Policlinico Casilino di Roma (the controller) – €30,000 Fine (Italy, 2022)

The Italian DPA received a report from a data subject stating that the Policlinico Casilino di Roma (the controller) exclusively permitted Covid pass holders to access its outpatient clinic. Following this, the DPA started an investigation into the matter. It noted that this indication was also reported on the controller's website and thus requested additional information from the controller. The controller submitted that it carried out real-time measurement of body temperature and required the voluntary presentation of the patients' Covid Certification, resulting from a negative swab result (done in the previous 48 hours), to safeguard public health and safety within the hospital. However, even if the patient did not have a Covid pass, the healthcare service would still be provided in compliance with prescribed protocols. The legal basis for the processing was to be found in the (verbal) consent of the person concerned given by voluntarily exhibiting the Covid certification. The healthcare service had to ensure that such a process was communicated by web communication, posters in the structure, and/or by the operator indicating it during the service booking. The DPA noted that the requirement that all patients going to the controller's outpatient clinics be in possession of a Covid pass lacked a proper legal basis, given that such a restriction was not provided for by the sectoral rules. Indeed, the sectoral rules did not provide for Covid certification to be required for health needs, for which access is always permitted for the procurement of drugs and medical devices and, in any event, for any purpose of medical treatment. Moreover, the DPA pointed out that possession of the Covid certificate did not prove immunity to the virus and therefore pointed out the disproportionality of the measure adopted by the controller according to which staff were provided with specific personal protective equipment only if in contact with data subjects who did not have Covid certification. The DPA believed that this measure, together with the provision of differentiated routes for such data subjects, not only failed to comply with national indications, but also risked discriminating against them. Further, the DPA held that the processing of data carried out through the control of Covid passes qualified as a treatment carried out for public health reasons and as such should find its legal basis in the specific sector discipline (Article 9(2)(i) GDPR) and not in the consent of the data subject. The Italian DPA held that the infringement of Article 5(1)(a) GDPR and Article 5(1)(b) GDPR and Article 9 GDPR, [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 75 of the national data protection legislation] and the applicable sectoral regulations (Law no. 87/2021, Law Decree no. 44 of 01/04/2021 and Prime Ministerial Decree of 17 June 2021), caused by the conduct of the controller, was subject to the application of an administrative fine pursuant to Article 83(5) GDPR. In view of all these elements, the Italian DPA imposed a €30,000 fine on the controller, pursuant to Article 58(2)(i) GDPR. In sanctioning the controller, the DPA took into account several aggravating factors, such as the fact that the processing, which lasted until June 2022, potentially concerned data capable of revealing information on the health of a significant number of data subjects (150,000/200,000 outpatient accesses) (Article 83(2)(a) GDPR and Article 83(2)(g) GDPR). It also considered the cooperation of the controller to remedy the infringement (Article 83(2)(f) GDPR) and the assertion of the controller in that it had acted in good faith to protect the health of patients and health professionals (Article 83(2)(k) GDPR) as mitigating factors.