Istituto Nazionale di Statistica – Violation Found (Italy, 2023)

In 2020, the Italian DPA issued [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9261093 Provision n. 10] authorizing the processing of personal data necessary for the creation of a permanent census as part of the national statistical program carried out by the Italian National Institute of Statistics, the controller. While authorizing the creation of the permanent census, the DPA ordered the controller to implement the following security and data protection measures: a) adopt a pseudonymisation technique [Article 5(1)(f) GDPR]; b) apply the principles of data minimization [Article 5(1)(c) GDPR], purpose limitation [Article 5(1)(b) GDPR] and storage limitation [Article 5(1)(e) GDPR]; c) and to implement privacy by design and by default [Article 25 GDPR]. The provision also addressed specific critical issues in relation to the attribution of a unique code that identifies the individual in the various databases, requiring the controller to implement a rotating decoupling mechanism of pseudonymised codes. Considering the complexity of these measures, the DPA found that it was necessary to follow their implementation so that compliance with data protection principles was ensured. Therefore, it opened an investigation on the controller based on Article 58(1) (a), (e) and (f) GDPR. While recognizing the difficulties in implementing the measures and the efforts undertaken by the controller, the DPA found some violations of the GDPR. First, the DPA noted that the controller was classifying the collected data in three categories: "identifying data" (residence, contact information, etc.), "thematic data" (income, education, work, etc.) and "sensitive thematic data" (sexual orientation, health, etc.). However, it found that the controller was not implementing specific security measures according to this classification. In the DPA's view, it was necessary to consider the nature of the data in the risk analysis to implement safeguards that are adequate to the identified risks. By failing to do so, the controller violated the principle of accountability and the obligations of privacy by design and by default provided for by Articles 5(2) and 25 GDPR. Second, the DPA noted that the controller uses a "specific integration domain" (SID), from where the data necessary for the pursuit of a specific statistical purpose are retrieved. In essence, a subset of information can be extracted from a master table based on specific selection criteria. To make the integration domains independent from each other, the controller uses hierarchical pseudonymisation. When the data is collected, it is assigned a universal pseudonym. This pseudonym is then translated through a cryptographic function into different pseudonyms for the different integration domains. A specific unique encryption key is assigned to each specific integration domain and each domain has a different encryption key. In the current testing phase, the requests formulated by individual statisticians (analysts) are sent to the competent central directors, who are responsible for assessing and aproving the requests when they are pertinent. According to the DPA, this system leaves the application of the minimization principle to the evaluation of the directors and, therefore, to mere organizational measures. Moreover, the DPA found critical issues regarding the impossibility of automatically detecting anomalies in the SIDs such as the singularity issue, which refers to the possibility of combining unique attributes of a single subject. The DPA deemed necessary to implement automatic detection measures, so that the controller can be immediately aware of the risks to which data subjects are exposed. Therefore, it found a violation of Articles 5(2), 24 and 25 GDPR. Third, the DPA found that the pseudonymisation system implemented by the controller calculates a hash code for each statistical unit that flows into the integrated microdata system, which is a suitable technique to ensure the uniqueness of pseudonyms on a formal level. However, considering that the creation of the secret key used for the generation of pseudonyms is linked to an extremely volatile parameter (the exact time with milliseconds), the "controlled reversibility" of the pseudonymisation technique is inapplicable on a concrete level. According to the DPA, the technique would only be applicable if the controller kept track of the exact time at which each transformation took place. The DPA also stresses that the pseudonymisation carried out by the controller does not yet imply the use of random secret keys diversified by statistical unit. Consequently, in the event of a security incident, even on a single statistical unit, the integration domain would be completely compromised once the syntax of the data is known. Finally, the DPA also found that the prescribed hierarchical decoupling mechanism of the codes in the various databases and its rotation over time had not yet been implemented. Therefore, the DPA considered that it was not possible to verify that two different pseudonyms deriving from the same master pseudonym code possibly contained in two different integration domains may refer to the same statistical unit. The DPA concluded that this violated Articles 25 and 32 GDPR. For the above reasons, the DPA held that the processing of personal data by the controller infringed Articles 5(2), 24, 25 and 32 GDPR and ordered the following corrective measures to bring the activities into compliance: a) comprehensively complete the source classification process, associating each class with the corresponding level of measurable risk of re-identification of the interested parties whose data are processed in each survey and the technical-organisational privacy by design and security measures capable to mitigate this risk; b) implement technical measures which, within each integration domain, and before proceeding with the survey, identify the possible presence of singularities on specific combinations of attributes configurable ex-ante and their percentage incidence in the sample, and which signal these with an alert occurrences to the analyst; c) develop an internal policy for the management of these singularities by the analysts responsible for carrying out the statistical survey, which possibly includes the possibility of reconfiguring the sample through the use of generalization techniques in order to eliminate, or in any case reduce, the incidence of these singularities; d) refine the process of "controlled reversibility" of derived pseudonyms, using a secret key that is more controllable than the millisecond time (e.g. a cryptographic salt) and storing these keys separately, as required by the definition of pseudonymization referred to in the Article 4(5) GDPR; e) use the master SIM pseudonym also for automated consistency checks on newly created statistical units (for example, uniqueness and accuracy checks) in place of the traditional "ictu oculi" checks on direct identifying attributes (such as name, surname, tax code), still widely used and a likely source of errors in the data entry process.