ItalyGarante Research and Statistics Ethical Rules, Identifiability Test and Anonymous Special-Category Data
Regole deontologiche per trattamenti a fini statistici o di ricerca scientifica Garante Provvedimento n. 515 del 19 dicembre 2018, Allegato 1, artt. 4 and 7
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Treat a data subject as identifiable whenever, with reasonable means, a significantly probable association can be established between the combination of the variables of a statistical unit and the data that identify it (Allegato 1, Article 4, paragraph 1, point a).
- Process special categories of data and data on criminal convictions and offences for statistical and scientific purposes in anonymous form as a rule (Allegato 1, Article 7, paragraph 1).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The provision states no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Article 4 of the Garante's ethical rules for processing for statistical or scientific research purposes treats a data subject as identifiable when, with reasonable means, a significantly probable association can be established between the combination of the variables of a statistical unit and the data that identify it.
Article 7 provides that special categories of data and data on criminal convictions and offences processed for statistical and scientific purposes must as a rule be in anonymous form. Compliance with the ethical rules is an essential condition of the lawfulness and fairness of the processing, and breach draws the administrative sanction of Article 83(5) of the General Data Protection Regulation (GDPR).
The rules apply to processing for statistical and scientific purposes by universities, other research bodies and scientific societies, and by researchers working within them. The rules do not apply to statistical and scientific processing connected with health protection activities carried out by health professionals or health bodies.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .