Banner1.png
Banner3.png

Garante per la protezione dei dati personali (Italy) - 9677521

From GDPRhub
Garante per la protezione dei dati personali (Italy) - 9677521
LogoIT.png
Authority: Garante per la protezione dei dati personali (Italy)
Jurisdiction: Italy
Relevant Law: Article 5(1)(a) GDPR
Article 5(1)(c) GDPR
Article 83 GDPR
Type: Investigation
Outcome: Violation Found
Decided: 10.06.2021
Published: 09.07.2021
Fine: 20000 EUR
Parties: n/a
National Case Number/Name: 9677521
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Italian
Original Source: The Italian DPA (Garante) (in IT)
Initial Contributor: n/a

The Italian DPA fined a dentist €20,000 for refusing treatment to patients who indicated that they had HIV in a patient history form. It held that there is no lawful or legitimate basis for collecting patient's infection history in order to withhold dental treatment from certain patients.

English Summary[edit | edit source]

Facts[edit | edit source]

The dentist, Dr. Marini, required that patients fill out a medical history questionnaire before receiving dental services at his office. The questionnaire asked about previous, existing or suspected infectious diseases (e.g. tuberculosis, hepatitis, HIV). The complainant, a prospective patient, indicated that he was positive for an HIV infection. The dentist subsequently refused to give him dental treatment, claiming that the complainant’s HIV infection would prevent him from “averting a possible contagion of staff and other patients.”

Italian national law (Law of June 5 1990, n. 135) holds that specific precautions to prevent contagion should be taken for each individual patient, such that patients with HIV infections can access dental services. Meanwhile, Article 5 GDPR provides that personal data must be processed in a lawful and transparent manner, relevant and limited to what is necessary with respect to the purposes for which they are processed (the principles of "lawfulness, fairness, transparency" and “data minimization”). In combination, this means that patient history on infectious diseases can only be used to provide a better plan of medical treatment.

Holding[edit | edit source]

The Italian DPA (Garante) held that Dr. Marini had violated the basic principles of processing in Article 5 GDPR by collecting information on infectious diseases from patients regardless of the type of intervention to be carried out to provide care. In this way, Dr. Marini processed personal data about HIV infection status in a way that is not relevant to the purpose for which it can be processed. Information about infection history can only be collected in order to know the patient's clinical history and to identify the most appropriate therapy. Further, information about HIV infection can only be collected if it is deemed necessary by the treating physician for the type of health intervention.

Using HIV infection information to refuse treatment, is not, however, a legitimate and necessary basis for processing such data. The DPA explained that Dr. Marini failed to process the complainant’s health data with the concrete purpose of evaluating the best therapy for the patient, offering him the required service, and possibly also taking additional measures against the risk of contagion.

Therefore, and pursuant to Article 83 GDPR, the DPA issued the dentist with an administrative fine of € 20,000.


Comment[edit | edit source]

Share your comments here!

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.














[doc. web n. 9677521]

Injunction order - 10 June 2021

Record of measures
n. 239 of 10 June 2021

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC, "General Data Protection Regulation" (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196 containing the "Code regarding the protection of personal data, containing provisions for the adaptation of the national system to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of individuals with regard to to the processing of personal data, as well as to the free circulation of such data and which repeals Directive 95/46 / EC (hereinafter the "Code");

GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution no. 98 of 4/4/2019, published in the Official Gazette n. 106 of 8/5/2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter "Regulation of the Guarantor no. 1/2019");

Having seen the documentation in deeds;

Given the observations made by the secretary general pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and operation of the office of the Guarantor for the protection of personal data, in www.gpdp.it, doc. web n. 1098801;

Rapporteur the lawyer Guido Scorza;

WHEREAS

1. The complaint

With a note of the XX Mr. XX has formulated a complaint in relation to the request, by the dott. Marini, to fill out a questionnaire in order to be able to access the dental services offered at his doctor's office. As evidenced, through the aforementioned questionnaire, distributed and then collected upon acceptance of the patient, it was required, as part of a general anamnestic collection, to highlight even if you have had (or suspected) of having infectious diseases , such as tuberculosis, hepatitis A, B, C and HIV (AIDS).

The complainant stated that, after having provided the information relating to his positive HIV infection, the doctor would have warned himself that he could not perform the required professional activity, since "his diagnosis of HIV seropositivity does not it allowed him to avert a possible contagion of staff and other patients ".

2. The preliminary activity

The Authority has made a request for information to Dr. Marini, aimed at knowing, in particular, the reasons that would make it essential to collect, at the time of acceptance, information relating to any state of seropositivity, taking into account that the precautions aimed at protecting against contagion must be adopted towards each patient that turns to the doctor's office (note of the XX, prot. n. XX).

With a note of the twentieth, Dr. Marini provided feedback, stating that:

- "It is a well-established practice to carry out, in the exercise of my activity as a dental surgeon, indiscriminately to every patient who requests treatment of any kind, a general medical history of his state of health. Up to now, I have considered the information requested relating to the patient's seropositivity to be indispensable, like the other information reported in the anamnesis at the time of acceptance (..) in order to formulate a correct diagnosis of the patient himself and the correct programming of the treatment plan. more appropriate treatment for the resolution of any diseases of the oral cavity ";

- "Tartar ablation or professional oral hygiene, which can never be performed after a complete oral examination and which is counted among the services that the patient who refers to a public or private facility for the first time can request, should not be considered secondary medical treatment. Indeed, it is a key element in the prevention of periodontal pathologies and sometimes constitutes the treatment itself or the initial phase of a broader and more complex treatment aimed at resolving the pathologies affecting the supporting tissues of the tooth (gingivitis and periodontitis), such as the state of immunodeficiency is a predisposing factor. In this regard, the visit that precedes the treatment should not only be based on the patient's physical examination but also on the collection of all the data that can lead to a correct classification of the patient's condition, in order to achieve the objectives of the treatment itself or avoid any negative effects ";

- "the information requested relating to the patient's seropositivity status at the time of acceptance, does not in any way concern all the precautionary and prevention measures of the transmission routes (direct or indirect) of the pathology between patient-doctor, nor doctor-patient , nor patient-patient, which are implemented, in any case and as provided, regardless of what the patient reports (for example, who may not even be aware of his HIV-positive status) ", specifying that" if I had knowledge of a patient's HIV status, I could, without in any way discriminating against the individual affected by this pathology, in the context of the management of my professional activity, prepare additional preventive measures to the essential and mandatory ones already provided for by the regulations, increasing the already high standards of safety and hygiene prepared in my professional activity, in the exclusive interest of my patients i and myself ".

With reference to what emerged from the examination of the documentation examined and from the declarations made, taking into account that the described conduct did not comply with the relevant legislation on the protection of personal data, the Office, with deed of XX (prot. XX), notified Dr. Marini, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, par. 2, of the Regulations, inviting him to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (art.166, paragraphs 6 and 7, of the Code, as well as art.18, paragraph 1, ln 689 of 24 November 1981 ).

In particular, the Office, in the aforementioned deed, represented that:

- art. 5 of the Regulation provides that personal data must be processed in a lawful, correct and transparent manner towards the interested party and must be adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed (so-called principles of "lawfulness, correctness , transparency "and" data minimization ": Article 5, paragraph 1, letters a) and c) of the Regulation);

- the Guarantor has already considered the collection, during the acceptance phase, of information relating to the possible state of seropositivity of each patient who comes to the doctor's office for the first time in contrast with the aforementioned principles, regardless of the type of clinical intervention or from the therapeutic plan that the same must carry out (cf. Provv. 12 November 2009 n. 35, web doc. n. 1673588; cf., also, Prov. 12 November 2009, web doc. n. 1686068, whose prescriptions are considered compatible with the Regulation and with the provisions of decree no.101 / 2018; see Article 22, paragraph 4, of the aforementioned Legislative Decree no. 101/2018);

- the law of 5 June 1990, n. 135 (Program of urgent interventions for the prevention and fight against AIDS) has established specific provisions for the protection of professional HIV infection in public and private health and care facilities, implemented with Ministerial Decree September 28, 1990 (art.7). In consideration of the impossibility "of identifying with certainty all patients with HIV infection", the legislator considered that the "precautions aimed at protecting against contagion (...)" should be adopted "towards the generality of the assisted persons" (cf. premises of the aforementioned decree). In particular, the specific precautions envisaged for dental operators must be adopted for "each individual patient" (see art. 4 of the aforementioned decree).

Having said that, on the basis of the elements acquired, with the aforementioned XX document, the Office found that Dr. Marini has processed personal data in violation of the basic principles of processing (Article 5 of the Regulation) for having collected information on infectious diseases including those relating to HIV, at the time of acceptance, regardless of the type of intervention to be carried out or a plan of care to be undertaken.

With a note of the twentieth, the same doctor, through the lawyer Sgroi, sent his defense briefs, in which, in particular, it was represented that:

a) “it must first of all be represented that Mr. XX has come into contact with Dr. Marini through the well-known web portal“ Groupon ”. (..) In the first phase, when registering and registering on the platform, the consumer / user creates his own account or identification profile through which he can access the various promotions offered by suppliers affiliated with the portal. Once registered, he will be able to select the offers of his interest, by purchasing Coupons / Vouchers / coupons which are in effect the right to use the chosen service and already paid. (…). It is important to note that, at the time of creating his personal account, the user is informed about the functioning of the platform and that (...) in this first phase he provides his "basic" identification data (essentially personal data and email address );

b) "Mr. XX therefore presented himself in the professional office of Dr. Marini technically already in the executive phase, having already indicated and purchased, through the Groupon platform, the type of professional service (in this case dental). Already the above should therefore be sufficient to clarify how, when Dr. Marini collected the information whose excess was contested, it was no longer in the preliminary "acceptance" phase of the doctor-patient relationship, but rather we already moved in the executive-medical phase of the professional relationship ";

c) "what the professional wanted to point out in the preliminary investigation, albeit perhaps with linguistically inappropriate terms, and which we want to reiterate here is, in essence, that the general anamnestic questionnaire" indicted ", which would have been unlawfully packaged and then subjected to XX, was inserted precisely and already "within the treatment process", what precisely the precedents of the Guarantor referred to in the notice of dispute allow to configure as a fully legitimate activity on the part of the doctor (see the provisions of 12/11 / 2009 n.35 of 12 November 2009, web doc. 1673588, and the prescriptive provision referred to in web doc. 1686068);

d) "it appears necessary to dwell on the substance of the relationship between XX and Dr. Marini and analyze its already-executive establishment, having in mind the dimensional requirements of the professional office of the accused, which is characterized in a specifically personal way, since Dr. Alessandro Marini is the only professional working in the studio (where, occasionally, also the young son of Dr. Marini - Lorenzo - but as a consultant). If one arises from this point of view, one cannot fail to note the substantial difference between the case in question and the situations already sanctioned by the Authority with the provisions of 12/11/2009. In the precedents referred to by the Guarantor (..), the sanctioned dental practice had, in particular, a completely different structure from that of Dr. Marini's office. It was in fact a sort of clinic or outpatient clinic, with a clear prevalence of the material element (as suggested by the name, "The Net") over the personal one ";

e) "it must therefore be noted that in relation to a study such as that of Dr. Marini it is never, in practice, possible to clearly distinguish the phase of acceptance (" first contact ") of the user from that of the effective medical-patient diagnostic contact, since both phases are always carried out by the same subject who is, in fact, a professional himself and are, for this absorbing reason, always destined in some way to become de facto confused. This different situation, in light of the constitutional principle of reasonableness (Article 3 of the Constitution), requires a difference in treatment. The case of the study of the single professional, who receives and treats the patient at his own office where he works alone, is therefore concretely different - it is reiterated - from that of an organized and structured medical center in which ten professionals work in which, for force of things, the "acceptance" phase frames the phase of "first" and mere administrative contact between the structure and a user and does not arrive or can be confused with the subsequent, personal / professional one between the patient and the individual professional to whom he is entrusted to receive effective care ";

f) the anamnestic questionnaire was "modified, inserting it in a context that makes it immediately clear how the request for information is already included" as part of the treatment process ", a condition of legitimacy set by the Authority. The collection of essential personal data was thus clearly separated from the part containing the requests for information useful for reconstructing the patient's general medical history ”.

As part of the information provided in relation to the elements referred to in art. 83, par. 2 of the Regulation, in addition to what has already been stated, it was highlighted that:

- "Dr. Marini carries out his profession individually and does not make use of administrative staff "and" has never refused sic et simpliciter to provide the dental service (a circumstance that, in mere hypothesis, would be relevant at a civil law level), but asked the patient that the information about the low viral load were clinically proven with recent analyzes, declaring then available to provide the health service ";

- "in abstract terms, the violation (concretely, however non-existent) would be of a culpable nature".

On the 20th, the hearing requested by the data controller was held before the Authority, during which, in relation to the notified violation, what had already been stated was reiterated and, in any case, it was specified that:

- "the legitimacy of the complaint relates only to the episode that occurred on the XXth and that, in that circumstance, by express admission of XX, the questionnaire was only administered to him by Dr. Marini who welcomed him at the studio;

- "the questionnaire was already of a medical nature, having the same anamnestic purpose";

- "in the same declarations made by Marini in the preliminary phase, it emerges that Marini himself referred to the strictly medical phase of the professional treatment";

- "the new forms have, however, eliminated the indiscriminate collection of data relating to infections even in the anamnestic phase, by inserting a free field that patients can fill in, in relation to the medical treatment to be carried out".

3. Outcome of the preliminary investigation

Given that, unless the fact constitutes a more serious crime, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false documents or documents, is liable pursuant to art. 168 of the Code ("False statements to the Guarantor and interruption of the execution of the tasks or the exercise of the powers of the Guarantor"), following the declarations made to the Authority during the procedure as well as the examination of the documentation acquired, that Dr. Marini has processed personal data in violation of the basic principles of processing pursuant to art. 5 Regulation for having carried out a processing of data that is not relevant to the purposes for which they were processed.

4. Conclusions

The elements reported by the owner in the defense briefs and in the hearing are insufficient to overcome the objections raised by the Office with the act of initiation of the procedure and, therefore, to allow the filing of the procedure, not recurring, however, any of the cases provided for by art. 11 of the Guarantor Regulation n. 1/2019.

Preliminarily, it should be noted that in the case in question, the acceptance phase, in which the patient comes into contact with the office for the first time, and the phase of diagnosis and treatment, in which the information on health, is not easy to distinguish. they are collected in order to know the patient's clinical history and to identify, for the same, the most correct therapy.

In any case, if, in general, the request to acquire the information occurs at the time of the start of the medical report in view of the correct programming of the treatment plan most appropriate to the individual case, the specialist can legitimately collect the data relating to the possible presence of an HIV infection, if the aforementioned anamnestic information is deemed necessary by the attending physician according to the type of health intervention or therapeutic plan to be performed on the patient, without prejudice to the patient's willingness to decide, in an informed way (and therefore informed) and responsible, not to communicate to the doctor some health events that concern him.

It should be noted, on this point, that it is not up to the Guarantor to analyze the relevance and necessity of the information collected to pursue the specific purpose of treatment, as it is a technical-scientific and non-legal evaluation, which is solely the responsibility of the health specialist. who is called upon to consider all aspects relating to the state of health that may be relevant for the purpose of treating a patient.
That said, accepting the hypothesis put forward in the defensive briefs, according to which the collection of information relating to the presence of infectious diseases (including HIV infection) took place as part of the treatment by Dr. Marini, the legal basis of this collection would be found in the pursuit of a purpose of diagnosis, assistance or health therapy, indicated in art. 9, par. 2, lett. h) of the Regulations.

However, it is noted that the aforementioned treatment activity was not, in practice, carried out, considering that the specialist informed the patient that he could not submit him to the required services. Therefore, even if in line with the assumption according to which the aforementioned collection would have taken place in the context of the treatment activity, and neglecting any medical deontology profiles, on which the Authority is not competent, the circumstance that the service has not, in fact, been implemented by the will of the doctor, does not eliminate the legal basis for the treatment of data relating to health, in particular, consisting in the acquisition of information relating to the presence of HIV infection.

It therefore emerges that the collection of the aforementioned information did not have the concrete purpose of evaluating the best therapy for the patient, offering him the requested service, possibly also with a strengthening of the protections against the risk of contagion (the adoption of which, it is recalled, is , in any case, with reference to those of a general nature, mandatory for all operators, in public and private health and assistance structures; to these are added the specific precautions for dental operators, "considering that, at the current state of knowledge scientific studies, it is not possible to identify with certainty all patients with HIV infection "- see premises and articles 1 and 4 of the aforementioned Ministerial Decree of 28 September 1990), but rather to remove the patient by refusing the treatments requested by him.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by Dr. Marini, in violation of art. 5 of the Regulations, within the terms set out in the motivation.

5. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (articles 58, par. 2, lett. I and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The violation of art. 5 of the Regulation, determined by the processing of personal data, subject of this provision, carried out by dr. Marini, is subject to the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, lett. a) of the Regulations.

Consider that the Guarantor, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations, as well as art. 166 of the Code, has the power to "inflict a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or instead of such measures, depending on the circumstances of each single case "and, in this context," the College [of the Guarantor] adopts the injunction order, with which it also disposes with regard to the application of the ancillary administrative sanction of its publication, in whole or in excerpt, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code "(Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).

The aforementioned administrative fine imposed, depending on the circumstances of each individual case, must be determined in the amount taking into account the principles of effectiveness, proportionality and dissuasiveness, indicated in art. 83, par. 1, of the Regulation, in light of the elements provided for in art. 83, par. 2, of the Regulation in relation to which, in particular, it is noted that:

- the data processing carried out concerned information on the state of health, in particular, relating to HIV infection, for which the legislator has provided for enhanced protection of the interested party and potentially all of Dr. Marini (Article 83, paragraph 2, letter a), e) and g) of the Regulations);

- the interested party has suffered prejudicial consequences due to the effect of the doctor's conduct, as he has not received the required health service (Article 83, paragraph 2, letter k) of the Regulations);

- despite having the doctor collaborated promptly with the Authority during the investigation, the violation is not culpable (Article 83, paragraph 2, letters b) and f) of the Regulations).

Due to the aforementioned elements, assessed as a whole, it is believed to determine the amount of the pecuniary sanction provided for by art. 83, par. 5, lett. a) of the Regulations, to the extent of € 20,000 (twenty thousand) for the violation of art. 5 of the Regulation as a pecuniary administrative sanction, pursuant to art. 83, par. 1, of the Regulation, effective, proportionate and dissuasive.

It is also believed that the ancillary sanction of the publication on the website of the Guarantor of this provision, provided for by art. 166, paragraph 7, of the Code and art. 16 of the Guarantor Regulation n. 1/2019, in relation to the particular category of personal data processed and the potential number of data subjects.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

WHEREAS, THE GUARANTOR

the violation of art. 5 of the Regulations, declares the unlawfulness of the processing of personal data carried out by Dr. Marini in the terms mentioned in the motivation;

ORDER

to dr. Marini, born in XX the XX, C.F. XX, resident in XX, with professional domicile in Via XX, electively domiciled in Via XX, XX, at XX, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations, as well as art. 166 of the Code, to pay the sum of € 20,000.00 (twenty thousand) as a pecuniary administrative sanction for the violation referred to in this provision, according to the methods indicated in the annex, within 30 days from the notification of motivation; it is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;

INJUNCES

to the aforementioned Dr. Marini, in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of € 20,000.00 (twenty thousand), according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. . 27 of the law n. 689/1981.

HAS

- the publication of this provision on the website of the Guarantor, pursuant to art. 166, paragraph 7, of the Code;

- the annotation of this provision in the internal register of the Authority - provided for by art. 57, par. 1, lett. u), of the Regulations, as well as by art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor - relating to violations and measures adopted in accordance with art. 58, par. 2, of the same Regulation.

Pursuant to art. 78 of the Regulation, of art. 152 of the Code and 10 of Legislative Decree no. 150/2011, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.

Rome, June 10, 2021

PRESIDENT
Stanzione

THE RAPPORTEUR
Peel

THE SECRETARY GENERAL
Mattei









   function printDiv (divIdToPrint, title)
    {
var divToPrint = document.getElementById (divIdToPrint);
var newWin = window.open ('', 'Print-Window');
newWin.document.open ();
newWin.document.write ('<html> <body onload = "window.print ()"> <img style = "width: 100%;" src = "/ o / guarante-privacy-theme / images / topdoc.gif "/> <h2 class =" internal-title "> '+ title +' </h2> '+ divToPrint.innerHTML +' </body> </html> ');
newWin.document.close ();
setTimeout (function () {newWin.close ();}, 10);
  }




[doc. web n. 9677521]

Injunction order - 10 June 2021

Record of measures
n. 239 of 10 June 2021

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC, "General Data Protection Regulation" (hereinafter the "Regulation");

GIVEN the legislative decree 30 June 2003, n. 196 containing the "Code regarding the protection of personal data, containing provisions for the adaptation of the national system to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of individuals with regard to to the processing of personal data, as well as to the free circulation of such data and which repeals Directive 95/46 / EC (hereinafter the "Code");

GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution no. 98 of 4/4/2019, published in the Official Gazette n. 106 of 8/5/2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter "Regulation of the Guarantor no. 1/2019");

Having seen the documentation in deeds;

Given the observations made by the secretary general pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and operation of the office of the Guarantor for the protection of personal data, in www.gpdp.it, doc. web n. 1098801;

Rapporteur the lawyer Guido Scorza;

WHEREAS

1. The complaint

With a note of the XX Mr. XX has formulated a complaint in relation to the request, by the dott. Marini, to fill out a questionnaire in order to be able to access the dental services offered at his doctor's office. As evidenced, through the aforementioned questionnaire, distributed and then collected upon acceptance of the patient, it was required, as part of a general anamnestic collection, to highlight even if you have had (or suspected) of having infectious diseases , such as tuberculosis, hepatitis A, B, C and HIV (AIDS).

The complainant stated that, after having provided the information relating to his positive HIV infection, the doctor would have warned himself that he could not perform the required professional activity, since "his diagnosis of HIV seropositivity does not it allowed him to avert a possible contagion of staff and other patients ".

2. The preliminary activity

The Authority has made a request for information to Dr. Marini, aimed at knowing, in particular, the reasons that would make it essential to collect, at the time of acceptance, information relating to any state of seropositivity, taking into account that the precautions aimed at protecting against contagion must be adopted towards each patient that turns to the doctor's office (note of the XX, prot. n. XX).

With a note of the twentieth, Dr. Marini provided feedback, stating that:

- "It is a well-established practice to carry out, in the exercise of my activity as a dental surgeon, indiscriminately to every patient who requests treatment of any kind, a general medical history of his state of health. Up to now, I have considered the information requested relating to the patient's seropositivity to be indispensable, like the other information reported in the anamnesis at the time of acceptance (..) in order to formulate a correct diagnosis of the patient himself and the correct programming of the treatment plan. more appropriate treatment for the resolution of any diseases of the oral cavity ";

- "Tartar ablation or professional oral hygiene, which can never be performed after a complete oral examination and which is counted among the services that the patient who refers to a public or private facility for the first time can request, should not be considered secondary medical treatment. Indeed, it is a key element in the prevention of periodontal pathologies and sometimes constitutes the treatment itself or the initial phase of a broader and more complex treatment aimed at resolving the pathologies affecting the supporting tissues of the tooth (gingivitis and periodontitis), such as the state of immunodeficiency is a predisposing factor. In this regard, the visit that precedes the treatment should not only be based on the patient's physical examination but also on the collection of all the data that can lead to a correct classification of the patient's condition, in order to achieve the objectives of the treatment itself or avoid any negative effects ";

- "the information requested relating to the patient's seropositivity status at the time of acceptance, does not in any way concern all the precautionary and prevention measures of the transmission routes (direct or indirect) of the pathology between patient-doctor, nor doctor-patient , nor patient-patient, which are implemented, in any case and as provided, regardless of what the patient reports (for example, who may not even be aware of his HIV-positive status) ", specifying that" if I had knowledge of a patient's HIV status, I could, without in any way discriminating against the individual affected by this pathology, in the context of the management of my professional activity, prepare additional preventive measures to the essential and mandatory ones already provided for by the regulations, increasing the already high standards of safety and hygiene prepared in my professional activity, in the exclusive interest of my patients i and myself ".

