The AUTHORITY for the PROTECTION OF PERSONAL DATA at today's meeting, in the presence of Dr. Antonello Soro, President, dott.ssa Augusta Iannini, vice President, dott.ssa Giovanna Bianchi Clerici, prof.ssa Licia Califano, components and Dr. Joseph Busia, Secretary General; Having regard to the Legislative Decree June 30, 2003, n. 196, code regarding the protection of personal data (hereinafter "the code"); Visto l'art. 99, paragraph 1, of the code under which the processing of personal data for scientific purposes it is considered compatible with the different purposes for which the data have previously been collected or processed; Visto l'art. 107 of the code where it is established that, without prejudice to the provisions of art. 20 and out of cases of specific statistical surveys or scientific research provided by law, the data subject's consent to the processing of sensitive data, when it is required, can be supplied with simplified methods identified by the codes of ethics and conduct for the processing of personal data for statistical purposes or scientific purposes under art. 106 and authorization of the guarantor can also be issued in accordance with art. 40; Visto l'art. 110, paragraph 1, of the code that allows you to treat personal data revealing the health status for scientific research in medical, biomedical or epidemiological, even in the absence of consent, when due to particular reasons it is not possible to inform them and the research programme be the subject of reasoned favourable opinion of competent local Ethics Committee and is authorized by the sponsor , pursuant to art. 40 of the code; View the sponsor's permission No. 2/2014 to the processing of data disclosing health and sex life and, in particular, point 1.2 authorizing the processing of personal data revealing the health status for scientific research aimed at protecting the health of the person concerned, or of the collective in medical, biomedical or epidemiological, referring to the provisions of articles 106 , 107 and 110 of the code regarding the necessity to acquire the consent of the persons concerned; Having regard to the provisions of the code of ethics and conduct for the processing of personal data for statistical and scientific purposes (2 June 16, 2004, # Provv. Official Journal of August 14, 2004, # 190, Annex a. 4 the code and can be found on the website of the authority, doc. web n. 1556635) also apply to the processing of data carried out for purposes of medical research biomedical, epidemiological or not related health activities carried out by health professionals or organizations, or with merchants ' activities comparable in terms of significant custom fallout on the concerned (articles 11 and 2, paragraph 2); Visto l'art. 2 of d.lgs. June 24, 2003, n. 211 and subsequent amendments and integrations that defines "observational studies» studies in which" medicines are prescribed according to the directions of the marketing authorisation. The assignment of the patient to a particular therapeutic strategy is not decided in advance by a trial protocol but falls within the normal clinical practice and the decision to prescribe the drug and is completely independent of that to include the patient in the study. Patients does not apply any additional diagnostic or monitoring procedure "; Given that a large number of the processing of data suitable for disclosing health and, where necessary for the achievement of the purposes of research, of data disclosing sex life and racial and ethnic origin, are performed by different controllers for the conduct of case studies for scientific research in medical, epidemiological or biomedical custom fallout, not significant on the concerned, using data collected previously for the purpose of care of the persons concerned or for the execution of previous research projects, which is derived from biological samples taken earlier for health reasons or for the execution of previous research projects; Considered that the studies do not only aim to evaluate the safety and effectiveness of drugs and medical devices in clinical practice but also to verify its appropriateness prescriptive or to investigate the relationships between risk factors and human health, or relate to diagnostic, therapeutic or preventive health event type, or the use of social-sanitary structures; Considering that, in the context of these studies, the processed data are recorded in the clinical documentation (or the documentation regarding previous studies in which it was collected) kept at the healing centers participating in compliance with the law, or are derived from biological samples removed and preserved in the archives of pathology of such centres or taken under previous research projects; Having regard to the specific measures of authorisation issued by the authority, under article 110, paragraph 1 (last part) and 41 of the code, with which it was authorized, even in the absence of consent, non-significant studies, personalized relapse on concerned, made with previously collected data for purposes of health protection of the persons concerned or obtained from biological samples collected previously for the same purpose; What, in that, because of proven special reasons, it's been documented the inability to provide them with the information on the processing of data and its research program received a reasoned favourable opinion of the Ethics Committee has jurisdiction; Considering that the processing of data in question may be authorised by the Garante also ex officio with General measures relating to certain categories of holders or treatments (article 40 of the code); Given that the general authorisation issued in accordance with art. 40 of the code, on December 12, 2013, in