Cass.Civ. - 6067/2025

Cass.Civ. - 6067/2025
Court:	Cass.Civ. (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 4(7) GDPR Article 6 GDPR Article 9 GDPR
Decided:	06.03.2025
Published:
Parties:	GPDP A local health authority (ASUFC)
National Case Number/Name:	6067/2025
European Case Law Identifier:
Appeal from:	Garante per la protezione dei dati personali (Italy) 9845156
Appeal to:	Not appealed
Original Language(s):	Italian
Original Source:	Apsilef (in Italian)
Initial Contributor:	cci

The Court of Cassation held that a local health authority unlawfully processed health data from electronic health files in order to carry out a large-scale analysis of Covid-related health risks.

English Summary

Facts

The controller for the case is Azienda Sanitaria Friuli Centrale (ASUFC), a local health authority.

In 2020 the local government of Friuli Venezia Giulia issued a resolution that required the controller to carry out a large-scale analysis of Covid-related health risks for the resident population of the region of Friuli (the data subjects). During this analysis, individuals from vulnerable populations (such as the elderly) were assigned a score representing their vulnerability to covid. The results were disclosed to medical practitioners for the purpose of preventive intervention- especially with regards to vaccination priority.

The processing was based on health data, including information in the data subjects’ electronic health file. The local government gave precise instructions to the health authority, including the instruction to appoint specific processors.

The DPA investigated the processing and held that it was unlawful. Additionally, the DPA held that the controller violated its transparency obligations and failed to carry out a DPIA. On these grounds, the DPA fined the controller €50,000.

The decision was later annulled by the civil court (Tribunale di Udine). Contrary to the DPA’s findings, the Court held that the processing was lawful and that a DPIA was not required under the GDPR.

The GPDP challenged the civil court’s decision with Italy’s Supreme court (Cassazione).

Holding

Contrary to the lower court’s findings, the Cassazione held that the controller unlawfully processed sensitive data.

In this regard, the Court first noted that Italian law lists different purposes for the processing of health data within the electronic health file. Among those, only the purposes related to individual treatment (i.e.: “prevention, diagnosis, health care, and rehabilitation”) are covered by the data subject’s consent.

The Court held that the processing of personal data for the purpose of preventive medicine, did not fall among these purposes and was not covered by consent.

Furthermore, such processing was not carried out with a compatible purpose under Article 5(1)(b) GDPR because Italian law requires the pseudonymization of any data from health files when such data are used for research. The controller did not pseudonymized the data in the case at hand.

Additionally, the Court held that due to intricacies of Italian administrative law, the controller could not rely on Articles 6(1)(e) and 9(2)(h) GDPR.

Finally, the Court held that Italian law did not sufficiently clarify the safeguards for data subjects, as required by Article 9(2) GDPR under letters (g), (h), and (i).

For the reasons above, the Cassazione annulled the civil court's ruling and ordered the court to rule again. The civil court is now bound to the Cassazione's findings on the law.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

Court of Cassation, I Civil, Order of March 6, 2025, No.

6067

Court of Cassation, I Civil, Order of March 6, 2025, No. 6067

ITALIAN REPUBLIC
IN THE NAME OF THE ITALIAN PEOPLE

THE SUPREME COURT OF CASSATION
FIRST CIVIL SECTION

Composed of the following distinguished Magistrates:

Dr. ACIERNO Maria - President -

Dr. TRICOMI Laura - rel. Counsel -
Dr. IOFRIDA Giulia - Counsel -

Dr. CAIAZZO Rosario - Counsel -
Dr. CAMPESE Eduardo - Counsel -

R.G.N. 2988/2024

ORDINANCE
on the appeal registered under No. 2988/2024 R.G. proposed by:

AUTHORITY FOR THE PROTECTION OF PERSONAL DATA, in the person of the legal representative
p.t., domiciled in ROME VIA DEI PORTOGHESI, at the STATE GENERAL
ATTORNEY'S OFFICE who represents and defends him ex lege;

-appellant-
against

AZIENDA SANITARIA FRIULI CENTRALE, in the person of the legal representative p.t., elected
domiciled in ROVERETO VIA PASQUI, 28/6, at the office of the lawyer CAROLLO
VALENTINA who represents and defends him together with the lawyer FABBRETTI MARIA
CRISTINA, as per special power of attorney in the documents;

-counter-

Against the JUDGMENT of the COURT of UDINE n. 641/2023 filed on 05/12/2023.
Having heard the report presented in the council chamber on 11/19/2024 by Councilor LAURA
TRICOMI.

