GPDP – Court Ruling (Italy, 2025)

The controller for the case is Azienda Sanitaria Friuli Centrale (ASUFC), a local health authority. In 2020 the local government of Friuli Venezia Giulia issued a resolution that required the controller to carry out a large-scale analysis of Covid-related health risks for the resident population of the region of Friuli (the data subjects). During this analysis, individuals from vulnerable populations (such as the elderly) were assigned a score representing their vulnerability to covid. The results were disclosed to medical practitioners for the purpose of preventive intervention- especially with regards to vaccination priority. The processing was based on health data, including information in the data subjects’ electronic health file. The local government gave precise instructions to the health authority, including the instruction to appoint specific processors. The DPA investigated the processing and held that it was unlawful. Additionally, the DPA held that the controller violated its transparency obligations and failed to carry out a DPIA. On these grounds, the DPA fined the controller €50,000. The decision was later annulled by the civil courtCivil courts are competent to review the DPA’s decisions (see Art. 152 d. lgs. 196/2003). This is an exception to the general rule that administrative decisions are reviewed by administrative courts. (Tribunale di Udine). Contrary to the DPA’s findings, the Court held that the processing was lawful and that a DPIA was not required under the GDPR. The GPDP challenged the civil court’s decision with Italy’s Supreme court (Cassazione). Contrary to the lower court’s findings, the Cassazione held that the controller unlawfully processed sensitive data. In this regard, the Court first noted that Italian law lists different purposes for the processing of health data within the electronic health file. Among those, only the purposes related to individual treatment (i.e.: “prevention, diagnosis, health care, and rehabilitation”) are covered by the data subject’s consent. The Court held that the processing of personal data for the purpose of preventive medicine, did not fall among these purposes and was not covered by consent. Furthermore, such processing was not carried out with a compatible purpose under Article 5(1)(b) GDPR because Italian law requires the pseudonymization of any data from health files when such data are used for research. The controller did not pseudonymized the data in the case at hand. Additionally, the Court held that due to intricacies of Italian administrative lawIn particular, Italy’s so-called “privacy code” (specifically, Articles 2-ter and sexies) specifies the scope of Articles 6 and 9 GDPR by listing the domestic legal sources that controllers can invoke when claiming that they are carrying out a task in the public interest (6(1)(e)) or that their processing of personal data is necessary for reasons of substantial public interest (9(2)(g)). The code was amended in 2021 to include “general administrative acts” (such as the local government’s deliberation in the case at hand) among the legal sources relevant to Articles 6(1)(e) and 9(2)(g) GDPR. The Court concluded, a contrario, that such administrative acts were not covered by Articles 2-ter and sexies in 2020, when the data were processed., the controller could not rely on Articles 6(1)(e) and 9(2)(h) GDPR. Finally, the Court held that Italian law did not sufficiently clarify the safeguards for data subjects, as required by Article 9(2) GDPR under letters (g), (h), and (i). For the reasons above, the Cassazione annulled the civil court's ruling and ordered the court to rule again. The civil court is now bound to the Cassazione's findings on the law.