In their article, Fairchild and Johns show how the gradual increase in limits to research is being followed by a contrasting tendency.1 Some recent developments in Italy, which also impact the international community, confirm this tendency with regard to the protection of personal data. The Italian Data Protection Authority recently adopted the General Authorisation to Process Personal Data for Scientific Research Purposes,2 marking a considerably more relaxed approach. Authorization shall be granted in particular “to universities, other research bodies or institutions and scientific societies” as well as to researchers and members of these institutions. In addition,
this Authorisation shall be granted if:
the processing of data that are suitable for disclosing health for scientific research purposes in the medical, bio-medical or epidemiological sectors is necessary to conduct studies that do not entail any significant personalized impact on data subjects and rely on data that were collected beforehand for health care purposes and/or to implement prior research projects and/or on data that were extracted from biological samples removed beforehand for health care purposes and/or to implement prior research projects; and the research is performed on the basis of a project that received a reasoned favorable opinion from the geographically competent ethics committee.2
The Deliberation authorizes “the processing of personal data suitable for disclosing data subjects’ health, also without their informed consent” for retrospective observational studies, with a series of “limitations and conditions.” It specifically “applies to the processing of data subjects' data to be included in the scope of a research where contacting such data subjects to provide them with information on the processing of their data proves impossible” on “ethical” or “organisational grounds.”2
Ethical grounds “have to do with the fact that the data subject is unaware of the respective health condition. This applies to any research if providing information to data subjects on processing of their data entails the disclosure of information on the specific study being carried out, which information might cause tangible or mental harm.”3 Organizational grounds “have to do with the fact that the failure to include the data relating to the estimated number of data subjects that cannot be contacted in order to be informed … would impact significantly on the study by altering the relevant findings.”3 The Authorization does not apply to genetic data for which special authorization is required.3
References
- 1.Fairchild AL, Johns DM. Beyond bioethics: reckoning with the public health paradigm. Am J Public Health. 2012;102(8):1447–1450 [DOI] [PMC free article] [PubMed] [Google Scholar]
- 2. Garante per la Protezione dei Dati Personali. General Authorisation to Process Personal Data for Scientific Research Purposes. Deliberated March 1, 2012. Gazzetta Ufficiale della Repubblica Italiana. n. 72. Available at: http://www.garanteprivacy.it/garante/doc.jsp?ID=1884019. Published March 26, 2012. Accessed August 2, 2012.
- 3. Garante per la Protezione dei Dati Personali. General Authorisation for the Processing of Genetic Data. Deliberated June 24, 2011. Gazzetta Ufficiale della Repubblica Italiana. n. 159. Available at: http://www.garanteprivacy.it/garante/doc.jsp?ID=1909957. Published July 11, 2011. Accessed August 2, 2012.