FACTS OF THE CASE 1.1.- With injunction order no. 416 of December 15, 2022, issued pursuant to art. 18 of

law no. 689/1981 and notified on December 30, 2022, the Authority for the Protection of
Personal Data (hereinafter also the Guarantor) had contested the unlawfulness of the
processing of clear personal data (i.e. associated with the identification
data of the interested parties) of patients contained in the
company databases and in the electronic health record (hereinafter also the FSE) carried
out by the Azienda Sanitaria Friuli Centrale (hereinafter also ASUFC) in execution of the resolution
of the Friuli Venezia Giulia Regional Council no. 1737 of November 20, 2020, in violation

of articles 5, 9, 14 and 35 of Regulation (EU) 2016/679 and art. 2 sexies of Legislative Decree no. 196/2003
(Personal Data Protection Code); had therefore ordered the Azienda Sanitaria
Friuli Centrale to proceed, within ninety days of notification of the provision, to the
cancellation of the data resulting from the processing of the information present in the
company databases and to pay the administrative fine of €55,000.00=.

The processing activity was carried out through INSIEL SPA - an in-house company of the
Region, formally appointed by ASUFC as Data Controller - through the use of
an algorithm provided by the Regional Agency for Health Coordination (hereinafter, also
ARCS), called ACG (Adjusted Clinical Groups)1, which would have pseudonymized the data
through the application of random numerical codes developed by ARCS. The objective pursued was

the preparation of a list of subjects in conditions of complexity and comorbidity to be transmitted
to general practitioners (GPs) in order to allow better management of the
Covid-19 epidemiological context, in order to prepare preventive interventions for the
patient's care; the selection of patients was limited to certain classes of patients.

Following the complex investigation, the Guarantor Authority had found the illegitimacy of the
processing, in accordance with the relevant legislation on the protection of personal data
indicated above, since the purposes of planning, evaluation and control (so-called
health governance) do not include the purposes of initiative medicine, nor the stratification
of the population assisted on the basis of individual health risk.

According to the injunction order, the processing of health data by ASUFC had
occurred: i) in the absence of a suitable, specific, regulatory basis (and, therefore, in violation of
articles 5, par. 1, letter a) and 9 of European Regulation no. 679/2016, as well as art. 2 ter and sexies of
legislative decree no. 196/2003 (Code on the protection of personal data); ii) in the absence of prior

consent and, therefore, unlawfully, since the processing operations in question
are not included in the list of those necessary for patient care, pursuant to art. 9 paragraph 2 letter
h) of Regulation no. 679/2016; iii) with violation by the Health Authority of the
obligation of both prior information (articles 13 and 14 of the Regulation) and of an impact assessment on
the protection of personal data (art. 35 of the aforementioned Regulation).

1.2.- The Health Authority Friuli Centrale, with an appeal filed on 30 January 2023, filed an
opposition before the Court of Udine against order no. 416/2022, which was resisted
by the Guarantor Authority.

In particular, the appellant ASUFC contested the order of the Authority for the
protection of personal data under multiple aspects, preliminarily objecting that the
contested conduct was not attributable to ASUFC, since the Company could not be classified
as the data controller of the health data, arguing that the

purposes and methods of the processing had been defined by the Region through the

Regional Council resolution no. 1737/2020 and the stratification
of patients through the application of the algorithm and that the consequent elaboration of lists of
patients falling within the requested categories had been carried out by ARCS (Regional Agency for
Health Coordination) and by the regional in-house company Insiel S.p.a. on express
regional mandate, with the consequent impossibility for ASUFC to exercise any effective
control and power of disposal over the data of its patients. In any case, the data processing, according to the appellant, would have taken place in full

compliance with national and European legislation.
The Personal Data Protection Authority resisted, requesting full confirmation of the sanctioning measure.

