General Authorisation for the Processing of Genetic Data - 22 February 2007 
[doc. web n. 1395420]
[ doc. web n. 1389918]
General Authorisation for the Processing of Genetic Data
The Garante per la protezione dei dati personali
Having convened today, with the participation of Prof. Francesco Pizzetti, President, Dott. Giuseppe Chiaravalloti, Vice-President, Dott. Mauro Paissan and Dott. Giuseppe Fortunato, Members, and Dott. Giovanni Buttarelli, Secretary General;
Having regard to legislative decree no. 196 of 30 June 2003, containing the Personal Data Protection Code, hereinafter referred to as the "Code";
Having regard to, in particular, section 90(1) of the aforementioned Code, whereby the processing of genetic data by whomsoever shall only be allowed in the cases set out in an ad-hoc authorisation to be issued by the Garante after consulting with the Minister of Health, who shall act on the opinion handed down, to that end, by the Consiglio Superiore di Sanità;
Having regard to section 90(2) of the Code, whereby the authorisation shall also specify the additional items to be included in the information notice pursuant to section 13, with particular regard to the purposes sought and the results that may be achieved also in respect of such unexpected findings as may be disclosed following the processing of data in question as well as in respect of the right to object to the said processing on legitimate grounds;
Having regard to the Garante´s general authorisation no. 2/2005 concerning the processing of data suitable for disclosing health and sex life, which expressly refers (point 1.4) to authorisation no. 2/2002 (point 2, letter b) ), whereby any genetic data that is processed for the purposes of prevention, diagnosis and/or therapy in respect of the data subject, or else for scientific research purposes, "may be used exclusively for the said purposes or in order to allow the data subject to make a free, informed decision, or else for the purpose of providing evidence in civil and/or criminal proceedings pursuant to the law";
Whereas it is necessary to ensure a high level of protection for fundamental rights and freedoms as well as for human dignity in regulating the processing of personal data, with particular regard to the right to the protection of personal data set forth in section 1 of the Code; whereas in doing so, one has also to minimise the risk of causing harm and/or dangers as evaluated on the basis of the recommendations adopted by the Council of Europe with regard to medical data, in particular Recommendation No. R(97)5 – whereby genetic data is all data, of whatever type, concerning the hereditary characteristics of an individual or concerning the pattern of inheritance of such characteristics within a related group of individuals (article 1), and such data, within the framework of the broader category of "medical data", may only be processed under certain conditions (article 1);
Whereas Council of Europe´s Recommendation No. R(92)3 on genetic testing and screening for health care purposes provides (principle no. 8) that the collection and storage of substances and of samples, and the processing of information derived therefrom, must be in conformity with the Council of Europe´s basic principles of data protection and data security laid down in the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, No. 108 of 28 January 1981, and the relevant Recommendations of the Committee of Ministers in this field;
Whereas other important principles applying to the processing of genetic data can be found in some international and Community instruments including
a. the Convention on Human Rights and Biomedicine, done in Oviedo on 4 April 1997, which prohibits any form of discrimination against a person on grounds of his or her genetic heritage (article 11) and allows for the performance of predictive genetic tests exclusively for health purposes or for scientific research linked to health purposes subject to appropriate genetic counselling (article 12);
b. UNESCO´s Universal Declaration on the Human Genome and Human Rights of 11 November 1997, which provides that everyone has the right to respect for their dignity and rights regardless of their genetic characteristics (article 2) and prohibits any discrimination based on genetic characteristics that is intended to infringe or has the effect of infringing human rights, fundamental freedoms and human dignity (article 6);
c. The Charter of Fundamental Rights of the European Union, proclaimed at Nice on 7 December 2000, which prohibits any form of discrimination based, in particular, on genetic features (article 21);
d. Directive 2004/23/EC of the European Parliament and of the Council of 31 March 2004, which requires that all necessary measures be taken to protect data, including genetic data, and additional safeguards be implemented with regard to information gathered in connection with donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells intended for human applications and of manufactured products derived from human tissues and cells intended for human applications (article 14).
