The Italian DPA has a positive opinion on telematic transmission of consent to the use of body post-mortem

At the end of 2023, the Italian Data Protection Authority gave its positive opinion to the draft decree on the modalities of transmission of information contents concerning the individual consent to the use of one's body and post-mortem tissues processing for the purposes of study, training and scientific research. This scheme is part of the legislative process aimed at setting up national databases for scientific research purposes of public interest.

The positive opinion took into account the changes made during the preliminary investigation and the technical and organisational measures, in their complexity, which were deemed appropriate to protect the fundamental rights and interests of individuals during the data processing. 

It was a process that started in 2020 with the first Italian legislation on the subject: in November 2023, the Ministry of Health asked the DPA to express its opinion on the decree scheme in question, which will set up a separate section in the database called DAT (Disposizioni Anticipate di Trattamento - Anticipated Treatment Provisions), devoted to the collection of the aforementioned information content.

In particular, according to the draft decree, the database is to be provided with the information concerning declaration of consent and revocation of consent by the dispositor; declaration of consent by both exercisers of parental responsibility, or guardians, or custodians, to the use of the body and post-mortem tissues of the donor under the age of 18 and revocation of consent also expressed by one of these persons; appointment and revocation of the trustee and substitute indicated by the dispositor; acceptance and revocation of acceptance of the appointment by the trustee and substitute.

In order to be valid, the declarations must be drawn up in a public deed or in a notarised private deed, or in a private deed personally delivered by the settlor to the registrar or to the healthcare facility, or by video recording or devices enabling the disabled person to communicate. 

The Ministry of Health will have the responsibility to receive the declarations of the disposers and to transmit to the appointed trustees, without delay, notice of the declaration of consent to the database, in accordance with the procedures set out in the technical specifications annexed to the draft decree, in order to organise the transport and management of the body at the authorised centres, for the following twelve months.

A very interesting aspect is the one on data retention: it is specified that personal data collected by healthcare companies and transmitted to the database will be deleted ten years after the death of the person concerned, a much shorter period of time than the usual duration of databases for scientific research projects, even shorter if one thinks of the retention of hospital facilities for diagnosis and treatment purposes. As far as children's data are concerned, their deletion is foreseen when they turn 18 years of age.

About the security measures, the DPA appreciated the legislator's acceptance of his indications concerning the need to expressly indicate that for the two partitions of the database (DAT and the one under consideration) the authorisation profiles are distinct, even though they share the same authentication system; the need to indicate that, for all users other than citizens, the use of SPID identities for personal use may be permitted pending the definition of the framework of guarantees and rules for SPID identities for professional use, the need for the sender and the information content of the email notification of registration in the database to the dispatchers and/or trustees to be such as to exclude any direct reference to the declaration itself, so as to ensure that such data are managed in an anonymised form.