With reference to what emerged from the examination of the documentation examined and from the declarations made, taking into account that the described conduct did not comply with the relevant legislation on the protection of personal data, the Office, with deed of XX (prot. XX), notified Dr. Marini, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, par. 2, of the Regulations, inviting him to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (art.166, paragraphs 6 and 7, of the Code, as well as art.18, paragraph 1, ln 689 of 24 November 1981 ).

In particular, the Office, in the aforementioned deed, represented that:

- art. 5 of the Regulation provides that personal data must be processed in a lawful, correct and transparent manner towards the interested party and must be adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed (so-called principles of "lawfulness, correctness , transparency "and" data minimization ": Article 5, paragraph 1, letters a) and c) of the Regulation);

- the Guarantor has already considered the collection, during the acceptance phase, of information relating to the possible state of seropositivity of each patient who comes to the doctor's office for the first time in contrast with the aforementioned principles, regardless of the type of clinical intervention or from the therapeutic plan that the same must carry out (cf. Provv. 12 November 2009 n. 35, web doc. n. 1673588; cf., also, Prov. 12 November 2009, web doc. n. 1686068, whose prescriptions are considered compatible with the Regulation and with the provisions of decree no.101 / 2018; see Article 22, paragraph 4, of the aforementioned Legislative Decree no. 101/2018);

- the law of 5 June 1990, n. 135 (Program of urgent interventions for the prevention and fight against AIDS) has established specific provisions for the protection of professional HIV infection in public and private health and care facilities, implemented with Ministerial Decree September 28, 1990 (art.7). In consideration of the impossibility "of identifying with certainty all patients with HIV infection", the legislator considered that the "precautions aimed at protecting against contagion (...)" should be adopted "towards the generality of the assisted persons" (cf. premises of the aforementioned decree). In particular, the specific precautions envisaged for dental operators must be adopted for "each individual patient" (see art. 4 of the aforementioned decree).

Having said that, on the basis of the elements acquired, with the aforementioned XX document, the Office found that Dr. Marini has processed personal data in violation of the basic principles of processing (Article 5 of the Regulation) for having collected information on infectious diseases including those relating to HIV, at the time of acceptance, regardless of the type of intervention to be carried out or a plan of care to be undertaken.

With a note of the twentieth, the same doctor, through the lawyer Sgroi, sent his defense briefs, in which, in particular, it was represented that:

a) “it must first of all be represented that Mr. XX has come into contact with Dr. Marini through the well-known web portal“ Groupon ”. (..) In the first phase, when registering and registering on the platform, the consumer / user creates his own account or identification profile through which he can access the various promotions offered by suppliers affiliated with the portal. Once registered, he will be able to select the offers of his interest, by purchasing Coupons / Vouchers / coupons which are in effect the right to use the chosen service and already paid. (…). It is important to note that, at the time of creating his personal account, the user is informed about the functioning of the platform and that (...) in this first phase he provides his "basic" identification data (essentially personal data and email address );

b) “Mr. XX therefore presented himself in the professional office of Dr. Marini technically already in the executive phase, having already indicated and purchased, through the Groupon platform, the type of professional service (in this case dental). Already the above should therefore be sufficient to clarify how, when Dr. Marini collected the information whose excess was contested, it was no longer in the preliminary "acceptance" phase of the doctor-patient relationship, but rather we already moved in the executive-medical phase of the professional relationship ";

c) "what the professional wanted to point out in the preliminary investigation, albeit perhaps with linguistically inappropriate terms, and which we want to reiterate here is, in essence, that the general anamnestic questionnaire" indicted ", which would have been unlawfully packaged and then subjected to XX, was inserted precisely and already "within the treatment process", what precisely the precedents of the Guarantor referred to in the notice of dispute allow to configure as a fully legitimate activity on the part of the doctor (see the provisions of 12/11 / 2009 n.35 of 12 November 2009, web doc. 1673588, and the prescriptive provision referred to in web doc. 1686068);