e. The Convention on Human Rights and Biomedicine (article 10), the Universal Declaration on the Human Genome and Human Rights (article 5, letter c) ), and UNESCO´s International Declaration on Human Genetic Data (article 10), which set out, with regard to the respective scope of application, everyone´s right to decide whether or not to be informed about the results of genetic examinations and their consequences (or else about the results of medical and scientific research where the genetic data, human proteomic data or biological samples are used for such purposes);
f. The Code of Practice of the International Labour Organisation on the protection of workers´ personal data (November 1996), under which genetic screening of workers should be prohibited or limited to specific cases as expressly authorised by domestic legislation (article 6.12);
g. The World Medical Association Helsinki Declaration (of June 1964, as subsequently amended), under which it is necessary to obtain the assent of a legally incompetent person, in addition to the assent of the legally authorised representative, where the said person is able to give assent to participation in research (paragraph 25);
h. The Working Document on Genetic Data adopted on 17 March 2004 by the Article 29 Working Party (WP91), which refers to the need to also take into consideration and regulate the legal status of biological samples, which are also liable to be sources of personal data, among the necessary safeguards to be afforded in respect of genetic data;
Having regard to Act no. 40 of 19 February 2004 on "Provisions Applying to Medically Assisted Reproduction";
Having regard to the Agreement reached on 15 July 2004 among the Minister of Health, Regions, and the Trento and Bolzano autonomous Provinces with regard to the document containing "Guidelines for Medical Genetics Activities" (published in the Official Journal no. 224 of 23.09.2004);
Having regard to legislative decree no. 191 of 19 August 2005, implementing directive no. 2002/98/EC, which sets quality and security standards for the collection, testing, processing, storage and distribution and human blood and blood components;
Having regard to Act no. 219 of 21 October 2005, regulating blood transfusion and the national production of blood derivatives, as well as to the order by the Minister of Health dated 13 April 2006 concerning "Urgent Measures with regard to Umbilical Cord Stem Cells" (published in the Official Journal no. 106 of 09.05.2005);
Whereas under sections 76 and 81 of the Code, health care professionals and public health care bodies may process personal data suitable for disclosing health in order to protect the data subject´s health and/or bodily integrity exclusively with the data subject´s consent, and they may process the said data also without the data subject´s consent, upon the Garante´s prior authorisation, if it is necessary to protect health and/or bodily integrity of either a third party or the social community;
Whereas sections 77, 78 and 79 of the Code lay down simplified arrangements in order for health care professionals and public health care bodies to provide the information referred to in section 13 thereof;
Having regard to the Garante´s decision dated 19 July 2006 (www.garanteprivacy.it, no. 1318699) setting out the essential items of information general practitioners and paediatricians are required to include in the information notices to be provided to data subjects with regard to the processing of personal data, in pursuance of section 78(3) and section 13(3) of the Code;
Whereas under sections 23 and 26 of the Code, private bodies and profit-seeking public bodies may only process sensitive data upon the Garante´s prior authorisation and – where necessary – with the data subject´s written consent;
Whereas a considerable number of processing operations concerning genetic data are performed for the purposes of prevention, diagnosis and/or therapy in respect of data subjects, as well as for scientific research purposes;
Whereas under section 40 of the Code, general authorisations applying to specific categories of data controller and/or processing may be issued and such authorisations have proved suitable so far in order to lay down unified measures aimed at safeguarding data subjects;
Whereas it is appropriate to issue the specific authorisation mentioned in section 90 of the Code to replace the requirements already set out with regard to genetic data in the Garante´s general authorisation no. 2/2002, which is referred to in authorisation no. 2/2005;
Whereas it is appropriate to issue a separate provision in order to take account of the processing of genetic data that is carried out by the categories of public body mentioned in Titles I, II and III of Part II of the Code;
Whereas any other processing operations concerning genetic data that are not referred to herein shall be regarded as unlawful, except for those mentioned above, including employers´ activities aimed at establishing employees´ and/or job candidates´ professional eligibility, irrespective of whether such activities are grounded on the data subjects´ consent, and the activities carried out by insurance companies;
Having regard to sections 41 and 167 of the Code;
Whereas it is appropriate that also this new authorisation should be in force for a limited time, without prejudice to whatever decisions concerning additions and/or amendments thereto also in the light of the rapid pace of development of genetics research and technologies as well as of the evolution of the knowledge base in this area;
Having regard to section 11(2) of the Code, which provides that any data that is processed in breach of the relevant personal data protection legislation may not be used;
Having regard to section 31 et seq. of the Code and to the technical specifications contained in Annex B thereto, containing provisions and rules in respect of security measures;
Having consulted with the Minister of Health, who acted upon the opinion issued by the Consiglio Superiore di Sanità in pursuance of section 90 of the Code;
Having regard to the considerations submitted by qualified experts in this sector, at the Garante´s request;
Having regard to official records;
Having regard to the considerations submitted by the Secretary General in pursuance of article 15 of the Garante´s Rules of Procedure no. 1/2000;
Acting on the report submitted by Prof. Francesco Pizzetti;
the processing of genetic data by the entities specified hereinafter in accordance with the requirements set out below pursuant to Sections 26, 40, 41 and 90 of the Code.
