-purposes).

In particular, the measure adopted by the Authority provides that, in cases where the processing for scientific research purposes concerns data relating to the health of persons who are deceased or who cannot be contacted for specific ethical or organisational reasons (attributable, for example, to the circumstance that the data subject is unaware of his/her condition or to the circumstance that contacting them would involve a disproportionate effort), the data controller, in addition to adopting appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, and acquiring the favourable opinion of the competent Ethics Committee (as already provided for by Art. 110 of Legislative Decree No. 196/2003), must also carefully justify and document, in the research project, the existence of ethical or organisational reasons for which informing the data subjects and, therefore, acquiring their consent is impossible or entails a disproportionate effort, or risks making it impossible or seriously prejudicing the achievement of the purposes of the research (also documenting the reasonable efforts made to try to contact them), and carry out and publish the data protection impact assessment, pursuant to Article 35 of the GDPR, notifying the Garante.

With the same provision, the Data Protection Authority also launched the procedure for the adoption of the Deontological Rules for the processing of personal data for statistical and scientific research purposes, inviting those who intend to take part in the work to provide, within 60 days of the publication of the provision in the Official Journal, information and documentation to prove, in particular, their qualified interest in the matter (decision no. 298 of 9th May 2024).