Following the investigation, the Court of Udine, after having suspended inaudita altera parte the enforceability of injunction order no. 416/2022, accepted the appeal and annulled the order;
it ordered the Personal Data Protection Authority to provide for the publication of the judgment in full (decision and reasoning), at its own expense, by means of a communication on its institutional website; it ordered the Personal Data Protection Authority to pay the costs of the proceedings.
The Court stated that the extraction of data from the regional data warehouse and the preparation of patient lists, which are instead

brought back to the legal concept of secondary processing of sensitive data already

collected by the Health Authority, with the consent of the patients, and already

available to the same general practitioners, even if not yet organized in lists of more

immediate perception, does not involve unlawful processing of personal data.

It also stated that the conduct was not attributable to ASUFC, even though it was recognized as the
data controller, because it had made the data available at the request of the
Regional Council; it therefore stated that the Council resolution was part of the state of

pandemic emergency, so that the processing could be considered necessary and therefore not

requiring consent; finally, it excluded that an environmental impact

assessment was necessary for the case in question. 1.3.- The Personal Data Protection Authority has filed an appeal with a single,
comprehensive, reason, requesting the Cassation of the sentence indicated in the epigraph. The Azienda

Sanitaria Friuli Centrale has responded with a counter-appeal.

The Authority has filed a brief.

The case has been heard in chambers.

REASONS FOR THE DECISION
2.- The objections of inadmissibility/inadmissibility of the appeal raised by the
counter-appellant are unfounded. The appeal clearly and exhaustively sets out the events of the case, the

objections raised and the questions of law submitted to the examination of this Court and does not request
a different assessment of the merits.
3.- With a single reason, divided into six points, the violation or false application of

art. 12 (Electronic health records, surveillance systems in the health sector and
governance of digital health) of the legislative decree is denounced. n.179 of 2012 (Further urgent measures for the growth of the Country)
converted with amendments by law 17 December 2012, n. 221 and d.p.c.m. n. 178 of 2015
(Regulation on electronic health records) – art. 2-ter of legislative decree n.196/2003
(Code on the protection of personal data) – arts. 5, 14, par. 5, letter d), and 35 of
Regulation (EC) 27/04/2016, n. 2016/679/EU [Regulation of the European Parliament and of the
Council on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

(General Data Protection Regulation) Published in the Official Journal of the European Union 4 May 2016, no. L
119.], in relation to art. 360, paragraph 1, no. 3, of the Italian Civil Procedure Code.

3.1.- The first profile denounces the violation and false application of art. 12 of Legislative Decree no. 179 of

2012.
The appellant complains that the Court based the acceptance of ASUFC's appeal
on the ambiguous assumption that the Company was not the data controller of the data that were extracted, on the basis of the resolution of the Regional Council no. 1737/2020 from the FSE, for purposes

outside those of ASUFC's competence, i.e. to form a so-called "statistical stratification" of
patients in conditions of complexity and comorbidity to be reported to General Practitioners
(MMG).
He maintains that this assumption is based on a clearly erroneous interpretation, also because

it is incompatible with the literal data, of the provisions of articles 4, par. 1, no. 7 (Data Controller) and 24 (Responsibility of the Data Controller) of the GDPR, to be read in conjunction
with art. 12 (Electronic health record, surveillance systems in the
health sector and digital health governance) of Legislative Decree no. 179 of 2012 (Further urgent measures for the growth of the
Country) and Prime Ministerial Decree no. 178 of 2015 (Regulation on electronic health records).

He points out that the information base from which the personal data of the patients were extracted to
perform the statistical stratification was not and could not have been the partition of the FSE,
of which the Region is the owner. In fact - as also recognized in the contested ruling -
by express provision of law, the Region can have at its disposal, through the FSE, only
information without the direct identification data of the patient and pseudonymized, typical of
statistical processing.

