ItalyGarante Provvedimento n. 146/2019, Pseudonymization and Anonymization of Genetic and Research Data
Prescrizioni relative al trattamento di categorie particolari di dati Garante Provvedimento n. 146 del 5 giugno 2019, Allegato 1, sections 4.2(e), 5.4 and 5.6
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Process genetic data and biological samples held in lists, registers or databases with encryption, pseudonymization or other solutions that make them temporarily unintelligible even to authorized staff and allow the data subjects to be identified only when necessary (Allegato n. 1, section 4.2, point e).
- Where research cannot reach its purposes without identifying the data subjects, process the data collected retrospectively with encryption, pseudonymization or other solutions that make them not directly attributable to the data subjects, and use codes that cannot be derived from the data subjects' identifying data unless that is impossible or disproportionate and the reason is recorded in writing in the research project (Allegato n. 1, section 5.4).
- State in the research project the retention period after the end of the study at the end of which the data and biological samples are anonymized (Allegato n. 1, section 5.6).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The provision states no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 4.2, point e, of Allegato 1 to Provvedimento 146/2019 requires genetic data and biological samples held in lists, registers or databases to be processed with encryption, pseudonymization or other solutions that make them temporarily unintelligible even to authorized staff.
Section 5.4 requires research data collected retrospectively to be processed with encryption, pseudonymization or other solutions that make them not directly attributable to the data subjects where the research cannot reach its purposes without identifying them. Section 5.4 also requires the codes used not to be derivable from the identifying data of the data subjects, unless that is impossible or disproportionate and the reason is recorded in writing in the research project.
Section 5.6 requires the research project to state the retention period after the end of the study at the end of which the data and biological samples are anonymized. Section 5 applies, among others, to universities, other research bodies and scientific societies, researchers working within them, and health professionals and health bodies.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .