Purpose definition as a crucial step for determining the legal basis under the GDPR: implications for scientific research.

The General Data Protection Regulation (GDPR) of the European Union, which became applicable in 2018, contains a new accountability principle. Under this principle, controllers (ie parties determining the purposes and the means of the processing of personal data) are responsible for ensuring and demonstrating the overall compliance with the GDPR. However, interpretive uncertainties of the GDPR mean that controllers must exercise considerable judgement in designing and implementing an appropriate compliance strategy, making GDPR compliance both complex and resource-intensive. In this article, we provide conceptual clarity around GDPR compliance with respect to one core aspect of the law: the determination and relevance of the purpose of personal data processing. We derive from the GDPR's text concrete requirements for purpose specification, which we subsequently apply to the area of secondary use of personal data for scientific research. We offer guidance for correctly specifying purposes of data processing under different research scenarios. To illustrate the practical necessity of purpose specification for GDPR compliance, we then show how our proposed approach can enable controllers to meet their compliance obligations, using the example of the overarching GDPR principle of lawfulness to highlight the relevance of purpose specification for the identification of a suitable legal basis.

Give more data, awareness and control to individual citizens, and they will help COVID-19 containment.

The rapid dynamics of COVID-19 calls for quick and effective tracking of virus transmission chains and early detection of outbreaks, especially in the "phase 2" of the pandemic, when lockdown and other restriction measures are progressively withdrawn, in order to avoid or minimize contagion resurgence. For this purpose, contact-tracing apps are being proposed for large scale adoption by many countries. A centralized approach, where data sensed by the app are all sent to a nation-wide server, raises concerns about citizens' privacy and needlessly strong digital surveillance, thus alerting us to the need to minimize personal data collection and avoiding location tracking. We advocate the conceptual advantage of a decentralized approach, where both contact and location data are collected exclusively in individual citizens' "personal data stores", to be shared separately and selectively (e.g., with a backend system, but possibly also with other citizens), voluntarily, only when the citizen has tested positive for COVID-19, and with a privacy preserving level of granularity. This approach better protects the personal sphere of citizens and affords multiple benefits: it allows for detailed information gathering for infected people in a privacy-preserving fashion; and, in turn this enables both contact tracing, and, the early detection of outbreak hotspots on more finely-granulated geographic scale. The decentralized approach is also scalable to large populations, in that only the data of positive patients need be handled at a central level. Our recommendation is two-fold. First to extend existing decentralized architectures with a light touch, in order to manage the collection of location data locally on the device, and allow the user to share spatio-temporal aggregates-if and when they want and for specific aims-with health authorities, for instance. Second, we favour a longer-term pursuit of realizing a Personal Data Store vision, giving users the opportunity to contribute to collective good in the measure they want, enhancing self-awareness, and cultivating collective efforts for rebuilding society.

Padova Charter on personal injury and damage under civil-tort law : Medico-legal guidelines on methods of ascertainment and criteria of evaluation.

Compensation for personal damage, defined as any pecuniary or non-pecuniary loss causally related to a personal injury under civil-tort law, is strictly based on the local jurisdiction and therefore varies significantly across the world. This manuscript presents the first "International Guidelines on Medico-Legal Methods of Ascertainment and Criteria of Evaluation of Personal Injury and Damage under Civil-Tort Law". This consensus document, which includes a step-by-step illustrated explanation of flow charts articulated in eight sequential steps and a comprehensive description of the ascertainment methodology and the criteria of evaluation, has been developed by an International Working Group composed of juridical and medico-legal experts and adopted as Guidelines by the International Academy of Legal Medicine (IALM).

An empirical study of healthcare providers and patients' perceptions of electronic health records.

This paper is the result of a legal and policy analysis of a statistical poll focused on the area of Livorno conducted by the LIDER-Lab of the Scuola Superiore Sant'Anna (Pisa, Italy). Information were gathered by submitting questionnaires to both healthcare providers and their patients. The scope was to evaluate the interest engendered by the application of technology on health data processing along with the needs, expectations and concerns of patients and healthcare providers. The paper leads to the main policy proposals of increasing financial investments in e-health (or at least preserve this area from the generalized budget constraints public health is suffering nowadays) and introducing incentives to use computers for general practitioners.