Azienda Socio Sanitaria Territoriale degli Spedali Civili di Brescia – Violation Found (Italy, 2024)

Azienda Socio Sanitaria Territoriale degli Spedali Civili di Brescia (‘controller’) requested a prior consultation pursuant to Article 36 GDPR as a promoter of a retrospective study called ‘Artificialintelligence for the definition of new signatures and models for the personalisation of organ preservation strategies in laryngeal and hypopharyngeal cancer – PRESERVE’ (‘study’). The study's goal is to make a model that can predict how well a patient will respond to a certain kind of chemotherapy for throat cancer. By looking at information about the patient and their cancer, such as their medical history, test results, and genetic makeup, researcher hope to find out quickly if this chemotherapy will work. This could help keep more patients from needing surgery and improve their quality of life, while also making the treatment more cost-effective. The study is part of a European Project on personalized medicine. The objective scope of the request for prior consultation refers exclusively to the retrospective collection of data required for Phase 1 of the European project aimed exclusively at the "development of a predictive algorithm" which forms basis for Phase 2 in which the artificial intelligence logic will be used. Due to the aggressiveness of the disease, most of the patients who would be enrolled for retrospective data collection are deceased or non-contactable. The company, therefore, identified Article 9(2)(j) GDPR as the legal basis for the processing of personal data relating to these individuals which allows for processing of special categories of data for archiving purposes, among others, in the public interest or scientific research purposes. Additionally, the Company stated that in compliance with the provisions of Article 14(5)(b) GDPR, the controller, prior to the start of the study, will make public the relevant information through a specific advertisement on its corporate websites. The controller identified different data retention periods (10 an