Azienda Socio Sanitaria Territoriale degli Spedali Civili di Brescia – Violation Found (Italy, 2024)

Azienda Socio Sanitaria Territoriale degli Spedali Civili di Brescia (‘controller’) requested a prior consultation pursuant to Article 36 GDPR as a promoter of a retrospective study called ‘Artificialintelligence for the definition of new signatures and models for the personalisation of organ preservation strategies in laryngeal and hypopharyngeal cancer – PRESERVE’ (‘study’). The study's goal is to make a model that can predict how well a patient will respond to a certain kind of chemotherapy for throat cancer. By looking at information about the patient and their cancer, such as their medical history, test results, and genetic makeup, researcher hope to find out quickly if this chemotherapy will work. This could help keep more patients from needing surgery and improve their quality of life, while also making the treatment more cost-effective. The study is part of a European Project on personalized medicine. The objective scope of the request for prior consultation refers exclusively to the retrospective collection of data required for Phase 1 of the European project aimed exclusively at the "development of a predictive algorithm" which forms basis for Phase 2 in which the artificial intelligence logic will be used. Due to the aggressiveness of the disease, most of the patients who would be enrolled for retrospective data collection are deceased or non-contactable. The company, therefore, identified Article 9(2)(j) GDPR as the legal basis for the processing of personal data relating to these individuals which allows for processing of special categories of data for archiving purposes, among others, in the public interest or scientific research purposes. Additionally, the Company stated that in compliance with the provisions of Article 14(5)(b) GDPR, the controller, prior to the start of the study, will make public the relevant information through a specific advertisement on its corporate websites. The controller identified different data retention periods (10 and 25 years) and hypothetical further retention of the data which is in compliance with the rules set by the Lombardy Region about maximum data discard rates approved. The controller also provided a single document with information to be provided to the interested parties based on Article 13 GDPR and to non-contactable persons based on Article 14 GDPR. The information notice includes the right to object to the processing. It is also represented that to ensure security of data, the data will not be disseminated under any circumstances, but only in cases of scientific publications and a strictly anonymous and aggregate form. The Garante issued a favorable opinion on the processing of personal data in relation to deceased or non-contactable persons involved in the study. However, several aspects must be considered and improved by the controller. Firstly, the company identified the correct legal basis for the processing of data concerning deceased and non-contactable people. On this point, it is considered necessary for the controller to keep track of the contact attempts made to persons who are currently non-contactable. At least three attempts at contact constitutes a reasonable and proportionate effort. Therefore, the three unsuccessful attempts are a condition to use the legal basis under Article 9(2)(j) GDPR. The Garante stressed the importance of having information about people who have passed away or are not reachable. Without this data, the group of people studied would not be complete, which could affect how accurate the algorithm is. To make sure everyone involved in the study is treated fairly and transparently, the company needs to share information even with those who cannot be contacted or have passed away. This includes putting information on the websites of all 20 participating centers in Italy, where the study is taking place. Secondly, the company plans to keep the data for 10 years after the end of the study, which is correct because the researchers need that time to analyze the data and verify the results. However, a 25-year retention period, similar to rules for drug trials, did not apply here and was therefore incorrect. Thirdly, the living data subjects involved in the study do not enjoy a right to object to how their data will be used, but they do have broader rights of revocation of consent and subsequent erasure. For this reason, the controller must delete any reference to the right to object in the information notices provided pursuant to Article 13 and 14 GDPR. Additionally, the information notice should be dived in two parts, for those who are considered interested parties and those non-contactable to ensure the information about how they use personal data is clear and easy to understand. Fourthly, the controller also needs to be transparent about the methods and algorithms they use to process this data as per Article 5(1)(a) GDPR. This helps build trust and ensures that experts can check and verify the process. The company should publish an impact assessment pursuant to Article 35 GDPR on their website, along with a list of the mathematical and statistical models they use and how they use algorithms. Fifthly, the company assures that personal data from the clinical trial will not be shared at all. However, it might be shared anonymously, like in scientific publications or conferences. It is emphasized that the data will be made anonymous after processing. When sharing grouped data, there's a risk of identifying individuals through statistical analysis. To avoid this, the number of statistical groupings should be much lower than the number of variables considered. Lastly, the company should regularly check how effective their anonymization techniques are and make adjustments if needed, to prevent any chance of re-identifying individuals.