Azienda Asl N.8 Di Cagliari – €18,000 Fine (Italy, 2023)

A data subject filed a complaint against the local health unit no. 8 of Cagliari, the controller, loss of biological data of genetic nature contained in the histological slides kept in some medical records and their unlawful destruction. The data controller and the data subject were parties to legal proceedings prior to this decision. Concerning the loss of data, according to an outsourced company (SISAR) which was responsible for the transfer of the samples from the Pathological Anatomy Department, the samples were correctly delivered to the Medical Records Office. However, more specific information about the recipients at the Medical Records Office was unavailable. Concerning the destruction of the same samples, the storage period for preserving the biological samples was minimum 10 years after which an assessment was required to determine whether the samples may or may not be destroyed. In this case, the controller allegedly failed to perform this assessment, as they did not consider pending legal proceedings where samples served as an evidence. The controller argued, based on the [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp215_en.pdf Article 29 WP Opinion 4/2007] on the concept of personal data, that the incident in question did not involve "personal biometric data". In particular, the controller emphasized that human tissue samples (like a blood samples) are sources out of which biometric data are extracted. As a result, collection, storage and use of tissue samples were subject to rules other than the GDPR. Firstly, the DPA considered that the controller breached the accountability principle under Article 5(2) GDPR for failing to effectively demonstrate their data processing operations, including deletion or destruction of the samples after the minimum 10-year period. In addition, the controller did not adopt methods to ensure traceability of the processed data throughout all stages of processing and they w