Italian Data Protection Authority Imposes Fine for Excessive Data Retention in Cancer Screening Algorithm Project

An administrative fine of €21,000 has been imposed on a research company by the Italian Data Protection Authority due to violations of the General Data Protection Regulation (“GDPR”) in the context of developing an algorithm for cancer screening.

In this context, the main findings and measures indicated in the decision are as follows:

• The data retention period set by the controller was found to be excessive and not aligned with the intended purpose, as the data were only used to train the algorithm and not needed throughout the full product life cycle.
• The algorithm in question was “locked,” meaning it could not be further developed after deployment, rendering extended data retention unnecessary.
• The controller planned to store personal data for up to 25 years without a clearly defined justification or timeline, which was deemed incompatible with the data minimization principle.
• The controller was ordered to revise and clarify its data retention policy and submit the new version to the authority.
• The privacy notices given to data subjects were found to contain vague or unclear information, particularly by presenting the processing purposes (product development and algorithm development) as separate, when in fact they were inseparable.
• The authority held that the description of the specific disease in the privacy notice was not misleading, considering the data subjects were already undergoing treatment for a known diagnosis. However, other elements of the notice were still found to be non-compliant with transparency requirements.

You can access the full text of the decision here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.