Instead, as emerges from the preliminary evidence, the data extracted were directly identifying
of the patients, as they referred to subjects identified by name, surname and tax code, and,
therefore, could be extracted exclusively from the partition of the FSE owned

by the Company, so much so that the Region had arranged for the stratification activity in question
to be carried out with the company databases, and not regional ones, and managed by the GPs.
3.2.- The second profile denounces the violation and false application of art. 5 of Regulation no.
2016/679/EU, which sets out the principles applicable to the processing of personal data. The Authority deduces

that the Court reaches an erroneous interpretative reconstruction of the concept of the so-called secondary use of data and its practical application when it states that the selection and management
of sensitive information relating only to patients who had already expressed their consent to the
disclosure of data to their doctors would constitute secondary processing (pursuant to art. 5 of the
Regulation) of the data contained in the FSE compatible with the purpose of the collection.

3.3.- The third profile denounces the violation and false application of art. 2-ter of Legislative Decree no.
196/2003 and subsequent amendments (Code on the protection of personal data).

The Authority complains that the Court erroneously identified in art. 2-ter of the Code the
legal basis of the data processing in question, while the scope of applicability of this
provision does not include the category of health data for which, due to the sensitive nature of the
interests involved and in relation to the processing carried out in performance of a task of public
interest, reference must necessarily be made to art. 2-sexies of the Code.

It also raises the erroneousness of the contested decision where the Court held that
the Company could not have opposed the regional resolution, and did not take into account the
principle of non-application of the internal rule that conflicts with the Community legislation consisting, in
this case, in the Regulation on data protection and in the Code in the part in which, on the
basis of what is provided for by art. 9, par. 2, letter g) and 4 of the Regulation, it completes the

provisions.
3.4.- The fourth profile denounces the violation and false application of art. 17-bis of Legislative Decree no.
18/2020.

The Guarantor Authority complains that the text of articles 1 and 17-bis of Legislative Decree no. 18/2020, adopted in the
pandemic period, is the subject of only a partial reference in the ruling, a circumstance
that would have led to an incorrect regulatory reconstruction also under this point. It points out, in this regard, that art. 1 of Legislative Decree no. 18/2020 attributed to the Regions and autonomous

Provinces only planning functions (adoption of plans to strengthen and
reorganize the healthcare network), while the aforementioned art. 17-bis established that the
processing of personal data referred to in paragraphs 1 and 2 (were) (are) carried out in compliance with the
principles set out in article 5 of the aforementioned Regulation (EU) 2016/679, adopting appropriate
measures to protect the rights and freedoms of the interested parties.

In its opinion, therefore, the provisions adopted during the emergency period did not and could not have derogated from the principles of data protection set out in the Regulation, including the principle of lawfulness indicated in the contested provision.

3.5.- The fifth profile denounces the violation and false application of art. 14, par. 5, letter d), of
Regulation no. 2016/679/EU, the Guarantor Authority deduces that the interpretation of the
Court is incorrect according to which, in the case in question, the information was not due pursuant to
art. 14, par. 5, letter d), since the data processing was carried out by

doctors, subjects subject to professional secrecy.
3.6.- The sixth profile denounces the violation and false application of art. 35 of Regulation no.
2016/679/EU, the Guarantor Authority deduces that the case in question falls within those for which

the owner is required to carry out, before proceeding with the processing, an impact assessment
of the planned processing on the protection of personal data (Article 35 of the Regulation), as
can be deduced on the basis of the criteria identified by the Art. 29 Group in the «Guidelines on
data protection impact assessment and determining whether the
processing is likely to result in a high risk»», adopted on 4 April 2017 and amended on 4
October 2017, as well as numerous previous provisions of the Guarantor.

This is because two of the criteria indicated by the European Committee certainly apply: a. there is the
processing of sensitive data or data of a highly personal nature; b. there is the processing of data
relating to vulnerable data subjects, including those relating to health.

It then believes that, with reference to the specific case, the criteria
relating to the processing of data on a large scale can also be satisfied, given that, according to the
statements of the Company itself, the processing involved over 17,000 interested parties.

The appellant Authority therefore highlights that the criterion of the use of innovative technologies
(algorithms) indicated by the Court is not the only relevant criterion in terms of impact assessment
and, in any case, at present, the use of algorithms for the stratification of the population assisted,
despite what the Court believes, is not a widely used technique in data
reprocessing operations, especially in the medical-scientific field.

4.- The appeal is well-founded and must be accepted.

