Azienda Ospedaliero Universitaria Città della Salute e della Scienza di Torino – Violation Found (Italy, 2023)

Prior to conducting two medical research studies, the University Hospital Città della Salute e della Scienza di Torino (the controller) consulted the Italian DPA in accordance with Article 36 GDPR. The first study, "Head and neck tumours: relapses and second tumours," is a retrospective analysis focusing on 400 deceased or uncontactable patients, for which the request for prior consultation was deemed necessary. The hospital sought a favourable opinion from the DPA, in accordance with the GDPR and [https://www.garanteprivacy.it/codice Article 110 of the Italian Privacy Code], for processing personal data without obtaining consent due to practical difficulties in contacting patients. The study spanned seven years, involving pseudonymised data storage in accordance with the principles of data minimisation and storage limitation. The second study, "Use of coronagraphy and right heart catheterisation in the pre-liver transplant cardiological work-up," is a multi-centre, observational, retrospective study analysing liver transplant candidates. In this study, the hospital also sought a favourable opinion for processing personal data without consent, emphasising the challenges posed by the high mortality incidence of the patients. This study utilised as a legal basis Article 9(2)(a) GDPR for the processing of personal data of the living patients, meanwhile it requested, similarly to the first study, the prior consultation of the DPA pursuant to [https://www.garanteprivacy.it/codice Article 110 of the Italian Privacy Code] for those who are deceased. Moreover, in relation to the data processing of deceased patients, the study foresaw transparency measures for the family members of the deceased, such as information published on its website and those of participating centres, aligning with Article 14 GDPR. Following the information provided, for the first study, the DPA acknowledged the hospital's correct identification of legal bases for the data processing, including those for patients who may be deceased or unreachable. However, the DPA reminded the controller of its transparency obligations related to the processing operations pursuant to Article 5(1)(a) GDPR and Article 14(5)(b) GDPR. In that case, the DPA recommended that the information on the study be published on its website throughout the entire duration of the processing. Moreover, it positively recognised that the controller correctly applied Article 89 GDPR, providing that the data are subject to effective data minimisation techniques throughout the processing phase, as well as effective pseudonymisation and anonymisation techniques, consistent with the GDPR. Regarding the second study, the DPA commended the controller's identification of legal bases and transparency measures in line with Article 5(1)(a) GDPR and Article 14 GDPR. However, the DPA urged the controller to ensure the continuous availability of information on its website and those of participating centres, emphasising the importance of transparency throughout the data processing. Additionally, the DPA highlighted the necessity for the controller to specify the personal data protection roles of the participating centres in compliance with Articles 24, 26, and 28 GDPR and to enhance the impact assessment by detailing risk-specific mitigation measures, aligning with Article 35 GDPR. In both cases, the DPA granted a favourable opinion and underscored the controller's adherence to GDPR principles, emphasising the importance of continuous transparency, effective pseudonymisation, and risk-specific mitigation measures in processing personal data for medical research.