relation to the processing of data disclosing health status for purposes of scientific research carried out, even in the absence of consent, for conducting studies, which are not affected, with significant custom fallout on previously collected data for purposes of health protection or derived from biological samples collected previously for the same purpose and is found to be an appropriate instrument to prescribe uniform measures to guarantee of the persons concerned, making also superfluous requesting permission from numerous individual measures data controllers and simplify significantly the obligations relating to the processing of data for conducting medical research , epidemiological or biomedical; Considered appropriate in the light of experience gained, issue a new license to replace the one expiring on December 31, 2014, harmonizing the requirements already issued in the light of experience gained; Considered it appropriate that this new permission is temporary and fixed term, pursuant to art. 41, paragraph 5, of the code and, in particular, effective for the 12-month period; Felt also appropriate, pursuant to the provisions of art. 110 of the code (last part), take into account for the purposes of this authorisation the treatments for scientific research which studies are preordered the reasoned opinion of the Ethics Committee at the regional level, is not sufficient for this purpose the formation of silence/consent following the notification of the said study Committee; Considering that, by virtue of art. 11 of the code of conduct for the processing of personal data for statistical and scientific purposes, consent is not required when, pursuant to art. 110 of the code, it is not possible to inform interested parties for "ethical reasons", namely for methodological reasons ' or ' for ' grounds for organizational impossibility '; Considering that, in applications so far submitted to the authority, the impossibility to inform interested parties was justified on the basis of ' ethical ' or of ' grounds for organizational impossibility '; Considered appropriate and then, in the light of experience gained, that data disclosing health status for scientific research preordered the medical studies, biomedical or epidemiological studies in which the impossibility to inform those concerned is justified by ' methodological reasons» undergo specific measures for authorization of the guarantor; Felt that the treatments covered by this authorisation shall also apply the precautions contained in the general authorization of the guarantor n. 2/2014 and in the code of conduct above, in particular for what concerns the criteria to keep in mind not to identify those interested in subsequent phases of the study to the extrapolation of data and the rules of conduct for officers and supervisors; Noted that the possible collection and storage of biological samples, as well as the resulting data processing must be carried out in accordance with the fundamental principles of protection and data security (see Council of Europe recommendation No R (92) 3 on genetic testing and genetic screening for health purposes; Working document on genetic data of the Group Art. 29 of the Dir. 95/46/EC, WP 91/2004); Considering that the use of biological samples in the context of research involving genetic data extrapolation must be carried out in accordance with the limits and conditions contained in the general authorization of the guarantor # 8/2014 the processing of genetic data, released on December 11, 2014 in accordance with art. 90 of the code; View also the Council of Europe recommendation No. R (2006) 4 that identifies the conditions and limits in respect of which it is allowed the use of biological materials for research, also belonging to deceased persons, taken for a purpose other than that of its preservation for research, including that taken for the execution of a previous research project; considered that this recommendation States that the biological material collected for the purposes of conservation research purposes can be made available for research activities with the consent of the person concerned and that, to that end, it should be done every reasonable effort to contact the person concerned, while if such contact is not possible, the biological material can be used for research only if they satisfied certain requirements (articles 10 , 12, 21 and 22); Having regard to the code of medical ethics of May 8, 2014 insofar as it provides for the obligation of professional secrecy by the doctor also in relation to patients who died (article 10); Whereas this authorization takes into consideration those residual hypothesis, permitted by the Code (article 110), where the necessary consent for the processing of sensitive data for the purpose of scientific research in medical, biomedical or epidemiological study has not been previously collected by data controllers, there are special safety conditions from which derives the impossibility to inform interested parties and the search cannot be performed using anonymous data or personal data treatment to individuals who can be contacted in order to make the information referred to in art. 13 of the code; Noted that, in accordance with the principles, referred to in art. 2, paragraph 2, of the code, simplification, harmonisation and effectiveness of the method of exercise of the rights of the persons concerned and of the obligations of data controllers, it is hoped that the information on the processing of data disclosing health status for scientific research can be demonstrated to interested at the same time as the one on the processing of data for care , sort by data controllers who pursue scientific research purposes along with housing and care