1. The Italian Data Protection Law is nowadays the Legislative Decree 196/2003 of 30 June 2003, GU no 174 of 29 july 2003 that came into force on 1 January 2004. This legislative decree is also called the “Personal Data Protection Code”. The provisions of this Code of conduct and professional practice are aimed at reconciling the individual’s fundamental rights and freedoms, in particular the right to personal data protection and the right to privacy.
2. The Personal Data Protection Code stipulates that health professionals and public health care bodies may process personal data concerning health:

   a) with the data subject’s consent, also without being authorized by the Garante, if the processing concerns data and operations that are indispensable to safeguard the data subject’s bodily integrity and health;
   b) without the data subject’s consent, based on the Garante’s prior authorization, if the purposes referred to under a) concern either a third party or the community as a whole.

3. The consent of the data subject may be given in accordance with the simplified arrangements referred to in the Personal Data Protection Code.
4. The health professionals shall take suitable measures to ensure that the data subjects’ rights, fundamental freedoms and dignity, as well as the professional secrecy requirements are respected in organizing the relevant services and discharging the relevant tasks, without prejudice to the provisions made in laws and regulations concerning arrangements to process sensitive data and minimum security measures.
5. A data subject shall have the right to obtain confirmation as to whether or not personal data concerning him exist, regardless of their being already recorded, and communication of such data in intelligible form.
6. Any request to access or obtain a copy of the clinical records and the attached patient discharge form as lodged by entities other than the data subject may only be granted, in whole or in part, if it’s justified because of the proven need:

   a) to establish or defend a legal claim in pursuance of Section 26(4), letter c), such  claim being equal in rank to the data subject’s right or else consisting in a personal right or another fundamental, inviolable right or freedom;
   b) to establish a legally relevant claim in pursuance of the legislation concerning access to administrative records, such claim being equal in rank to the data subject’s right or else consisting in a personal right or another fundamental, inviolable right or freedom (section 92).

7. Section 7 of the Personal Data Protection Code is entitled “Right to access personal data and other rights”. According to this section a A data subject shall have the right to obtain:

   a) updating, rectification or, where interested therein, integration of the data;
   b) erasure, anonymization or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;”

Top