The Privacy Guarantor has given a favorable opinion on the implementation decree scheme that activates the national platform-DGC for the issue of the green pass, providing adequate guarantees for the use of green certifications.
With regard to the apps to recover the green pass, the Guarantor authorized the use of the Immuni App, but postponed the use of the IO App due to the critical issues encountered.
The Guarantor for the protection of personal data, as a result of long and fruitful discussions with the Ministry of Health - explains a note from the Authority - gave a favorable opinion on the implementation decree scheme, which activates the National Platform-DGC for the issue of the green pass, providing adequate guarantees for the use of green certifications.
The green pass, introduced by the "Reopening" decree to allow travel between Regions and access to public and sporting events, is now foreseen, in the yellow areas, also to participate in parties on the occasion of civil and religious ceremonies. The Authority, which has already warned the government about the critical issues of the current version of the "Reopening" decree, recalls the need to clearly identify, when converting the decree into law, the cases in which the interested party may be asked to exhibit the green certification to access places or premises. Precisely the current indeterminacy of the circumstances in which the display of the green pass is required has favored the adoption, by some Regions and Autonomous Provinces, of ordinances that have imposed itsuse also for purposes other than those provided for in the reopening decree and in respect of which the Guarantor has already intervened. The Authority also underlines that the European regulation on the green pass, currently being adopted, also provides that the same can be used by the Member States for other purposes, with respect to travel within the EU, but only if this it is expressly provided for and regulated by a national standard. The Authority - while positively evaluating, on the whole, the Dpcm scheme, which incorporates most of the indications provided by the Guarantor in the course of discussions with the Ministry of Health - notes some profiles on which it considers necessary an intervention. In particular,the Guarantor asks for clarity on the purposes for which the green pass may be requested, which must be established with a rule of primary rank. Furthermore, the standard must provide that the certifications can be issued and issued only through the National Platform-DGC and verified exclusively through the Verification C19 App. In fact, this app is the only tool able to guarantee the validity of the validity of the green certification, in compliance with the principles of protection of personal data, also ensuring that the verifiers can only know the personal details of the interested party, without viewing the other information present. in certification (recovery, vaccination, negative result of the swab). Another measure,requested and obtained by the Guarantor during the discussions with the Ministry of Health, is that the subjects appointed to check the green certifications are clearly identified and instructed.
As for the ways in which to obtain the green pass, the decree scheme provides for it to be made available through various digital tools (website of the National Platform-DGC; Electronic Health Record; App Immuni; App IO) that will allow interested parties to consult , view and download certifications. Furthermore, interested parties can also contact the family doctor and pharmacist to download the green certification. With regard to the apps to recover the green pass, the Guarantor has authorized the use of the Immuni App, but has postponed the use of the IO App due to the critical issues encountered in this regard. In the same meeting of the Board, with a separate provision, the Authority, in relation to critical issues of a general nature on the functioning of the IO App,has urgently ordered the company PagoPA to temporarily block some data processing carried out through the aforementioned app which involve interaction with Google and Mixpanel services, and which therefore involve a transfer to third countries (eg.
USA, India, Australia) of particularly sensitive data (eg
cashback transactions, payment instruments, holiday bonuses), carried out without users having been adequately informed and given their consent. Profiles on which the Authority had already drawn attention with various provisions of 2020, also providing indications to make the use of the app compliant with the privacy legislation. (HANDLE).