DATA PROTECTION
Data Protection Authority: FAQs clarifying the legal prerequisites for the processing by Institutes for Hospitalization and Treatment of a Scientific Nature (IRCCS) of personal data collected for health care purposes for further research purposes.
What are IRCCSs? How can they use personal data collected for the treatment of patients for research purposes? What obligations do they have under the Italian Data Protection Code? These questions have been answered by the Italian Data Protection Authority Privacy with FAQs.
The Authority's clarifications are addressed to IRCCSs, i.e. those bodies of the National Health Service that, according to standards of excellence, pursue research purposes in the biomedical field and in that of the organisation and management of health services, and perform highly specialised hospitalisation and care services.
In the FAQs it is explained that IRCCSs, in order to be able to use their patients' data also for the scientific research activity authorised by the Ministry, must identify an appropriate legal basis to legitimise such processing and an appropriate exception to the general ban on processing health and genetic data.
The Italian Data Protection Authority has therefore clarified that public and private IRCCSs, in addition to the consent of the research participants, may base the processing of personal data collected for the purpose of treatment for further research purposes on Article 110-bis, paragraph 4 of the Italian Data Protection Code, according to which the processing of data collected for clinical activity does not constitute further processing for research purposes.
However, if IRCCSs make use of this provision, they are obliged to carry out the Impact Assessment (DPIA) and publish it on their websites. However, if the full publication of the DPIA may infringe intellectual property rights, trade secrets or otherwise, the Institute may publish it in excerpts.
A specific section of the FAQs is devoted to the different ways of informing research participants depending on whether the data are collected from them or from the institute's internal databases or other participating centres.
Finally, the Authority has clarified the objective scope of application of Article 110-bis, paragraph 4 of the Code, which concerns all types of medical, biomedical, epidemiological, prospective and retrospective research, promoted by IRCCSs, including multicentre studies, whether carried out within the research networks of IRCCSs or in those promoted by such institutes with the participation of entities that do not enjoy such recognition.
The Authority's clarifications are addressed to IRCCSs, i.e. those bodies of the National Health Service that, according to standards of excellence, pursue research purposes in the biomedical field and in that of the organisation and management of health services, and perform highly specialised hospitalisation and care services.
In the FAQs it is explained that IRCCSs, in order to be able to use their patients' data also for the scientific research activity authorised by the Ministry, must identify an appropriate legal basis to legitimise such processing and an appropriate exception to the general ban on processing health and genetic data.
The Italian Data Protection Authority has therefore clarified that public and private IRCCSs, in addition to the consent of the research participants, may base the processing of personal data collected for the purpose of treatment for further research purposes on Article 110-bis, paragraph 4 of the Italian Data Protection Code, according to which the processing of data collected for clinical activity does not constitute further processing for research purposes.
However, if IRCCSs make use of this provision, they are obliged to carry out the Impact Assessment (DPIA) and publish it on their websites. However, if the full publication of the DPIA may infringe intellectual property rights, trade secrets or otherwise, the Institute may publish it in excerpts.
A specific section of the FAQs is devoted to the different ways of informing research participants depending on whether the data are collected from them or from the institute's internal databases or other participating centres.
Finally, the Authority has clarified the objective scope of application of Article 110-bis, paragraph 4 of the Code, which concerns all types of medical, biomedical, epidemiological, prospective and retrospective research, promoted by IRCCSs, including multicentre studies, whether carried out within the research networks of IRCCSs or in those promoted by such institutes with the participation of entities that do not enjoy such recognition.
