On general privacy authorizations

​The public consultation of the Data Protection Authority on the five general authorizations compliant with the GDPR was published in the Official Journal:  

• Provisions relating to the processing of special categories of data in employment relationships (General Authorization No. 1/2016);
• Provisions relating to the processing of special categories of data by associations, foundations, churches and religious associations or communities (General Authorization No. 3/2016);
• Provisions relating to the processing of special categories of data by private investigators (General Authorization No. 6/2016);
• Provisions relating to the processing of genetic data (General Authorization No. 8/2016);
• Provisions relating to the processing of personal data for scientific research purposes (General Authorization No. 9/2016).

The deadline for submitting any contributions will lapse on 12 March 2019.

The consultation was commenced pursuant to art. 21 of the Legislative Decree No. 101/2018, concerning the provisions for adapting the Privacy Code (Legislative Decree No.196/2003) to the GDPR.

Article 21 outlines the so-called "twin-track" approach to "general authorizations" (that are the authorizations issued in the past by the Data Protection Authority for "certain categories of controllers or processing", according to the repealed articles 26 and 40 of the Privacy Code):

• subject matter of this consultation are the general authorizations compliant with the GDPR in order to establish, by means of a further measure, their effective compatibility;
• the general authorizations excluded from the consultation are no longer effective upon the entry into force of the Legislative Decree No. 101/2018 (19 September 2018). 

As a consequence, following the publication of the consultation, the general authorizations excluded from its material scope of application are no longer effective due to the non-compliance with the GDPR, namely: General Authorization No. 2/2016 to the processing of data concerning health and sex life; General Authorization No. 4/2016 to the processing of particular data by professionals; General Authorization No. 5/2016 to the processing of particular data by different categories of controllers; General Authorization No. 7/2016 to the processing of judicial data by private individuals, public economic entities and public entities.