Privacy protection in scientific research is a crucial issue that is constantly evolving due to technological advances and new ethical challenges. In Italy, Article 110 of Legislative Decree 101/2018, which transposes the GDPR, has undergone recent amendments that deserve careful consideration.
Article 110 provides a set of stringent requirements for retrospective studies, those using data collected in the past, for which it is considered difficult to obtain explicit consent from participants again for their use in research. These requirements are:
- the opinion of the ethics committee;
- a data protection impact assessment, project-specific or general;
- a demonstration that every effort has been made to obtain new consent from retrievable participants;
- a requirement for prior consultation with the Privacy Guarantor, with penalties for noncompliance.
Recent interventions in Article 110 modify the last of these requirements, as it has been found that this particularly lengthy and cumbersome process can be a barrier to retrospective research, especially for nonprofit studies and those conducted in the public sector. The amendment, therefore, removes the requirement for prior consultation with the Privacy Guarantor for retrospective studies except for those involving genetic data. Instead, the Garante was asked to establish general ethical rules to be applied in these cases. This is an innovative tool, adopted only in Italy, which aims to ensure a balance between the protection of privacy and the freedom of scientific research.
The changes to Article 110 represent a step toward greater flexibility in the conduct of retrospective studies in Italy. The elimination of the requirement for prior consultation with the Garante greatly simplifies the bureaucratic process, reducing the time and cost of research.
However, it is important to stress that the protection of privacy remains a fundamental principle. The deontological rules to be established by the Garante should ensure an adequate level of protection of personal data, even in the absence of explicit consent.
The implementation of the European Health Data Space (EHDS) could bring further changes to Italian regulations on privacy in scientific research. In particular, the request for authorization for secondary use of health data should be addressed to a specific competent authority, if different from the data owner.
In conclusion, the amendments to Article 110 represent an important step toward greater flexibility in scientific research in Italy, while maintaining a high level of privacy protection. It will be crucial to monitor the evolution of the legislation and the implementation of the deontological rules by the Privacy Guarantor to ensure a balance between the freedom of research and the protection of personal data.