4.1.- As a preliminary matter, it is appropriate to specify that Legislative Decree no. 196 of 30 June 2003 (Privacy Code) in the version following the amendments introduced with Legislative Decree no. 101 of 10 August 2018 to adapt national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, which came into force on 25 May 2018 (Article 99, paragraph 2 of the Regulation), as well as the Regulation itself.
4.2.- The dispute concerns the personal data included in the Electronic Health Record, which includes data relating to health (Article 4, paragraph 1, Nos. 1 and 15 of the Regulation)

and their processing.
4.3.- In general, as far as it is relevant in this process, it is necessary to remember that personal data
are «collected for specified, explicit and legitimate purposes, and subsequently processed in a

way that is not incompatible with those purposes; further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not, in accordance with Article 89, paragraph 1, be considered incompatible with the initial purposes»

(Article 5, paragraph 1, letter b) of the Regulation); that processing is lawful where the data subject has expressed
consent to the processing of his or her personal data for one or more specific purposes, unless
one of the hypotheses of necessary processing applies (Article 6 of the Regulation); that, where the
processing for a purpose other than that for which the personal data were collected
is not based on the consent of the data subject or on a legislative act of the Union or of the Member States,
the controller must take into account, inter alia, «(c) the nature of the personal data,
in particular whether special categories of personal data are processed pursuant to Article 9...»; that
data concerning health fall within a category of personal data for which the

processing is prohibited, unless the explicit consent of the data subject is given, or one of the
specific cases in which the processing is qualified as necessary by the regulation applies (Article 9 of the
regulation).

In summary, the processing of personal data concerning health is lawful provided that
the explicit consent of the data subject is given, unless one of the cases of
necessary processing provided for by the regulation applies.
4.4.- The establishment of the electronic health record falls within this regulatory framework, which

is regulated by art. 12 of Legislative Decree no. 179 of 18 October 2012, converted with amendments by Law no. 221 of 17
December 2012, and in Prime Ministerial Decree no. 178 of 29 September 2015, containing the Regulations on
the electronic health record.

The electronic health record (FSE for short) is individual and concerns the individual patient; it
is made up of the set of digital data and documents of a health and social-health nature generated by
present and past clinical events that concern the patient, also referring to services provided
outside the National Health Service. It is established by the regions and autonomous provinces in
compliance with the legislation in force on the protection of personal data, according to the
provisions of art. 12 cited.

The FSN pursues multiple and specific purposes, as identified in paragraph 2 of art. 12 (in the text
applicable ratione temporis to the case in question, as provided for by art. 12 of Legislative Decree 18
October 2012, no. 179, in force until 26 January 2022 - before the amendments introduced by Legislative Decree 27
January 2002, no. 4, converted with amendments by Law 28 March 2022, no. 25).

The purposes are: a) prevention, diagnosis, treatment and rehabilitation; b) study and scientific research in the
medical, biomedical and epidemiological fields; c) health planning, verification of the
quality of care and evaluation of health care.

The subjects who can use the FSE change according to the purpose pursued, as well as
the quality of the data accessible for processing and the conditions for processing.

The purposes of prevention, diagnosis, treatment and rehabilitation (letter a) are pursued by the subjects
of the National Health Service and regional social-health services and by all practitioners of
the health professions who take care of the patient according to the methods of access by
each of the aforementioned subjects and by the practitioners of the health professions, as well as in
compliance with the security measures defined pursuant to paragraph 7.

The consultation of the data and documents for the purposes referred to in letter a) takes place in clear (i.e. with the name of the patient): the consultation can be carried out by the subjects
indicated above only with the consent of the patient and always in compliance with professional secrecy,
except in cases of health emergency according to methods identified for this purpose. Moreover, the lack of
consent by the assisted person does not affect the right to the provision of the service.

The assisted person can also consult his/her own FSE, in a protected and confidential form.

