Covid Campania, Guarantor sends formal warning to Region: privacy violet vaccine card

The Guarantor for the protection of personal data has adopted a provision with which it formally “warned” the Campania Region that the certification system of vaccination, recovery or negativity – promoted by the Region as a necessary condition for the use of countless services such as those tourism, hotels, weddings, transport and shows – violates the privacy legislation. The system is provided for by an order of the President of Campania which delegates to the Regional Crisis Unit the definition of the operating procedures and the distribution of smart cards on which the regional Covid passes will be registered. On the basis of the investigation launched by the Guarantor, it emerged that the initiative lacks a suitable legal basis. Provisions of this nature, which condition personal rights and freedoms, are admissible, in fact, only if provided for by a suitable national legislation and not by a regional ordinance. This ordinance, moreover, goes beyond the same indications of the so-called ‘Reopening Decree’ – which already presented specific critical issues already reported by the Authority to the Government – introducing the display of the green pass as a further condition for mobility and access to basic services. The ordinance also introduces the use of smart cards as a “system for issuing certification of vaccination” without specifying the ownership of the treatment, who can access and use the information, who can check the validity and authenticity of the certifications . The project thus infringes the basic principles of the EU Regulation on the protection of personal data such as those of lawfulness, correctness, transparency, privacy by design and by default. The system adopted by the Region would have required, in any case, that a preventive impact assessment be carried out aimed at implementing adequate measures to guarantee the protection of data, even particularly sensitive ones such as those on people’s health. The Authority points out that projects such as the Campania one introduce systems for the release and verification of vaccination different from those identified at national level and, above all, that jeopardize the very interoperability of certifications at national and European level, in contrast with the very purpose to facilitate free movement within the European Union during the Covid-19 pandemic. The formal “warning” adopted against the Campania Region was also communicated to the President of the Council of Ministers and to the Conference of Regions and Autonomous Provinces, for the relevant assessments.