Rome, 23 April (beraking latest news Salute) – “The newly approved standard for the creation and management of ‘green certifications’, the so-called vaccination passes, presents such criticalities as to invalidate, if not appropriately modified, the validity and functioning of the system envisaged for the reopening of movements during the pandemic. Urgent action is therefore needed to protect people’s rights and freedoms “. This is the indication of the Guarantor for the protection of personal data contained in a formal warning, adopted pursuant to the EU Regulation, just sent to all the ministries and other parties involved. The provision was also sent to the President of the Council of Ministers, for the relevant assessments.
The Guarantor observes first of all that the so-called “reopening decree” does not guarantee a suitable regulatory basis for the introduction and use of green certificates on a national scale, and is seriously incomplete in terms of data protection, without an assessment of possible risks on a large scale for personal rights and freedoms.
In contrast to the provisions of the European regulation on the protection of personal data, the decree does not precisely define the purposes for the processing of data on the health of Italians, leaving room for multiple and unpredictable future uses, potentially misaligned even with similar initiatives. European. It is not specified who is the data controller, in violation of the principle of transparency, thus making it difficult if not impossible to exercise the rights of the data subjects: for example, in the case of incorrect information contained in the green certifications.
The law, the Guarantor underlines, also provides for an excessive use of data on certificates to be exhibited in the event of control, in violation of the principle of minimization. To ensure, for example, the temporal validity of the certification, it would have been sufficient to provide a form that would only report the expiry date of the green pass, instead of using different models for those who have previously fallen ill with Covid or have undergone vaccination. The currently proposed system, especially in the transitional phase, risks, among other things, to contain inaccurate or outdated data with serious effects on individual freedom of movement. Finally, there are no data retention times or adequate measures to guarantee their integrity and confidentiality.
Finally, the Guarantor points out that the serious criticalities identified could have been resolved in advance and in a very short time if, as required by European and Italian legislation, the subjects involved in the definition of the law decree had initiated the necessary dialogue with the Authority, requesting the expected opinion, without postponing to subsequent further information
In any case, the Authority has offered the Government its collaboration in addressing and overcoming the critical issues identified.