DPA case 9356568 – Violation Found (Italy, 2020)

Under Article 36(5) GDPR, the Italian Ministry of Health has submitted the Data Protection Impact Assessment of the "Covid-19 Alert System" (and its official mobile application “Immuni”). The impact assessment, “supported by extensive documentation”, describes the technical and organizational measures adopted by the Ministry in order to ensure an appropriate level of security of the processing. In accordance with Article 36 GDPR, the Garante must decide on the adequacy of the intended processing under the GDPR. After careful examination, the Garante authorized the processing whilst prescribing further safeguards to be implemented within thirty days of the decision. Main integrations requested are as follows: - Describe the algorithm punctually within the Data Protection Impact Assessment, specifying configuration parameters, assumptions and other factors, and making it available to the scientific community; - Users should receive clear and intelligible information about the algorithm, also by means of infographics and similar tools; - Inform users about the possibility that the app generates exposure notifications that do not always reflect an actual risk condition (false "positives"); - Allow users to temporarily deactivate the app it through an easily accessible function; - Identify appropriate methods to protect the analytics in the app backend, avoiding any form of re-association to identifiable subjects, also adopting appropriate security measures and anonymisation techniques, to be identified according to the specific purposes actually pursued, in compliance with the principles of privacy by design and by default; - Integrate the impact assessment and privacy policies in relation to how to exercise the right of deletion and objection; - Integrate the impact assessment and describe in further details the role of processors and other subjects involved in the processing activities, highlighting the existence of any risks for the data subjects; - Only store th