Before commencing and/or continuing the processing, information systems and software shall be configured by minimising the use of personal and/or identification data so as to rule out their processing if the purposes sought in the individual cases can be achieved by means of anonymous data and/or appropriate arrangements allowing data subjects to be only identified where necessary, respectively, as per Section 3 of the Code.
For the purposes of this authorisation,
a. "genetic data" shall mean any data that, regardless of its type, concerns an individual´s genotypic characteristics, or the pattern of inheritance of such characteristics within a related group of individuals;
b. "biological sample" shall mean any sample of biological material containing information on an individual´s genotypic characteristics;
c. "genetic test" shall mean the analysis, for clinical purposes, of a specific gene, or of a product and/or function thereof or of other DNA constituents and/or a chromosome, in order to carry out a diagnosis or confirm a clinical suspicion in an individual already affected by disease (diagnostic test), or else in order to detect or rule out a mutation associated with a genetic disease that might develop in a healthy individual (presymptomatic test), or in order to assess an individual´s liability to develop common diseases (predictive test);
d. "pharmacogenetic test" shall mean the analysis aimed at DNA-sequence identification in order to predict "individual" response to drugs in terms of effectiveness and relative risk of adverse effects;
e. "individual variability test" shall mean a genetic examination aimed either at establishing consanguinity or at assigning biological traces to specific individuals;
f. "genetic screening" shall mean any genetic test that is carried out on a given population or group in order to assess their common genetic characteristics or timely detect individuals that are affected by and/or carriers of genetic diseases and/or other hereditary characteristics;
g. "genetic counselling" shall mean a communication process whereby an individual or family affected by a genetic disease is assisted in understanding medical information including the diagnosis and foreseeable course of the disease, the available treatments, the contribution of inheritance to occurrence of the disease, the risk of occurrence for both the individual in question and other family members, all the available options in coping with the disease risk, and the impact such risk may have on reproductive choices; as well as a physician and/or biologist specialising in medical genetics, other professionals skilled in the management of psychological and social issues related to genetics shall participate in the aforementioned process;
h. "genetic information" shall mean the information process concerning the specific features of genetic screening.
This authorisation shall be granted:
a. to health care practitioners, in particular medical genetics experts, with regard to such data and operations as are indispensable exclusively for health care purposes in respect of the data subject and/or a third party belonging to the same genetic line as the data subject;
b. to public and private health care bodies, in particular clinical facilities for medical genetics, with regard to such data and operations as are indispensable exclusively for health care purposes in respect of the data subject and/or a third party belonging to the same genetic line as the data subject;
c. to medical genetics laboratories with regard to such operations as are indispensable in respect of indispensable data that are intended to be processed exclusively for the purposes of prevention and genetic diagnosis concerning the data subject, or that are intended to be used for the purposes of carrying out investigations by defence counsel, establishing or defending a legal claim, also concerning a third party, or establishing consanguinity of non-EU nationals, stateless persons, and refugees with a view to family reunion;
d. to natural and legal persons, research bodies and/or institutions, associations and other public or private bodies seeking research purposes, with regard to such data and operations as are indispensable exclusively for the purposes of scientific research, including statistics, in view of protecting the data subjects´, third parties´ and/or the community´s health in the medical, biomedical, epidemiological and anthropological sectors within the framework of the activities falling under the scope of medical genetics;
e. to psychologists, technical consultants and their assistants within the framework of multi-disciplinary genetic counselling, with regard to such data and operations as are indispensable exclusively for the purpose of providing advisory services to the data subject and/or his/her family members;
f. to pharmacists with regard to such data and operations as are indispensable exclusively for the purpose of fulfilling obligations arising out of the provision of drugs to the data subjects;
g. to defence counsel including their alternates, technical consultants and authorised private detectives with regard to such data and operations as are indispensable exclusively for the purpose of carrying out the investigations by defence counsel referred to in Act no. 397 of 7 December 2000; the authorisation shall be also granted in order to establish or defend a legal claim, also concerning a third party, providing the claim in question is not overridden by the data subject´s one and the data are only processed for the said purposes and for no longer than is absolutely necessary therefor;
h. to the international bodies regarded as eligible by the Ministry for Home Affairs and to diplomatic and/or consular representations in view of issuing the required certifications – which are currently set out in section 49 of Presidential decree no. 200/1967 – for the purpose of family reunion, whenever a data subject is unable to provide official proof of consanguinity because of his/her status, the lack of a recognised authority, or the alleged unreliability of the documents issued by the local authority.