activities; Considered that, in the context of that information provided to the person concerned, a distinction must be drawn clearly, with respect to the indication of the elements referred to in art. 13 of the code, the treatments carried out for scientific research than those intended to protect the health, highlighting in particular the intent of participation in research, so as to enable the person concerned to manifest specific and free consent knowingly compared with different purposes (articles 13, 23, 78, paragraph 5, and 105, paragraph 2, of the code); Visto l'art. 11, paragraph 2, of the code, which stipulates that the data processed in violation of the regulations governing the processing of personal data may not be used; Having regard to articles 31 and following ones of the code and the technical regulations specified in Annex B) to the same code regarding minimum security measures; Having regard to articles 20, 26, 40, 41, 98, 107 and 110 of the code; Having regard to article 162, paragraph 2-bis, 167, paragraph 2, and 170 of the code laying down penalties for unlawful processing of personal data and non-compliance with provisions of the guarantor; Having regard to official acts; Having regard to the observations of the Office of the Secretary General in accordance with art. sponsor 15 of Regulation No 1/2000; The rapporteur prof.ssa Licia Califano;
Authorize the processing of data suitable for disclosing health and, only where necessary for the achievement of the purposes of research, data revealing racial or ethnic origin and sex life, even in the absence of consent, for purposes of scientific research in medical, epidemiological or biomedical respecting the limits and conditions set forth below. 1. scope of application. This authorization is issued: a) to universities and other institutions or research institutions and scientific societies, as well as to researchers working within the scope of such universities, government agencies, research institutions and members of such scientific societies;
b) merchants healthcare professions and the medical institutions within the limits of art. 2, paragraph 2, of the code of ethics and conduct for the processing of personal data for statistical and scientific purposes (annex a. code 4). The data covered by this authorisation can be also carried out by natural or legal persons, bodies, associations and private bodies, as well as those specifically in charge of processing such as agents or managers (researchers, monitors, panels of experts, contract research organisations, laboratories, etc.) (articles 4, paragraph 1, point f), 28, 29 and 30 of the code). 2. purpose of data processing: scientific research in medical, epidemiological or biomedical. 1. This authorization is issued when the treatment is necessary for the conduct of studies, not having significant custom on relapse interested, made with previously collected data for health care or for the execution of previous research projects which is derived from biological samples taken earlier for health reasons or for the execution of previous research projects and research is carried out on the basis of a draft reasoned favourable opinion of competent, ethical Committee at the regional level, in accordance with the modalities laid down in art. 3 of the code of ethics and conduct for the processing of personal data for statistical and scientific purposes (annex a. code 4). The studies covered by this authorisation may also concern the relationships between risk factors and human health, or aim to evaluate the safety and efficacy of drugs or medical devices in clinical practice, or to verify the appropriateness or prescriptive focus on diagnostic, therapeutic or preventive health events — on the use of social-sanitary structures. 2. This authorization does not affect the scope of research that can be made, in the concrete case, through: the treatment of anonymous data;
the treatment of data refers to persons who can be contacted in order to make the information and gain consensus. 3. Categories of data processed. Before you begin or continue treatment systems and computer programs are configured by minimising the use of personal and identification data, in order to exclude the treatment when the aims pursued in individual cases may be carried out by, respectively, anonymous data or suitable methods to identify the interested only in case of necessity, according to art. 3 of the code. The treatment can be provided for personal data strictly relevant to the above purposes, including those derived from biological samples, except that these are not "genetic data ' for the purposes of the authorization # 8/2014 issued by the guarantor in virtue of art. 90 of the code. The processing of genetic data is authorized subject to the limits and conditions identified in the aforementioned authorization. 4. Inability to inform interested parties. The authorisation concerns the processing of data of the persons concerned to be included in research that it is possible to contact in order to provide the information-due to the existence of any of the following reasons, considered unusual or unique completely documented in the research project: 1. Ethical reasons arising from the circumstance that he ignores his condition. This category includes searches for which the information on the processing of data to be made to those concerned would involve the revelation of news concerning the conduct of the trial, knowledge of which would cause material or psychological damage to the interested parties themselves (can fit into this hypothesis, for example, epidemiological studies on deploying a factor that preaches or can predict the development of a morbid condition for which there is no treatment).