d) "it appears necessary to dwell on the substance of the relationship between XX and Dr. Marini and analyze its already-executive establishment, having in mind the dimensional requirements of the professional office of the accused, which is characterized in a specifically personal way, since Dr. Alessandro Marini is the only professional working in the studio (where, occasionally, also the young son of Dr. Marini - Lorenzo - but as a consultant). If one arises from this point of view, one cannot fail to note the substantial difference between the case in question and the situations already sanctioned by the Authority with the provisions of 12/11/2009. In the precedents referred to by the Guarantor (..), the sanctioned dental practice had, in particular, a completely different structure from that of Dr. Marini's office. It was in fact a sort of clinic or outpatient clinic, with a clear prevalence of the material element (as suggested by the name, "The Net") over the personal one ";

e) "it must therefore be noted that in relation to a study such as that of Dr. Marini it is never, in practice, possible to clearly distinguish the phase of acceptance (" first contact ") of the user from that of the effective medical-patient diagnostic contact, since both phases are always carried out by the same subject who is, in fact, a professional himself and are, for this absorbing reason, always destined in some way to become de facto confused. This different situation, in light of the constitutional principle of reasonableness (Article 3 of the Constitution), requires a difference in treatment. The case of the study of the single professional, who receives and treats the patient at his own office where he works alone, is therefore concretely different - it is reiterated - from that of an organized and structured medical center in which ten professionals work in which, for force of things, the "acceptance" phase frames the phase of "first" and mere administrative contact between the structure and a user and does not arrive or can be confused with the subsequent, personal / professional one between the patient and the individual professional to whom he is entrusted to receive effective care ";

f) the anamnestic questionnaire was "modified, inserting it in a context that makes it immediately clear how the request for information is already included" as part of the treatment process ", a condition of legitimacy set by the Authority. The collection of essential personal data was thus clearly separated from the part containing the requests for information useful for reconstructing the patient's general medical history ”.

As part of the information provided in relation to the elements referred to in art. 83, par. 2 of the Regulation, in addition to what has already been stated, it was highlighted that:

- "Dr. Marini carries out his profession individually and does not make use of administrative staff "and" has never refused sic et simpliciter to provide the dental service (a circumstance that, in mere hypothesis, would be relevant at a civil law level), but asked the patient that the information about the low viral load were clinically proven with recent analyzes, declaring then available to provide the health service ";

- "in abstract terms, the violation (concretely, however non-existent) would be of a culpable nature".

On the 20th, the hearing requested by the data controller was held before the Authority, during which, in relation to the notified violation, what had already been stated was reiterated and, in any case, it was specified that:

- "the legitimacy of the complaint relates only to the episode that occurred on the XXth and that, in that circumstance, by express admission of XX, the questionnaire was only administered to him by Dr. Marini who welcomed him at the studio;

- "the questionnaire was already of a medical nature, having the same anamnestic purpose";

- "in the same declarations made by Marini in the preliminary phase, it emerges that Marini himself referred to the strictly medical phase of the professional treatment";

- "the new forms have, however, eliminated the indiscriminate collection of data relating to infections even in the anamnestic phase, by inserting a free field that patients can fill in, in relation to the medical treatment to be carried out".

3. Outcome of the preliminary investigation

Given that, unless the fact constitutes a more serious crime, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false documents or documents, is liable pursuant to art. 168 of the Code ("False statements to the Guarantor and interruption of the execution of the tasks or the exercise of the powers of the Guarantor"), following the declarations made to the Authority during the procedure as well as the examination of the documentation acquired, that Dr. Marini has processed personal data in violation of the basic principles of processing pursuant to art. 5 Regulation for having carried out a processing of data that is not relevant to the purposes for which they were processed.

4. Conclusions

The elements reported by the owner in the defense briefs and in the hearing are insufficient to overcome the objections raised by the Office with the act of initiation of the procedure and, therefore, to allow the filing of the procedure, not recurring, however, any of the cases provided for by art. 11 of the Guarantor Regulation n. 1/2019.

Preliminarily, it should be noted that in the case in question, the acceptance phase, in which the patient comes into contact with the office for the first time, and the phase of diagnosis and treatment, in which the information on health, is not easy to distinguish. they are collected in order to know the patient's clinical history and to identify, for the same, the most correct therapy.

In any case, if, in general, the request to acquire the information occurs at the time of the start of the medical report in view of the correct programming of the treatment plan most appropriate to the individual case, the specialist can legitimately collect the data relating to the possible presence of an HIV infection, if the aforementioned anamnestic information is deemed necessary by the attending physician according to the type of health intervention or therapeutic plan to be performed on the patient, without prejudice to the patient's willingness to decide, in an informed way (and therefore informed) and responsible, not to communicate to the doctor some health events that concern him.

It should be noted, on this point, that it is not up to the Guarantor to analyze the relevance and necessity of the information collected to pursue the specific purpose of treatment, as it is a technical-scientific and non-legal evaluation, which is solely the responsibility of the health specialist. who is called upon to consider all aspects relating to the state of health that may be relevant for the purpose of treating a patient.
That said, accepting the hypothesis put forward in the defensive briefs, according to which the collection of information relating to the presence of infectious diseases (including HIV infection) took place as part of the treatment by Dr. Marini, the legal basis of this collection would be found in the pursuit of a purpose of diagnosis, assistance or health therapy, indicated in art. 9, par. 2, lett. h) of the Regulations.