3. Purposes of the Processing
Such genetic data may be processed as are closely relevant to the purposes mentioned below, where they may not be achieved, on a case by case basis, by processing either anonymous data or personal data of a different nature:
a. health care, with particular regard to genetic diseases, and protection of the data subject´s genetic identity, with the data subject´s consent, except for the provisions made in sections 26 and 82 of the Code for the case where a data subject is unable to provide his/her consent because legally incapable, physically impaired, or mentally disabled;
b. health care, with particular regard to genetic diseases, and protection of the genetic identity of a third party belonging to the same genetic line as the data subject, where consent has not or may not be provided because of legal incapacity and/or physical impairment or mental disability; this shall apply to such genetic data as have already been collected, if the processing is indispensable to allow the third party in question to make informed reproductive choices or is justified by the availability of preventive care and/or treatment in respect of the said third party;
c. scientific and statistical research with a view to protecting the community´s health in the medical, biomedical and epidemiological sectors, providing that the availability of exclusively anonymous data on population samples does not allow the research purposes to be achieved, whereby the said research shall be carried out with the data subject´s consent except for the statistical surveys and/or scientific researches provided for by law.
Within the framework of the purposes mentioned under a. and b. above, this authorisation shall also be granted exclusively for the purpose of allowing the authorised entities to fulfil specific obligations and/or ensure that such obligations are fulfilled, or to discharge specific tasks set out in Community legislation, laws and/or regulations with particular regard to public health and hygiene, prevention of occupational diseases, diagnosis and treatment including organ and tissue transplantation, rehabilitation from physical and mental disability and/or impairment, protection of mental health, and pharmaceutical assistance pursuant to the law. The processing operations may also concern the filling out of health records, certifications and other health care documents.
This authorisation shall also be granted if the processing of genetic data is indispensable:
a. for defence counsel to carry out the investigations referred to in Act no. 397 of 7 December 2000, also by the agency of alternates, technical experts and/or authorised private detectives, or else to establish or defend a legal claim, whether related to a third party or not, also without the data subject´s consent – except where the processing requires the performance of genetic tests. The foregoing provisions shall apply on condition the claim to be established or defended is not overridden by the data subject´s one or consists in a personal right or another fundamental, inviolable right or freedom, and if the data are only processed for those purposes and for no longer than is absolutely necessary to achieve such purposes. The processing must be carried out in compliance with the general authorisations issued by the Garante for the processing of sensitive data by self-employed professionals and private detectives (authorisation no. 4/2005 and no. 6/2005, respectively). The processing may also concern the information related to medical history and/or the data subject´s family members.
b. To fulfil specific obligations or ensure that specific obligations are fulfilled, or to discharge specific tasks as set out expressly in Community instruments, laws and/or regulations applying to social security and welfare, occupational and/or population safety and hygiene, also without the data subject´s consent, in compliance with the limitations laid down in the Garante´s general authorisation for the processing of sensitive data in the employment context (authorisation no. 1/2005) and without prejudice to the provisions contained in the code of practice referred to in section 111 of the Code. The processing may also concern the information related to medical history and/or the data subject´s family members.
c. To establish consanguinity with a view to family reunion in respect of non-EU nationals, stateless persons, and refugees pursuant to legislative decree no. 286 of 25 July 1998. In particular, the processing of genetic data that is carried out in spite of the availability of alternative procedures entailing no processing of such data shall not be regarded as indispensable.
4. Processing Mechanisms
The addressees of this Authorisation shall configure the collection and use of biological samples as well as the processing of genetic data in such a manner as to prevent infringements of the data subjects´ rights, fundamental freedoms, and dignity. The said activities shall be carried out lawfully and fairly for specific purposes to be set out in pursuance hereof and notified to data subjects in accordance with the mechanisms specified under 4.1.
