DPA case 9578184 – Violation Found (Italy, 2021)

On the 22nd of April 2021, the Decree Law (decreto legge) n° 52/2021 was adopted by the Italian Government. The decree introduced urgent measures to contain and combat the Covid-19 epidemic, and in particular it introduces a “green certification” that allows citizens to move between orange and red-coded territories within Italy, as well as to participate in some events under certain circumstances. A citizen can therefore ask for a green certification to be issues after completion of the vaccination process, recovery from Covid-19, or following the negative results of a quick antigenic test or a molecular test. Depending on these cases, the certification will have a different period of validity. These provisions are applicable until the national “Digital Green Certificate” platform (DGC) will be activated by the delegated acts for the implementation of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021PC0130 Digital Green Certificate Regulation], which is still being negotiated by EU institutions. The decree law also provides for the Prime Minister to adopt a decree to implement “technical specifications to ensure the interoperability of the Covid-19 green certifications and the national platform for the DGC”, and of those with other EU Member States’ platforms. Finally, Decree Law 52/2021 provides that, “pending the adoption of the aforementioned implementing decree, public and private healthcare facilities, pharmacies, general practitioners and freely chosen paediatricians may, however, issue the aforementioned green certificates, ensuring the completeness of the elements indicated” in an Annex 1 to the decree law. According to the Garante, the Government failed to adequately take into account the risks posed by the above-mentioned measures to the rights and freedoms of data subjects, and hence failed also to adopt “the appropriate technical and organisational measures […] to effectively implement the principles of data protection”. In particu