Processing of judicial data yes, but under what conditions? The Privacy Guarantor expresses its opinion on the recent proposal for a regulation for greater protection
Processing of judicial data yes
Have you ever wondered what are the protections envisaged regarding the processing of your so-called data? judicial? It is common to hear, in fact, that information relating to one's own judicial situation is considered an aspect of life that one hardly wants to disclose willingly. In addition to this, the legislation also supports this approach, supported also by the impact that such information has on the life of the interested party, who must therefore be better protected when dealing with these topics.
From this perspective. the recent regulation proposal of the Ministry of Justice is inserted, which has recently passed under the careful scan of the Guarantor for the protection of personal data, which aims to strengthen a regulatory system of protection already present, but which is however characterized by evident gaps.
Judicial data: what are they?
Commonly referred to as judicial data, this information is in technical jargon the data relating to criminal convictions and offenses. They are governed by Article 10 of EU Regulation 679/2016, as well as - internally - by the so-called Privacy Code. Unlike "common" personal data, this category of data is considered more delicate and therefore deserving of enhanced protection.Therefore, to ensure that the processing of this type of data is considered lawful, it is necessary that
the treatment is carried out on the basis of the consent of the interested party, the fulfillment of a contract, for the safeguarding this treatment takes place either under the control of a public authority or is authorized by European law or by a State member.
What does the regulation provide?
The regulation proposed by the Ministry of Justice aims to fill the gaps mentioned above, applying Article 2-octies of the Privacy Code, which provides for it as a hypothesis to authorize the processing of cd data of the data subjects.The crucial points of the proposed regulation are, therefore, the following:
extension of the definition of judicial data contained in the GDPR, which will also include data relating to the application, by means of a judicial measure, of preventive measures; the regulatory sources that legitimize the processing of judicial data are Article 10 of the GDPR, art. 2-octies of the Privacy Code and other residual regulations on the subject, including the regulation itself; intensification of the guarantees for the protection of the processing in question, including those provided for by other regulatory provisions, which must materialize in processing the data using methods and logic that are proportionate and necessary with respect to the purposes of the processing; allow the limitation of processing to the necessary data; guarantee the right to rectify and / or update them, as well as the right to cancel them under certain conditions; in the context of employment relationships, the deadline for storing the aforementioned data is set for two years from the termination of the relationship; again on this aspect,
What does the Guarantor for privacy suggest?
Generally speaking, the Guarantor has expressed his favorable opinion on the draft regulation proposed by the Minister of Justice, suggesting, at the same time, points on which even more attention should be paid. These are, for example, the verification of data sources and their reliability, especially if the judicial data are obtained from sources such as the Internet, of which only institutional sites, professional associations or recognized trade associations are considered safe. In connection with this aspect, the Guarantor also points out that it is of fundamental importance that the information relating to the interested party is always updated based on the actual evolution of the legal position of the subject. Lastly, another focal point of the Guarantor's intervention concerns the lawfulness of consent as a legal basis that legitimizes the processing of judicial data referred to him, with particular regard to the area of employment relationships. In fact, on the subject, the Authority underlines how the consent possibly given by the worker, due to his "natural" position of losing with respect to the employer, cannot be considered totally free, and therefore, cannot be an expression of an autonomous and not coerced will of the subject.Photo credit - depositphotos .com
The changes proposed by the Privacy Guarantor
In concrete terms, then, the Guarantor has expressed the need to make some changes to the proposed regulation, which can be summarized in the following points:more guarantees for all treatments, even those carried out under the control of the public authority; provide that "only the data contained in the criminal record certificate or in other documentation legitimately acquired, necessary and strictly pertinent to the [purposes], are processed"; also allow private subjects to acquire the "selective certificate", only under certain conditions; provide that only judicial data relating to offenses hindering or in any case relevant to "the purposes pursued on the basis of the law or, in the cases provided for by law, regulations" are processed; more concrete use of the reference to the principle of limitation of data retention; introduction of the impact assessment as a prerequisite for the transfer of so-called data judicial in the workplace; strengthening of guarantees relating to "open sources of information". These and others, therefore, are the proposals for modification and integration of the regulation scheme, which, in the light of the same, would be even more protective and stringent in terms of the processing of judicial data.