Specific measures shall be laid down to unambiguously identify the individual that undergoes the collection of the biological materials required to perform the relevant analysis (section 11(1), letter c), of the Code).
The processing of genetic data shall only be carried out by means of such operations, logical arrangements, and data organisation mechanisms as are absolutely indispensable with regard to the aforementioned obligations, tasks and/or purposes.
The obligations arising out of the rules of practice applying to the individual professional categories mentioned herein shall be left unprejudiced.
4.1. Collection and Storage
Where the purposes for which genetic data are processed may not be achieved without identifying data subjects, also on a temporary basis, the data controller shall take specific measures to keep identification data separate ever since collection – except where this is found to be impossible on account of the peculiarities of the processing or requires an effort that is manifestly disproportionate.
The collection of genetic data for performing genetic tests and screening shall be limited to the personal and family information that is absolutely indispensable for performing the analysis in question (section 11(1), letter d), of the Code).
In particular, no data concerning health or any other features related to data subjects – apart from their sex – shall be collected in connection with processing operations that are carried out via individual variability tests. Samples shall be taken by persons entrusted with this task by a medical genetics laboratory, or else by a physician to be designated by the latter; as for family reunion cases, the samples shall be taken by health care professionals entrusted with this specific task by diplomatic and/or consular representations and/or international bodies regarded as eligible by the Ministry for Foreign Affairs
4.2. Scientific and Statistical Research
Any scientific and/or statistical research for whose performance it is permitted to make use of genetic data and biological samples shall be carried out, in addition, on the basis of a project to be drawn up pursuant to the relevant sector-related standards, also in order to give proof that the data are processed and the biological samples used for suitable scientific purposes. To that end, such data and biological samples may be used as are closely relevant to the purposes sought, by having regard to the available data and the processing operations already carried out by the same data controller as well as to the existence of other arrangements that can allow achieving the research purposes by means of personal data other than identification and/or genetic data, or that do not entail the taking of biological samples.
The project in question shall specify the measures to be taken in processing personal data with a view to ensuring compliance with this authorisation and personal data protection legislation, also with regard to preservation and security of the data and biological samples; the data processors, if any, shall also be referred to (see sections 29, 31, 33, 34, and 35 of the Code, and Annex B thereto). In particular, where the research envisages the collection and/or use of biological samples, the project shall specify source, nature and mechanisms for the taking and preservation of the samples as well as the measures adopted to ensure that the data subjects have voluntarily provided the biological materials in question.
The project shall be kept by the data controller under confidentiality arrangements for at least one year as from conclusion of the research. The data controller shall provide the information contained in the project to any data subject requesting it.
4.3. Security Measures
The following precautions shall have to be taken in connection with preservation and security of genetic data and/or biological samples.
Access to the relevant premises shall be controlled by security staff and/or electronic devices envisaging specific identification procedures, also based on biometrics. Any person admitted after closing time, on whatever grounds, shall have to be identified and his/her data recorded.
Preservation, use, and transportation of biological samples shall be carried out in such a manner as to also ensure their quality, integrity, availability and traceability.
Genetic data shall be transmitted electronically by certified electronic mail after encrypting and digitally signing the information to be transmitted. Web application-based communication channels may be used if they provide secure communication channels and it has been established that they can guarantee the digital identity of the server providing the service as well as of the client station from which the data are accessed by means of digital certificates issued by a certification authority in pursuance of the law.
Electronically processed genetic data may be browsed providing that authentication systems are in place based on the joint use of information known to the persons in charge thereof and of devices, including biometric devices, held by the said persons.
Genetic data and biological samples contained in lists, registers and/or databases shall be processed with the help of encryption techniques and/or by means of identification codes or any other techniques such as to make them provisionally unintelligible also to the persons authorised to access them; additionally, the data subjects shall have to be only identifiable when necessary, in order to minimise the risks of accidental disclosure and/or unlawful/unauthorised access. Where the said lists, registers and/or databases also contain data concerning data subjects´ genealogy and/or health, the aforementioned techniques must also allow genetic and medical data to be processed separately from the other personal data that identify the data subjects directly.
