DPA case 9954241 – Complaint Upheld (Italy, 2023)

A data subject had undergone osteopathic treatments in a clinic by an osteopathist, the controller. At that time, the controller submitted her privacy policy to the data subject and asked for her consent for processing of her data for purposes of medical treatment and for scientific research. As a matter of fact, the controller included the clinical studies relating to the condition of the data subject in her final thesis in Osteopathy at a specialized school. The data subject claimed that the thesis included enough personal data about her, including her health status, clinical history, family composition, profession and other elements to make it possible to identify her. The data subject claimed that the data in question was unlawfully copied from the medical documents that she had shared with the controller only for purposes of medical treatment. The data subject also asked the controller information about the use of her personal health data in her final thesis and the controller denied that she wrote her thesis on the clinical case concerning the data subject. The data subject then decided to file a complaint with the Italian DPA. The DPA started an investigation and asked the controller and the school to provide their submissions. The controller provided the DPA with information about her privacy policy and the consent she requested from the data subject, where it is stated that the clinical data will not be shared with anyone with the exception of scientific research purposes. The privacy policy further specified that the personal data included in the controller’s thesis would be anonymized and that in any case the thesis would not be published and would only be available to the thesis supervisor and the administrative office of the school. The controller asked that no charges are raised against her and that the case is dealt with taking into account all attenuating circumstances of Article 83 GDPR. The school office also brought its submissions confirmin