The purposes of study and scientific research in the medical, biomedical and epidemiological fields (letter

b) and health planning, verification of the quality of care and evaluation of
healthcare (letter c) are pursued by the regions and autonomous provinces, as well as by the
Ministry of Labor and Social Policies and the Ministry of Health within the limits of their
respective powers assigned by law, without using the identification data of the assisted persons present in the
FSE, according to access levels, methods and logic of organization and data processing
defined with the decree referred to in paragraph 7, in compliance with the principles of proportionality, necessity and

indispensability in the processing of personal data.
As can be seen from the Prime Ministerial Decree of 29 September 2015, no. 178, containing the Regulation on the electronic health record (as per art. 12, paragraph 7, of Legislative Decree no. 179 of 18 October 2012), complete information pursuant to art. 13 of the Personal Data Protection Code (art. 6) constitutes a prerequisite for the lawfulness of the processing. The data that flow into the FSE are related to the current and possibly previous state of health of the assisted person and are relevant as personal data, consisting of «any information relating to a natural person, identified or identifiable, even indirectly, by reference to any other information, including a personal identification number, pursuant to the Personal Data Protection Code;», and identification data, consisting of «personal data that allow the direct identification of the interested party, pursuant to the Personal Data Protection Code;» (art.1, letters s) and t), of the Prime Ministerial Decree of 29 September 2015, no. 178).

The processing of these data through the establishment of the individual FSE is based, by regulatory provision, on the free and informed consent of the assisted person and therefore does not fall within the cases of necessary processing.

In particular, the assisted person is required to give his/her first specific consent that makes it possible
to feed the FSE (art.6, paragraph 1, letter d) and art.7 of the Prime Ministerial Decree).

Furthermore, «a further specific consent is required limited to the consultation of the data and documents in the FSE, for the purposes referred to in letter a) of paragraph 2 of art.12…» (art.6, paragraph 1, letter e) and art.7 of the Prime Ministerial Decree).

Both consents are revocable.

As specified in Chapter II of the Prime Ministerial Decree of 29 September 2015, no. 178, the data controllers for
treatment purposes, for which a second consent is required, are the subjects of the SSN and the social-health services that take care of the assisted person (art.10); for the purpose of care, data processing services may also be provided, relating to diagnostic-therapeutic pathways, to support the prevention, diagnosis and treatment processes, but limited to the patient being treated (art.11).

It is also specified (art.13 - Access to FSE information for treatment purposes) that:

the FSE is a tool available to the patient that can allow access to the subjects of the
SSN and regional social-health services that take care of him;
access to the FSE information by these subjects is permitted only if all of the

following conditions occur:
a) the patient has given explicit consent to access the FSE;

b) the information to be processed is exclusively that pertinent to the treatment process in progress;

c) the subjects who access the information fall within the categories of subjects authorized to
consult the FSE indicated by the patient and are effectively involved in the treatment process. The regions and autonomous provinces and the Ministry of Health are the owners of the treatments for research

purposes (art.12 letter b, legislative decree no. 179/2012) and the treatments for government purposes (art.12, letter c)
legislative decree no. 179/2012).
For these purposes, the processing of the data in the FSE is permitted provided that they are deprived of the direct

identifying data of the patient and in compliance with the principle of indispensability, necessity,
relevance and non-excess in relation to the aforementioned purposes and the personal data listed therein (articles
15-20 of the Prime Ministerial Decree of 29 September 2015, no. 178).

5.1.- Having reconstructed the regulatory framework in this way, the objections appear to be well-founded.
5.2.- First of all, it should be noted that the lawfulness of the processing of FSE data is based on a
double, specific, free and informed consent by the patient: the first is constituted by the

consent to the feeding of the FSE with the data; the second is constituted by the consent to
consult the data and documents (in clear) contained in the FSE for the purposes of prevention,
diagnosis, treatment and rehabilitation (letter a).

The data controllers for the purposes of prevention, diagnosis, treatment and rehabilitation (which
requires the second consent) are the subjects of the National Health Service and the regional
social-health services and the health professionals who take care of the patient according to the
access methods by each of the aforementioned subjects and by the health professionals according to the permitted methods; the information to be processed is
exclusively that pertinent to the ongoing treatment process of the patient; for the purpose of care, data processing services may also be provided, relating to diagnostic-therapeutic pathways, to support prevention, diagnosis and treatment processes, but limited to the patient being treated. No processing of clear data that goes beyond the position and therapeutic interest of the individual patient to whom the FSE refers is provided for.
5.3.- It follows that the Court has precisely stated that ASUFC is the owner of the processing of personal data of patients included in individual FSEs, on the basis of double consent, even if the Court's conclusions on the non-attributability of the conduct to ASUFC cannot be shared, for the reasons that will be set out later (see 5.5.).