All the other obligations laid down in sections 11, 14, 22, 31, et seq. of the Code and the technical arrangements concerning minimum security measures as set out in the technical specifications annexed to the said Code are hereby left unprejudiced – also with regard to storage and transportation of the data outside secure premises as well as to the need for ensuring controlled accesses to such premises. The obligations in questions shall have to be also fulfilled in respect of biological samples.
5. Information Notices
Except for the processing of genetic data carried out in a non-systematic fashion by general practitioners and/or family paediatricians within the framework of their standard relationships with data subjects as aimed at protecting their health and bodily integrity, the information notices shall include the following items in addition to those referred to in sections 13, 77, and 78 of the Code:
a. a detailed list of all the specific purposes to be achieved;
b. the possible findings, also with regard to unexpected findings that might be disclosed on account of the processing of the genetic data;
c. the data subject´s right to object, on legitimate grounds, to the processing of his/her genetic data;
d. whether the data subject is allowed to limit the scope of communication of his/her genetic data and the transfer of biological samples, including their possible use for additional purposes;
e. the retention period of genetic data and biological samples.
Once the data subject becomes of age, the information notice shall be also provided to him/her in view of obtaining his/her consent anew whenever this is necessary (section 82(4) of the Code).
As regards processing operations for scientific and statistical research purposes, the information notice shall also specify the following:
a. that the consent must be given freely and may be withdrawn at any time without this being in any manner detrimental and/or prejudicial to the data subject, except where the data and biological samples do not allow the data subject in question to be identified any longer whether from the start or because of their processing;
b. what arrangements have been made to allow data subjects to be only identifiable for as long as is necessary for the purposes of data collection and/or the subsequent processing (section 11(1), letter e) of the Code);
c. whether the data and/or biological samples may be retained and used for other scientific and statistical research purposes, to the extent this is known, whereby such purposes shall be appropriately specified also with regard to the categories of entity the data may be communicated and/or the samples transferred;
d. how data subjects can access the information contained in the research project, where they request to do so.
As regards processing operations performed via genetic tests and screening for health care purposes, or for research and/or family reunion purposes, specific, clear-cut information shall be provided to data subjects, also in writing, prior to collecting their biological samples or using such samples where they have already been collected – irrespective of whether the processing is carried out by health care professionals and/or public or private health care bodies that have already informed the data subjects in question by availing themselves of the simplified mechanisms mentioned in sections 77-79 of the Code.
Processing operations aimed at the performance of investigations by defence counsel and/or the establishment of a legal claim may only be carried out via genetic tests if the data subject has been informed thereof in the manner specified above.
5.1. Genetic Counselling and Information Activities
With regard to processing operations carried out via genetic tests for health care and/or family reunion purposes, genetic counselling shall be provided to data subjects both before and after performing the tests; the counselling shall be such as to provide the data subjects with complete, accurate information on all the possible implications of the relevant results. Prior to introducing genetic screening for health care purposes, appropriate measures shall be taken to ensure that the public is informed about the availability of the tests performed, their nature, specific features, and consequences – also within the framework of institutional publications and by means of electronic communications networks.
The genetic counsellor shall help the data subjects in taking – in a fully autonomous manner – the decisions they consider to be most appropriate by having regard to genetic risk, family expectations, and their ethical and religious principles. The counsellor shall help them in pursuing a line of conduct that is consistent with the decisions made as well as in adjusting themselves to disease and/or the disease recurrence risk in the best possible manner.
Where the individual variability test is aimed at establishing paternity and/or maternity, the data subjects shall also be informed about the legislation on lineage by highlighting the possible psychological and social consequences of the test.
Prior to performing scientific researches on population samples, awareness-raising activities shall be carried out in respect of the community concerned also via local mass communication media and public presentations, in order to clarify the nature of the research, the purposes to be achieved, the implementing mechanisms, the financial sources, and the expected risks and/or benefits to the population concerned. The awareness-raising activities shall also point out possible discrimination and/or social stigma risks as applying to the community concerned, in addition to the risks related to the disclosure of unexpected consanguinity relationships and the steps taken in order to minimise such risks.
In compliance with sections 23 and 26 of the Code, genetic data may be processed and biological samples used exclusively for the purposes specified herein, on condition that the person concerned has provided his/her written informed consent thereto.
In pursuance of section 23 of the Code, consent shall only be valid if the data subject is placed under no constraint and the consent may be withdrawn at any time.
