Privacy, no illegitimate mass filing on vaccinations against Covid-19

Following numerous discussions on the web regarding the fears of an alleged and illegal mass filing of people who decide to vaccinate or not against Covid-19, which would be introduced with Law Decree no. 34/2020, Federprivacy has deemed it appropriate to provide a clarification via an article on its institutional website signed by Antonio Ciccia Messina, a legal expert in the protection of personal data.

Assuming that “the tones are also stirred up by the fact that some fear censuses, labeling and discrimination against those who choose not to get vaccinated”, in his note published on the website of the main Italian association of privacy professionals, Avv. Ciccia Messina explains that according to current legislation “the consent of the interested party is not required to feed the electronic health record. Consequently, a consent cannot be revoked, which a priori is not required for loading the information. “

Without prejudice to the fact that the provisions on privacy are certainly erected in defense of individual freedoms, the relevant issue on the vaccination archive is therefore not on an unjust mass filing, but in the technical and organizational measures, in compliance with minimization and purposes, in the transparency, careful control by the authorities, and in compliance with all the other provisions of the GDPR.

Moreover – underlines Ciccia Messina – the novelties of the Electronic Health Record have already “been commented on by the then president of the Guarantor for the protection of personal data Antonello Soro during the hearing of 25 May 2020 before the Parliamentary Commission for simplification”, and the elimination of consent in this case “contributes to considerably simplifying the process of setting up the ESF thus making it automatically available regardless of individual manifestations of will”. Furthermore, the processing of information relating to the health of the person by a doctor for the purpose of diagnosis and treatment is already in itself a legal basis sufficient in itself for the processing of such data in accordance with EU Regulation 2016/679.