Medical, biomedical and epidemiological research
Article 110 of the Italian Data Protection Code exempts from obtaining data subjects’ consent, when health data is processed for the purposes of scientific research in the medical, biomedical or epidemiological fields (subject to certain conditions) and where a DPIA is performed and made public.
Consent is also not required, if informing the interested parties is impossible or involves a disproportionate effort, or if it risks making it impossible or seriously compromising the achievement of the research goals. In such cases, (1) the controller must adopt appropriate measures that protect the rights, freedoms and legitimate interests of the data subjects, (2) the research program is subject to a favorable opinion of the competent ethics committee and (3) must be submitted to prior consultation of Garante.
Further processing of personal data by third parties for scientific research or statistical purposes
Garante may authorize the further data processing for scientific research or statistical purposes by third parties who primarily carry out such activities. It is allowed in situations where informing the data subjects is impossible, involves a disproportionate effort or is likely to make it impossible or seriously jeopardize the achievement of the research objectives. In such situations, appropriate measures must be taken to protect the data subjects’ rights, freedoms and legitimate interests, including preventive forms of data minimization and anonymization (Article 110-bis of the Italian Data Protection Code).
The further data processing by third parties may also be authorized by Garante by means of general measures adopted ex officio. Such measures shall be published in the Official Journal of the Italian Republic.
The processing of personal data collected for clinical activities considering research purposes, by institutes of hospitalization and treatment of a scientific nature, does not constitute further processing by third parties.