2. grounds of impossibility attributable to organizational circumstance that the failure to take account of data referring to the estimated number of interested that it is possible to contact to let them know, compared to the total number of subjects you intend to engage in research, would have significant consequences for the study in terms of altering the results thereof; What account being taken in particular of the criteria laid down by the study, the method of enrollment, the size is chosen as the sample statistical period of time elapsed from the moment data to interested parties It was originally collected (for example, in cases where the study concerns involved with high infant mortality or incidence diseases in terminal stage of the disease or advanced age and serious health conditions). With reference to these grounds of impossibility of organization, and authorized the processing of data of those who, upon a reasonable effort made to contact them, including by checking the status in life, consulting the data in medical records, the use of telephone numbers that may be provided as well as contact data capture at the Registry Office of assisted or resident population estimates , are at the time of enrollment in the study have died or not contactable. It is understood the obligation to collect the consent to the processing of data of interested parties included in the search in any case where, in the course of the study, it is possible to make them adequate information and, in particular, where they turn to the treatment center, also for check-ups. 5. method of treatment. The data covered by this authorization is carried out in accordance with the provisions of the code of ethics and conduct for the processing of personal data for statistical and scientific purposes (annex a. code 4) and solely with operations strictly necessary to the conduct of the trial. If the search cannot achieve its aims without identification, even temporary, of the persons concerned, in the treatment following the retrospective collection of data encryption techniques are adopted or used identification codes or other solutions that, considering the number of data processed, make them not directly related to the persons concerned, allowing to identify the latter only in case of necessity. In these cases, the codes used are not deducible from personal identification data of the persons concerned, unless this proves impossible because of the special characteristics of the treatment or would require a manifestly disproportionate effort and be motivated, also in writing, in the research project. With the identification data of the person concerned, research material as long as it is temporary and essential for the result of the search, it is reasoned, moreover, in writing. 6. communication and dissemination. The persons identified in paragraph 1) that act as data controllers, also jointly with other owners, can communicate with each other personal data covered by this license to the extent that play the role of promoter, Center Coordinator or participant Center and communication is essential to the conduct of the trial. The data reveal the State of health of the persons concerned, as well as those related to sexual life and racial and ethnic origin are used for the conduct of the study cannot be disclosed. The results of the research can be disseminated in aggregate form, that is, according to methods that do not render identifiable interested parties even via indirect identification, even under publications. 7. retention of data and samples. Within the framework of compliance with the obligation laid down in art. 11, paragraph 1, point e) of the code, data and biological samples used for performing the search are stored using encryption techniques or use of identification codes or other solutions that, considering the number of data and samples stored, don't make them directly related to the persons concerned, for a period not exceeding that necessary for the purposes for which they were collected or subsequently processed. To this end, it is indicated in the research project the retention period, following the end of the study, after which these data and samples are processed anonymously. 8. safekeeping and security. Subject to the requirement to adopt the minimum security measures provided for by the code (articles 33-35 and All. B) to code), are employed by the holder of the processing, each for their part in connection with the role played in the processing of data and the consequent responsibility, specific measures and technical measures to increase the security level of data processed for the conduct of the study in accordance with instructions contained in the "guidelines for the processing of personal data in the context of clinical trials of medicines taken by the guarantor by decision of July 24, 2008 (doc. Web # 1533155). What, both during storage or data storage (and possibly of collection and storage of biological samples) is in the next stage of processing of that information as well in the next phase of data transmission to the promoter or third parties that collaborate with the first for the conduct of the study. Shall be adopted, in particular: a. suitable measures to ensure the protection of data against the risk of unauthorized access to data, lost or stolen integral or partial storage media or portable or fixed computer systems (for example, through the application of all or part of a file system or database encryption technologies, or by adopting other measures which render unintelligible data protection information to persons not entitled) recording and archiving operations data by electronic means;
b. secure communication protocols based on the usage of cryptographic standards in electronic transmission of data collected as part of the study to a centralized database that stores or stored as data in electronic transmission of the study to the promoter or third parties of which the promoter has appointed to conduct of the trial. Where such transmission is carried out by means of optical media (CD ROM) and is designated a charge of receipt at the promoter and is used, for sharing the data encryption key, a different channel than the one used for the transmission of content;
c. labeling techniques, storage and transmission of biological samples, using identification codes, or other solutions that considering the number of samples used, make them not directly related to the persons concerned, allowing to identify the latter only in case of necessity;
q. with regard to the processing of data stored on a centralized database, it is necessary to adopt: suitable systems of authentication and authorization for those responsible according to the roles and requirements of access and treatment, making sure to use credentials of validity limited to the duration of the study and to turn them off at the end of the same;
procedures for the periodic assessment of the quality and consistency of authentication credentials and authorization profiles assigned to the Trustees;
log audit systems to control access to the database and to detect any abnormalities. 9. transfer abroad. If it is essential for the search result transfer data suitable for disclosing health and sex life, as well as those related to racial and ethnic diversity of stakeholders included in the study in countries outside the European Union, in the absence of express consent, in writing, of the persons concerned (article 43, paragraph 1, point a), of the code), the transfer is authorized by the guarantor in the presence of additional conditions under art. 43 of the code, or in accordance with articles 44 and 45 of the code. 10. Permission requests. Data controllers falling within the scope of this authorisation shall not be required to submit an application to this authority, if the treatment that you intend to comply with its instructions. Permission requests submitted or received, even after the date of adoption of this decision, shall be accepted in the terms referred to in the provision itself. The guarantor does not take into account requests for authorisation, pursuant to art. 110 of the code (last part), for treatments to be made – to the requirements of this provision, except that, pursuant to art. 41 of the code, their acceptance is justified by circumstances or situations that are not covered by this license. 11. Application in time. This authorization shall become effective as from 1 January 2015 until December 31, 2016. This authorization will be published in the official journal of the Italian Republic.
Rome, December 11, 2014 President: Soro the rapporteur: C. the Secretary-General: Busia