New provision by the privacy authority for the processing of special data
The Privacy Authority has adopted a provision that establishes processing obligations in relation to special categories of data.
The primary purpose of this provision is the reformulation, in the light of the GDPR, of the “general authorization“, dating back to 2016, which regulated the processing of what were called “sensitive” data, today “particular”.
The provision establishes the obligations that must be met for the proper processing of special data, such as, according to the identification of the Guarantor, sexual and political orientation, ethnicity, data relating to the health of individuals.
Specifically, the processing of these personal data that the Authority regulates are those relating to:
1) processing within the framework of employment relationships
2) processing by associations, foundations, churches and religious associations or communities
3) processing by private investigators
4) processing of personal data for purposes of scientific research
5) processing of genetic data
The Authority identifies the requirements relating to these categories of processing, specifying, as regards the first 3, the scope of application, the persons to whom the data refer, the purposes of the processing and the specific requirements.
More extensive are the provisions on the processing of personal data for purposes of scientific research and processing of genetic data.
In the first case, the prescriptions concern: scope of application; types of research; consent; methods of processing; storage of data and samples; custody and security.
In the second case they concern: some key definitions in the field of genetics; specific pre-registrations; information to interested parties; genetic counselling and information activities; consent; communication and dissemination of data; protection of the health of a third party; pre-symptomatic tests; processing of genetic data for the performance of defensive investigations pursuant to Law No. 397 of 7 December 2000; processing of genetic data for the purposes of family reunification and consanguinity bonds; processing of genetic data for purposes of scientific and statistical re-search.
What does this provision change in substance? The general authorizations used up to now cease to have value, by virtue of the adaptation to the GDPR, carried out by the Authority, of the document with instructions for processing special data, which is an indispensable tool for companies and Public Administration.
Here below you can find the link to the full text of the above-mentioned provision: https://www.garanteprivacy.it/docweb/9124510