5.4.- However, the reconstruction carried out by the
Tribunal as secondary treatment, «not incompatible with the original purposes for which
the same information was collected» of the treatment in question, consisting in
the preparation of lists of patients falling within particular vulnerable categories through a
so-called stratification mechanism based on the examination of data from multiple FSEs, does not appear to be in accordance with the discipline examined, because -
according to the Court - «Ultimately, the activity carried out by Insiel S.p.a., on express regional
mandate, therefore consisted in a mere re-elaboration of data already collected and also available

to general practitioners, carried out with the primary objective of facilitating general practitioners
in the area in identifying patients in conditions of complexity and comorbidity, in order to
allow them a more timely and efficient management, in terms of prevention,
planning and programming, of vaccination in the pandemic context.» (fol.5).

Indeed, Article 5, letter b), second part, of the Regulation, which provides for "further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not, in accordance with Article 89, paragraph 1, be considered incompatible with the initial purposes ('purpose limitation');", to which the judge of the merits refers, is not applicable in the case in question.

This case cannot be included in the case governed by Article 5 above, both because the consent required in the specific case, by law, is limited to a specific processing, namely consultation, and because the research and governance purposes are expressly and

independently regulated and provide for the use of anonymized data.

It should be noted that the purpose pursued, although worthy of appreciation, does not exempt from
compliance with the legislation on the protection of personal data, supported by a high degree of

caution and rigor in relation to data relating to health.

In the case of the FSE, for treatment purposes, consent is required in relation to a specific
processing of personal data, consisting of the consultation of data and documents (art.12 of

legislative decree no. 179/2012 and art.7, paragraph 2, of the Prime Ministerial Decree of 29 September 2015, no. 178) and data
processing services, relating to diagnostic-therapeutic pathways, to support the
prevention, diagnosis and treatment processes, but limited to the patient being treated (art.11, paragraph 2, of the
Prime Ministerial Decree of 29 September 2015, no. 178).

The processing of data contained in the FSE for treatment purposes is, therefore, strictly limited to
data directly linked to the patient being treated and does not provide for any general re-elaboration
of data belonging to a plurality of patients aimed at creating a summary document
for healthcare planning purposes; on the other hand, the different purposes provided for by letters b) and c) of art. 12, paragraph 2, of Legislative Decree no. 179/2012 on research and governance are also expressly

regulated and must be pursued without using the identification data of the patients.
Therefore, the Court was wrong to consider that the processing of personal and identifying data in question constituted a so-called secondary processing and could go beyond the limits of the expressly permitted processing and could even be implemented beyond the scope of the individual FSE, by means of the cross-referencing and re-elaboration of data from a plurality of patients using an algorithm in order to give rise to a so-called "statistical stratification" of patients in conditions of complexity and comorbidity to be reported to General Practitioners (GPs).

5.5.- The contested decision is incorrect and must be quashed even where it excluded the imputability of the conduct to ASUFC on the grounds that the treatment in question had been decided by the Regional Council which had defined all the methods of its execution and that the patients had already expressed consent to the consultation of their data.

The reference to art. 2-ter of Regulation no. 2016/679/EU (Legal basis for
the processing of personal data carried out for the performance of a task of public interest or
connected to the exercise of public powers) because the regulatory extension of the legal basis also
to a general administrative act occurred following the amendment introduced by Legislative Decree
n.139/2021 and does not apply retroactively in relation to the activity carried

out previously, following the resolution of the Council dating back to 2020.
Furthermore, for the processing of special categories of personal data, including data relating
to health, Article 2 – sexies of the Regulation applies, which concerns the processing of

special categories of personal data, processing necessary for reasons of relevant public
interest and, in the case in question, it has not been ascertained that the processing was ordered because
it was necessary, for the reasons illustrated below (see 5.6.).

ASUFC, as the data controller, therefore had the duty to exercise all its
prerogatives to protect the use of the data stored by the FSE and there is no reason for exemption
from liability on the part of the data controller.