However, it is noted that the aforementioned treatment activity was not, in practice, carried out, considering that the specialist informed the patient that he could not submit him to the required services. Therefore, even if in line with the assumption according to which the aforementioned collection would have taken place in the context of the treatment activity, and neglecting any medical deontology profiles, on which the Authority is not competent, the circumstance that the service has not, in fact, been implemented by the will of the doctor, does not eliminate the legal basis for the treatment of data relating to health, in particular, consisting in the acquisition of information relating to the presence of HIV infection.

It therefore emerges that the collection of the aforementioned information did not have the concrete purpose of evaluating the best therapy for the patient, offering him the requested service, possibly also with a strengthening of the protections against the risk of contagion (the adoption of which, it is recalled, is , in any case, with reference to those of a general nature, mandatory for all operators, in public and private health and assistance structures; to these are added the specific precautions for dental operators, "considering that, at the current state of knowledge scientific studies, it is not possible to identify with certainty all patients with HIV infection "- see premises and articles 1 and 4 of the aforementioned Ministerial Decree of 28 September 1990), but rather to remove the patient by refusing the treatments requested by him.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by Dr. Marini, in violation of art. 5 of the Regulations, within the terms set out in the motivation.

5. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (articles 58, par. 2, lett. I and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The violation of art. 5 of the Regulation, determined by the processing of personal data, subject of this provision, carried out by dr. Marini, is subject to the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, lett. a) of the Regulations.

Consider that the Guarantor, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations, as well as art. 166 of the Code, has the power to "inflict a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or instead of such measures, depending on the circumstances of each single case "and, in this context," the College [of the Guarantor] adopts the injunction order, with which it also disposes with regard to the application of the ancillary administrative sanction of its publication, in whole or in excerpt, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code "(Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).

The aforementioned administrative fine imposed, depending on the circumstances of each individual case, must be determined in the amount taking into account the principles of effectiveness, proportionality and dissuasiveness, indicated in art. 83, par. 1, of the Regulation, in light of the elements provided for in art. 83, par. 2, of the Regulation in relation to which, in particular, it is noted that:

- the data processing carried out concerned information on the state of health, in particular, relating to HIV infection, for which the legislator has provided for enhanced protection of the interested party and potentially all of Dr. Marini (Article 83, paragraph 2, letter a), e) and g) of the Regulations);

- the interested party has suffered prejudicial consequences due to the effect of the doctor's conduct, as he has not received the required health service (Article 83, paragraph 2, letter k) of the Regulations);

- despite having the doctor collaborated promptly with the Authority during the investigation, the violation is not culpable (Article 83, paragraph 2, letters b) and f) of the Regulations).

Due to the aforementioned elements, assessed as a whole, it is believed to determine the amount of the pecuniary sanction provided for by art. 83, par. 5, lett. a) of the Regulations, to the extent of € 20,000 (twenty thousand) for the violation of art. 5 of the Regulation as a pecuniary administrative sanction, pursuant to art. 83, par. 1, of the Regulation, effective, proportionate and dissuasive.

It is also believed that the ancillary sanction of the publication on the website of the Guarantor of this provision, provided for by art. 166, paragraph 7, of the Code and art. 16 of the Guarantor Regulation n. 1/2019, in relation to the particular category of personal data processed and the potential number of data subjects.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

WHEREAS, THE GUARANTOR

the violation of art. 5 of the Regulations, declares the unlawfulness of the processing of personal data carried out by Dr. Marini in the terms mentioned in the motivation;

ORDER

to dr. Marini, born in XX the XX, C.F. XX, resident in XX, with professional domicile in Via XX, electively domiciled in Via XX, XX, at XX, pursuant to art. 58, par. 2, lett. i) and 83 of the Regulations, as well as art. 166 of the Code, to pay the sum of € 20,000.00 (twenty thousand) as a pecuniary administrative sanction for the violation referred to in this provision, according to the methods indicated in the annex, within 30 days from the notification of motivation; it is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;

INJUNCES

to the aforementioned Dr. Marini, in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of € 20,000.00 (twenty thousand), according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. . 27 of the law n. 689/1981.

HAS

- the publication of this provision on the website of the Guarantor, pursuant to art. 166, paragraph 7, of the Code;

- the annotation of this provision in the internal register of the Authority - provided for by art. 57, par. 1, lett. u), of the Regulations, as well as by art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor - relating to violations and measures adopted in accordance with art. 58, par. 2, of the same Regulation.

Pursuant to art. 78 of the Regulation, of art. 152 of the Code and 10 of Legislative Decree no. 150/2011, against this provision, it is possible to appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.

Rome, June 10, 2021

PRESIDENT
Stanzione

THE RAPPORTEUR
Peel

THE SECRETARY GENERAL
Mattei