ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
clear and simple, concise and comprehensive lan - guage that is easily accessible and understandable to the minor. 1.4 Processing of Personal Data for Research and Development Purposes Life sciences or medtech companies can anonymise patient data for product development or scientific research only if the outcome is true anonymisation in the GDPR sense. That means that the data must be rendered irreversibly non-identifiable, taking into account all means reasonably likely to be used for re- identification. In healthcare, this is a high bar, as clini - cal datasets are rich and easily linkable; the GPDP’s approach is consistently strict, so mere removal of direct identifiers or standard pseudonymisation is not enough. If the company achieves genuine anonymisa - tion, the dataset falls outside the GDPR and can be used for research and development without a GDPR legal basis. Where full anonymisation is not realistically achiev - able, data remains personal (even if pseudonymised). Then, the company must rely on a GDPR Article 6 law - ful basis and an Article 9 (2) condition for health data, most often the scientific research ground combined with Article 89 safeguards. The Italian Privacy Code rules on research (including the updated Article 110) support this pathway by allowing certain research uses with enhanced safeguards when informing indi - viduals is impossible or disproportionate, but they do not remove the need for a lawful basis and account - ability. The Code of Conduct for management software developers approved by the GPDP in October 2024 reinforces this compliance logic for software/tech ven - dors working with hospitals: it operationalises privacy- by-design/default, clarifies that vendors typically act as processors for installation/maintenance/support, and expects robust security and life cycle controls. In practice, it pushes medtech vendors to ensure that any re-use/anonymisation for R&D is clearly covered contractually with the healthcare provider and sup - ported by appropriate technical measures. Looking forwards, the European Health Data Space Regulation (EU) 2025/327 (EHDS) is a major change
for these companies. It entered into force on 26 March 2025 and will apply in phases from 26 March 2027, with the secondary use regime (research/innovation/ AI training, etc) becoming operational from 26 March 2029 and some data categories being phased in lat - er. The EHDS will create a harmonised, permit-based route to access large volumes of electronic health data across the EU through national Health Data Access Bodies, typically in secure environments and often in anonymised/pseudonymised form. For life sciences and medtech firms, this should increase lawful access and legal certainty for research and development, but only under tighter governance, interoperability, audit - ability and anti-reidentification constraints. 1.5 Processing of Personal Data in the Context of Artificial Intelligence With regard to the use of AI systems, it is essential to note that both EU (AI Act) and national legislation refer to the GDPR and the Privacy Code for the regu - lation of personal data protection profiles relating to the use of AI tools. In this context, the first thing to note is the transparency obligations, as Articles 13 and 14 of the GDPR require data subjects to be pro - vided with information on the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. In addition, Article 22 of the GDPR states that the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects con - cerning them or similarly significantly affects them, except where the decision is: • necessary for entering into, or the performance of, a contract between the data subject and a data controller; • authorised by the law to which the controller is subject and which also lays down suitable meas - ures to safeguard the data subject’s rights and freedoms and legitimate interests; or • based on the data subject’s explicit consent. In these cases, the data controller shall implement suitable measures to safeguard the data subject’s
203 CHAMBERS.COM
Powered by FlippingBook