Where a data subject withdraws his/her consent to the processing of data for research purposes, the biological sample will be also destroyed providing it has been collected for such purposes – except where the sample may be related no longer to an identified and/or identifiable individual either from the very beginning or because of the processing.
As regards processing that is carried out by means of genetic tests, including screening, also for purposes of research and/or family reunion, the informed consent of the individuals that undergo the collection of the biological material required for performing such analysis shall have to be obtained. In the said cases, the data subject shall have to state whether he/she wishes to be informed of the findings of the test/research, including unexpected news concerning him/her, where such news are concretely and directly beneficial to the data subject in terms of treatment, prevention, and/or awareness of reproductive choices.
Consent with regard to the information concerning an unborn child shall be provided by the respective mother. Where the processing based on prenatal tests may also disclose genetic data related to the future occurrence of a disease affecting the child´s father, the father´s prior consent shall have to be also obtained.
If the processing is necessary to safeguard the data subject´s life and bodily integrity, and the data subject may not provide his/her consent because of his/her being physically prevented from doing so, legally incapable, or mentally incapacitated, the consent shall be provided by the legal representative or else by a next of kin, a family member, a person cohabiting with the data subject, or – failing these – the manager of the facility where the data subject is domiciled. The provisions set out in section 82 of the Code shall apply.
The child´s opinion shall be taken into consideration, insofar as this is permitted by the child´s age and maturity. In any other case where the data subject is legally incapable, or physically or mentally incapacitated, the processing shall only be allowed if the underlying purposes are directly beneficial to the data subject; the data subject´s opinion shall be taken into consideration to the extent this is possible.
Processing of data in connection with pre-symptomatic genetic tests may only be carried out on non-diseased children that are at risk of genetic diseases if it is concretely likely that treatments and/or preventive measures become available prior to the children´s becoming of age. Individual variability tests may not be carried out on children without both parents´ consent, where parental responsibility is vested in both parents.
Processing of data in connection with genetic tests for the performance of investigations by defence counsel or else for the establishment of a judicial claim may only be carried out with the informed consent of the person the biological material required for the investigation(s) belongs to – except where expressly provided otherwise by the law.
7. Processing Operations in Specific Sectors
No genetic data or biological samples that are processed or collected, respectively, with a view to individual variability tests for the performance of investigations by defence counsel or in order to establish a judicial claim in a criminal proceeding may be used for other purposes. Genetic data or biological samples that are processed or collected, respectively, with a view to the performance of genetic tests for purposes of prevention, diagnosis and/or treatment in respect of the data subject, or else for scientific or statistical research purposes, may be used for the performance of investigations by defence counsel or else to establish a judicial claim in a criminal proceeding on condition the relevant legislation is complied with.
8. Retention of Data and Samples
With regard to the obligation set forth in section 11(1), letter e), of the Code, biological samples and genetic data may be retained for no longer than is absolutely necessary to fulfil the obligations and/or discharge the tasks mentioned in point 3 hereof, or else to pursue the purposes referred to therein for which they were collected or subsequently used.
Biological samples and genetic data that have been collected and processed, respectively, to perform genetic tests and screening shall be retained for no longer than is necessary to perform the analyses and/or pursue the purposes for which they were collected or subsequently used.
Any genetic data that is processed for the purposes of family reunion shall be retained for no longer than is necessary to handle the reunion application, without prejudice to retention under the law of the instrument and/or document containing the data in question. Upon rejection or granting of the application, the samples collected to establish consanguinity shall have to be destroyed (section 11(1), letter e), of the Code).
Under section 11(1), letters c), d), and e) of the Code, the authorised entities shall verify regularly that the data are accurate and updated and that they are relevant, complete, non-excessive and indispensable in respect of the purposes to be achieved in the individual cases – by having also regard to such data as are provided at the data subject´s initiative. Where a data is found to be excessive, irrelevant and/or non-indispensable, also following the said verification, it may not be used.
Biological samples and genetic data that were collected for health care purposes may be retained and used for scientific or statistical research purposes subject to the need for obtaining the data subjects´ informed consent – unless the statistical investigations and/or scientific researches are provided for by law. Biological samples and genetic data that are collected with a view to implementing research projects and performing statistical investigations other than those for which the data subjects´ informed consent was originally obtained may be retained and used further insofar as scientific and/or statistical purposes are pursued that are directly related to the initial ones. The foregoing provisions shall apply unless the data subjects´ consent is obtained anew, or if the biological samples and genetic data do not allow any longer identifying the said data subjects – whether because of their processing or not –, or if it is impossible to inform the data subjects on account of specific reasons, even after making all reasonable efforts to contact them, and the research programme was authorised specifically by the Garante in pursuance of section 90 of the Code after obtaining a reasoned favourable opinion by the geographically competent ethics committee.
