Istituto Tumori "Giovanni Paolo II" IRCCS – €10,000 Fine (Italy, 2024)

The DPA carried out an ex officio inspection at a research hospital in order to verify compliance with the provisions regarding the processing activities carried out for scientific research purposes in the medical, biomedical and epidemiological fields. Two clinical studies were analysed in terms of the following aspects: principles of lawfulness of processing, transparency to the data subject, retention period, accountability, privacy by design and by default, as well as the obligation to carry out a Data Protection Impact Assessment. The DPA held that the processing of personal data carried out for medical, biomedical and epidemiological research purposes in particular in study #1 and study #2, have been performed in breach of Article 5(1)(a) GDPR and Article 9(2)(j) GDPR, Article 35 GDPR, Article 12 GDPR, Article 13 GDPR and Article 14(5)(b) GDPR. The investigation revealed that the consent was collected in an inadequate manner. Such consent was not preceded by a full disclosure of at least its essential elements. In this sense, it was fundamentally flawed from the point of view of specificity and determinacy, according to Article 13 GDPR, and was considered contrary to the principles of transparency and fairness under Article 5(1)(a)GDPR. The DPA reinforced the importance of carrying out a prior DPIA on the processing of personal data for medical research purposes, in response to the controller's claim that it does so only when the study involves a particular type of profiling of patients' data or if there is an impact on their care through automated processing. In this regard, the DPA reaffirmed that the controller limited the preparation of the DPIA to fewer cases than it should have. The failure to carry out the DPIA beforehand in this case was considered a breach under Article 35 GDPR. It was also emphasised that the controller has the duty to issue a specific notice in respect of each individual research project, at least in order to provide information