5.6.- As to whether or not the processing in question is necessary, it should be noted that the
Court, after having recalled recital 54 and art. 9 of the regulation, in the context of the
state of pandemic emergency decided by the Council of Ministers on 31 January 2020 and then
extended until 31 March 2022, of the Order of the Head of the Department of Civil
Protection (OCDPC) no. 630 of 3 February 2020, of art. 17 bis of the legislative decree n.18/2020 and art.1 of legislative decree n.34/2020, seems to deduce that the treatment in question was to be classified as necessary,

so much so that it could disregard the consent of the patient, on the basis of the circumstance that the decrees
had been expressly referred to in the Preamble to the Memorandum of Understanding between the FVG Region and the
trade unions of the GPs for the regulation of the two-year period 2020-2021 and the activities connected
to the Covid-19 epidemiological emergency and constituted the primary regulatory
foundation for the processing of health data prescribed by the resolution of the Regional Council n.

1737/2020, within the legislative and regulatory powers attributed to the

Region itself.
This conclusion cannot be shared.

The pandemic emergency and the reference to the legislation adopted in this circumstance in the Preamble
of the Council resolution is not sufficient to qualify the static stratification treatment
as necessary treatment, in the absence of a detailed examination of the concrete
explanation in the Council resolution of the specific prerequisites for necessary
treatment, as required by articles 1 and 17 bis of the legislative decree, both in terms of competence for the treatment and in terms of concrete
compliance with article 9, paragraph 2, letters g), h) and i) and article 10 of regulation no. 2016/679/EU, and in
terms of assessment of the effective adoption or otherwise of appropriate measures to protect the
rights and freedoms of the interested parties (article 17 bis, paragraph 2, legislative decree 18/2020).

5.7.- The reference contained in the judgment to the discipline of professional secrecy to which doctors are subject and to the derogation hypothesis of the obligation of prior information provided for by art. 14, par. 5, letter d) of regulation no. 2016/679/EU is not relevant to the present case and
even on this point the decision appears incorrect: what is being examined in the injunction order is,
in fact, the conduct of the ASUFC and not that of the referring doctors of each patient,
subject to professional secrecy.

5.8.- Finally, the criticism regarding the finding of non-existence of the
violation of art. 35 of regulation no. 2016/679/EU, relating to the contestation of failure to
assess the impact of the processing of personal data, must also be upheld.

Pursuant to art. 35 of Regulation no. 2016/679/EU «1. Where a type of processing, in particular when it involves the use of new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data…» and also «3. The data protection impact assessment referred to in paragraph 1 shall be required in particular in the following cases. … (b) processing on a large scale of special categories of personal data referred to in Article 9, paragraph 1, or of data relating to criminal convictions and offences referred to in Article 10». The impact assessment must therefore be carried out by the controller, before the start of the processing and it is the controller who must decide – in light of the criteria indicated in Article 35 of the Regulation – whether or not to proceed with the task.
Contrary to what the Court assumes - the novelty of the technologies used should not be assessed
in the abstract, but in relation to the technical specifications of the tool used, since,

otherwise, the term algorithm would be a mere, tendentially neutral, nomen.

Furthermore, when a treatment with characteristics attributable to the provision of
art. 35 of the Regulation occurs, it is the data controller - who has the preventive burden of

proceeding with the risk analysis - who must demonstrate, in the face of the
Garante's challenge, the correct implementation of the rules and practices on the
protection of personal data and not the Guarantor, as the Court seems to believe when it accuses the Guarantor of not having
attached, nor asked to demonstrate what the high risk was for the
rights and freedoms of natural persons.6.- In conclusion, the appeal must be upheld; the contested sentence must be quashed with referral of the case,

also for the ruling on the costs of this judgment, to the Court of Udine in the person of
a different magistrate.
P.Q.M.

- Accepts the appeal and annuls the contested sentence with referral of the case to the Court of Udine,
in the person of a different magistrate, who is also entrusted with providing for the costs of the judgment of
legitimacy.

Thus decided in Rome, in the Council Chamber of the First Civil Section, on 19 November 2024.

Filed in the Registry on 6 March 2025