9. Data Communication and Dissemination
Genetic data may not be communicated and biological samples may not be made available to third parties unless this is indispensable for the purposes mentioned herein.
Genetic data and biological samples collected for scientific and statistical research purposes may be communicated or transferred to research bodies and institutions, associations, and other public or private bodies pursuing research purposes exclusively within the framework of joint projects.
Genetic data and biological samples collected for scientific and statistical research purposes may be communicated or transferred to the aforementioned entities outside the framework of joint projects with regard to information that is not or does not include identifiable data; this may be done for scientific purposes that are directly related to those for which the said data and/or samples were originally collected, whereby the purposes in question must be clearly specified in writing in the request for the data and/or samples. In this case, the requesting entity shall undertake not to process the data and/or use the samples for purposes other than those specified in the said request as well as not to communicate or transfer the data to third parties.
Any genetic data that is collected for family reunion purposes may only be communicated to the diplomatic representations and/or consulates that are competent for evaluating the documents submitted by the data subject, or else to the international body – regarded as eligible by the Ministry for Foreign Affairs – the data subject has applied to. Biological samples that have been collected for the aforementioned purposes may only be transferred either to the laboratory in charge of performing the individual variability tests or to the international body regarded as eligible by the Ministry for Foreign Affairs.
Without prejudice to section 84 of the Code, genetic data shall be disclosed as a rule directly to the data subject; they may be disclosed to individuals other than the data subject on the basis of a written delegation by the latter. All appropriate arrangements shall be made to prevent other entities, including those present in a given place together with the data subject, from getting the information at issue without authorisation. Where the data are communicated directly to a person delegated by the data subject, they shall be kept in a closed envelope.
The results of genetic tests and screening as well as research findings, where they are directly, concretely beneficial to data subjects in terms of treatment, prevention and/or awareness of reproductive choices, shall have to be communicated to the said data subjects by also respecting their willingness to be informed or not about the aforementioned events – where necessary, by providing appropriate genetic counselling.
If research findings are concretely, directly beneficial in terms of treatment, prevention and/or awareness of reproductive choices, also with regard to the individuals belonging to the same genetic line as the data subject, they may be communicated to such individuals if they so request and the data subject has expressly consented thereto, or if the data subject has deceased and had never objected expressly thereto during his/her life.
As regards researches carried out on isolated populations, such findings as may be relevant in terms of treatment and/or prevention with a view to protecting the health of the individuals belonging to the said populations shall have to be disclosed to the community concerned and the local authorities.
No genetic data may be disseminated. Research findings may only be disseminated in aggregated format, or else in accordance with such arrangements as can prevent data subjects from being identified also by way of indirect identification data – as also related to publications.
10. Authorisation Requests
The controllers of processing operations that fall under the scope of application of this authorisation shall not be required to lodge an authorisation request with the Garante if the processing to be performed is compliant with the foregoing requirements.
Such authorisation requests as have already been or will be lodged, also following adoption of this authorisation, shall have to be regarded as granted under the terms set out herein.
No authorisation requests shall be taken into consideration by the Garante where they concern processing operations that depart from the requirements laid down herein, unless they are to be granted on account of peculiar circumstances and/or exceptional situations that are not addressed herein – e.g. whenever obtaining consent entails a clearly disproportionate effort by having regard, in particular, to the number of data subjects.
11. Final Provisions
The obligations arising out of laws, regulations and/or Community legislation that provide for bans and/or limitations on the processing of genetic data shall be left unprejudiced.
The controller of the processing of genetic data shall be under the obligation to submit a notification to the Garante prior to starting the said processing (as per sections 37 and 163 of the Code).
12. Duration and Transitional Provisions
This authorisation shall be in force as from 1 April 2007 until 31 December 2008.
Where the processing is not compliant with the requirements set out herein as of the date on which this authorisation is published, the data controller shall have to bring it into line by 1 September 2007.
This authorisation shall be published in the Official Journal of the Italian Republic.
Done in Rome, this 22nd day of the month of February 2007.
THE SECRETARY GENERAL