ItalyGarante Provvedimento n. 146/2019, Genetic, Health, and Biometric Data Prescriptions
Garante Provvedimento n. 146 del 5 giugno 2019
In force since .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.NIST Privacy FrameworkPR.AC-P4NIST Privacy FrameworkPR.DS-P1NIST Privacy FrameworkPR.DS-P2
- Do not scrape or process publicly posted facial images to build a biometric identification database without a valid General Data Protection Regulation (GDPR) Article 9 basis.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- PR.DS-P1Data-at-rest are protected.
- PR.DS-P2Data-in-transit are protected.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Do the prescriptions of Provvedimento 146/2019 on genetic data continue to apply alongside the safeguard measures that Article 2-septies of the Codice privacy requires the Garante to adopt for genetic, biometric and health data at least every two years?
What it makes you log
What the log must hold
Access record
Logging duty
For research on genetic data, where study data sit in a centralized database, the prescriptions require audit log systems to control access to the database and to detect anomalies, alongside role-based authentication and authorization. Section 4.2, point a, separately requires a documented procedure for access to premises holding genetic data and samples, and the research project is to be kept in confidence for five years from the planned end of the research; neither is a log of processing. The prescriptions state no retention period for the audit logs.
- Kind
- Explicit
- As of
- Provision
- Section 5.7, point e, last indent (audit log systems for access to the centralized study database)
- Trigger
- personal_data_processing
What this law does
The Garante's Provvedimento n. 146/2019 imposes specific security measures for genetic data (documented physical-access controls, encrypted or pseudonymized storage, controlled transmission), consent requirements for genetic testing and for processing genetic data to protect a third party's health, and a research-retention rule limiting secondary use of genetic data and biological samples to cases where equivalent research cannot be done on data from consenting subjects.
A biometric enforcement action of the Garante is Provvedimento n. 50 del 10 febbraio 2022 against Clearview AI: a EUR 20 million fine, a ban on further processing of the facial-recognition data of people in Italy, and orders to delete that data and to designate a representative in the EU.
When LexLint raises it
When your app profile says your app processes biometric data, crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .