Tag Archives: italy

Facial Recognition Technology: Are We Close to a Turning Point?

When people think about facial recognition technology (“FRT”), they immediately imagine the use of their faces to unlock their smartphones. But this technology is far more complicated, useful and potentially dangerous.

First, it is important to understand the difference among “facial detection”, “facial characterization”, “facial identification” and “facial verification”. Such terms have been defined by the non-profit organization Future of Privacy Forum (https://fpf.org/wp-content/uploads/2019/03/Final-Privacy-Principles-Edits-1.pdf) as follows:

  • Facial detection simply distinguishes the presence of a human face and/or facial characteristics without creating or deriving a facial template.
  • In facial characterization the system uses an automated or semi-automated process to discern a data subject’s general demographic information or emotional state, without creating a unique identifier tracked over time.
  • Facial Identification is also known as “one-to-many” matching because it searches a database for a reference matching a submitted facial template and returns a corresponding identity.
  • The last one, facial verification, is called “one-to-one” verification because it confirms an individual’s claimed identity by comparing the template generated from a submitted facial image with a specific known template generated from a previously enrolled facial image.

There are many possible uses of facial recognition. In the private sector FRT may be used to keep track of employees’ time and attendance, identify shoppers’ patterns inside stores, implement smart homes, etc. In the public sector, FRT may be used to monitor protests, identify suspects in security footage, check claimed identities at borders, etc.

This relatively new technology brings, besides a wide range of possible implementations, significant concerns regarding privacy, accuracy, race and gender disparities, data storage and security, misuse. For instance, depending on the quality of images compared, people may be falsely identified. In addition to that, in its current state, FRT is less accurate when identifying women compared to men, young people compared to older people, people of color compared to white people. Privacy is certainly another concern: without strong policies it is unclear how long these images might be stored, who might gain access to them or what they can be used for; not to mention that this technology makes far easier for government entities to surveil citizens and potentially intrude into their lives (see “Early Thought & Recommendations Regarding Face Recognition Technology”, First report of the AXON AI and policing technology Ethics Board https://www.policingproject.org/axon-fr).

Once the possible implementations and the related risks are understood, the worldwide lack of regulation becomes even more surprising.

Within the European Union, the General Data Protection Regulation obviously applies to FRT. Furthermore, “Guidelines on Facial Recognition” have been released on January 28, 2021 by the Consultative Committee of the Council of Europe with regard to automatic processing of personal data (https://rm.coe.int/guidelines-on-facial-recognition/1680a134f3). This latter document includes:

  • Guidelines for legislators and decision-makers;
  • Guidelines for developers, manufacturers and service providers;
  • Guidelines for entities using FRT;
  • Rights of data subject.

When it comes to Italy, particular attention has been drawn by several decisions of the Italian Data Protection Authority on the topic. Recognizing the innovative potential of FRT as well as its riskiness for individual rights, the Authority adopted a more permissive approach regarding the private sector’s use of FRT, while issuing stricter decisions with regard to the use of FRT by public authorities. For instance, the Authority allowed the use of FRT by police forces for purposes of identifying individuals among archived images, but prohibited real-time surveillance using the same technology (see https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9040256 and https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9575877). On the other hand, the Authority allowed one airport to implement FRT for purposes of improving efficiency in the management of the flow of passengers, so long as images of individuals were not stored (see https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/8789277).

The European Commission, in light of the complexity of the situation and the necessity of a strong and harmonised legislative action, presented on April 21, 2021 its “Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence” (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021PC0206). This Proposal was already the subject, on June 18, 2021, of a EDPB and EDPSs’ joint-opinion (https://edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-52021-proposal_en), in which they called for a general ban on the use of FRT for:

  • Automated recognition of human features in publicly accessible spaces;
  • Categorization of individuals into clusters according to ethnicity, gender, etc., based on biometric features;
  • Inference of individuals’ emotions.

What the European Commission is doing is an example of a more globally widespread legislators’ attitude towards artificial intelligence in general and FRT in particular. These technologies are more and more in our lives and are constantly evolving. Consequently, there is an increasing request, both from public and private subjects, for clear rules to govern this new technology and ensure that individual rights are safeguarded. Hopefully in the next months/years the situation will become clearer.

Flavio Monfrini / Michele Galluccio

Repeal of Patent Linkage in Italy is on the Horizon

The patent linkage is the practice of linking the marketing authorisation of medicinal products, their pricing or reimbursement, or any other generic drug approval, to the patent status of the original reference product.

On 4 November 2021 the Italian Council of Ministers approved the draft law for the market and competition for the year 2021 (the “Draft Law”), by means of which by the end of this year the Italian Government intends to modify, update and renovate the regulatory framework of several critical sectors of the economic life of the country, amongst which energy, transportation, entrepreneurship and healthcare.

With the aim of removing barriers to market entry for generic medicines, the Draft Law inter alia provides for the abolition of the patent linkage, finally bringing Italy, on this point, in line with the EU law and the other European countries.

Indeed, the Draft Law repeals article 11, paragraph 1, of Law no. 189/2012 (the “Balduzzi Decree”), pursuant to which generic drugs cannot be included in the list of the medicines reimbursed by the Italian National Health Service before the expiry date of the patent or of the supplementary protection certificate of the corresponding originator’s product.

Because it establishes a patent linkage, said provision of the Balduzzi Decree is generally held in breach of the EU law, according to which regulatory bodies, when granting a marketing authorisation for a medicine, setting its price, and determining its class of reimbursement, cannot consider the patent coverage, but only the quality, safety, and efficacy of medicines.

In the last decade the Italian association of generic drug manufacturers (Assogenerici), several patient advocacy groups and even the Italian Competition Authority had tried to push the Italian Government to repeal article 11, paragraph 1, of the Balduzzi Decree, but without success. Now, probably also under the EU Commission’s pressures to comply with the requirements it set in the framework of the aids given to Italy to face the economic and social consequences of the Covid-19 pandemic, the Italian Government decided to finally remove the patent linkage.

The purpose of the measure provided by the Draft Law is to allow manufacturers of generic medicines to carry out all the negotiation procedures for price and reimbursement to be ready to enter the market as soon as the patent expires, and so to increase the competition in the healthcare sector.

The Draft Law will be soon submitted to the Italian Parliament, where it will be discussed and where it might be subject to several and significant amendments. We will see whether the abolition of the patent linkage will be eventually approved and will therefore become law.

Web Cookies’ Processing: New Guidelines by the Italian DPA

On June 10, 2021 the Italian DPA has officially issued new guidelines for the processing of cookies and other online tracking instruments. Such newly-issued guidelines are aimed at compliance with principles set forth by the GDPR, as well as by the recently issued contributions of the European Data Protection Board. The new guidelines complement and update the previous ones issued in 2014.

New provisions mainly regard how consent is acquired and information to be provided to interested subject. In fact:

  • consent by the user must be given in accordance with principles of freedom and unambiguousness. Accordingly, the use of methods that do not comply with such principles, such as the “scrolling-down” and the “cookie-wall”, are unlawful and void;
  • the “cookie banner” must comply with the “privacy by design” and “privacy by default” principles, as resulting from article 25 of the GDPR. Consequently, simplified manners for the obtainment of the consent are allowed only to the extent that they comply with some pre-determined requirements;
  • “analytic cookies” can be processed without any consent by users only if they do not allow any identification (direct identification of the person concerned should not be achieved), and if they are used for the production of aggregate data only. Otherwise, they need to be expressly authorized;
  • information to be provided to the users must be specific and comply with articles 12 and 13 of the GDPR.

Data controllers now have a 6-months term (expiring on December 2021) for the adoption of the measures necessary to comply with such giudelines.

The full text of the measure can be found at the following link: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9677876.

Personal Data of Deceased People: Clear Indications by the Italian Data Protection Authority

Access to personal data concerning deceased people may represent an issue and a necessity, especially for their heirs. How is such kind of access to personal data currently regulated under the Italian Law (Legislative Decree n. 196/2003), as amended after GDPR?

The Italian Data Protection Authority, in its efforts to combine data protection legislation and clarity, recently issued an outline of article 2-terdecies of the Legislative Decree n. 196/2003.

  • Who is entitled to such right to access? Whoever (i) has a vested interest; (ii) acts in the interest of the deceased person (who is the “interested party” pursuant to data protection laws); (iii) acts as mandatary; or (iv) acts for worthwhile reasons of family protection.
  • To whom should the request to access data be addressed? The request should be addressed to the relevant Data Controller (i.e., the natural or legal person, public authority, agency or other body, either private or public, which determines the purposes and means of the processing of personal data), also through the Data Processor (i.e., the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller), where appointed.
  • Which information may be requested? (i) Access to personal data of the deceased person; (ii) the purpose of processing data; (iii) which data have been communicated and the related addressees; (iv) the retention period; (v) the origin of such data and (vi) whether data are subject to an automatic decisional processing (Sections 15-22 of GDPR).
  • Do you have to pay to access data? No, it is free (unless the request is manifestly unfounded or excessive).
  • Are there any exceptions or limits? Yes, it is not possible to access data in the event it is forbidden (i) by the law or (ii) by the interested party, who released an express and unequivocal declaration addressed to the Data Controller. However, even in the latter hypothesis, third parties exercising their patrimonial rights originating from the death of the interested party cannot be prejudiced in their rights.
  • Do you have to motivate your request? No.
  • How long does it take to get a feedback on your request? Maximum one monthsince your request, except in some particular cases, as provided by GDPR.
  • What can you do if your request is refused or in lack of any feedback? You may address the Italian Data Protection Authority or the relevant court.

Access to data concerning deceased people seems to be quite easy in theory. However, balancing patrimonial rights of heirs and assessing “express and unequivocal” declarations of the deceased may prove to be more complex in practice.

Five Key Takeaways from Our Seminar on Clinical Trials

If you missed our seminar on clinical trials on January 16, here are five key takeaways to help you understand the changing regulatory environment in Europe and Italy.

  1. Be ready for a new regulatory landscape

The recent clinical trials regulatory overhaul within the EU aims at fostering research and facilitating the tasks of all actors involved in this area. However, delays in the implementation of such new legislation are posing an actual risk for the entire sector throughout the EU, while competition from emerging economies is getting stronger.

  1. Harmonized, but not enough

In several areas, such as observational studies or ethical committee’s assessments, a unified approach at European level is yet to be adopted. This leaves a lot of fragmentation among the various countries and a lot of work to be done at local level in order to ensure compliance with applicable regulations. Be prepared to deal with such inconveniences, in particular in the pharmaceutical sector.

  1. Changes in data protection laws offer new opportunities but challenges remain

GDPR brought new harmonized provisions to improve and support the use of data for the purpose of conducting research. However, guidance from national data protection and regulatory authorities in areas such as legal grounds for processing and secondary use is far from established. Moreover, different EU countries continue to adopt opposite approaches when it comes to consent and legitimate interest as valid legal grounds for data processing in the framework of clinical research. Data protection compliance will therefore continue to require local check-ups.

  1. New opportunities for independent research

Recent regulatory changes in Italy are being implemented to foster independent not-for-profit research in the clinical area. The new regulations, which are about to be adopted, envisage new opportunities for the participation of private actors in independent research and allow not-for-profit research institutions to better exploit the results of their research. The potential for conflicts remain and caution should be exercised within public-private relationships, but there is hope that new paradigms of collaboration will see the light.

  1. A new world of evidence is out there

More and more projects in the clinical research field involve real world data and real world evidence, gathered in a number of different ways outside the rigid protocols of a controlled study, whether through medical devices or other data collection instruments. Real world data are key to understanding how treatments work in reality and developing new healthcare paths. However, both clinicians and private actors are operating in uncharted territories and the line between studies and alternative research projects is thinner than you may expect. Be mindful of the regulatory and compliance ramifications of these new powerful tools.

Update: Italian Senate Steps Back on Light Cannabis

Optimism after last week’s news did not last very long.  The Italian Senate just approved its version of the Italian Budget Law for 2020 (still subject to the Italian House of Representatives’ vote) striking out the amendment clarifying that products with THC contents under 0.5% should not be considered as having a doping or psychotropic effect.

This quick turnaround was likely due to the highly political nature of the debate surrounding the whole industry, which may have influenced the Senate’s final decision on light cannabis business and, on a very different field, may as well still impact on the slow progress of the increase of the Italian production of therapeutic cannabis.

 

New Bill May Bring More Clarity for “Light Cannabis” Business

Italy has an uncertain scenario set forth for light cannabis (i.e. with THC levels below 0.2%) shops and businesses, after a recent decision of the Italian Supreme Court, last July.

The decision took a rather strict approach, specifying that, under current legislation (and especially, under Law 242/2016), only certain specific types of products may be considered legal, i.e.:

– food and cosmetics;

– certain semi-finished products, such as fiber (“fibra”), shives (“canapulo”), powders (“polveri”), wood chips (“cippato”), oils (“olii”) or fuels (“carburanti”), for supplies to businesses and artisanal businesses of different fields, including energy;

– material intended for the practice of green manure (“sovescio”);

– organic material intended for bioengineering works or products for bio-building;

– material intended for the phytoremediation to reclaim polluted sites;

– cultivations dedicated to educational and demonstration activities, as well as research carried out by public or private institutions;

– crops used for nursery gardening (“florovivaismo”).

Whatever falls outside the items listed above, even if the content of THC is below 0.2%, may be treated as an illegal drug with all relevant implications, especially under Italian criminal law – unless such products are proven to have no doping or psychotropic effect whatsoever.

It is not difficult to imagine the negative impact of such approach on business operators in Italy, which caused many of them to close, interrupt or suspend their activity, right after having experienced a quite impressive boom, leading to an estimated yearly turnover in 2018 of euro 150 million.

Just yesterday, nevertheless, the Budget Commission of the Italian Senate approved an amendment of the draft Budget Law for 2020 that, according to Senator Matteo Mantero, would clarify in express terms that products with a THC content under 0.5% cannot be considered as having a doping or psychotropic effect and, therefore, should be considered as legal. Of course, this measure will be linked to a specific taxation of all cannabinoid products (0.4 euro per gram of finished product), which is expected to bring benefits to Italy’s budget for 2020.

The specific amendment and the entire draft of the Budget Law for 2020 is still undergoing its approval process. We will keep an eye on it. Stay tuned for updates.

WHO Pushes towards Transparency of Prices of Health Products

Yesterday the World Health Organization announced a resolution encouraging Member States to “enhance public sharing of information on actual prices paid by governments and other buyers for health products, and greater transparency on pharmaceutical patents, clinical trial results and other determinants of pricing along the value chain from laboratory to patient.” The resolution also urged Member States to “work collaboratively to improve the reporting of information by suppliers on registered health products, such as reports on sales revenues, prices, units sold, marketing costs, and subsidies and incentives”.

The Italian Ministry of Health reported the adoption of this resolution with triumphant tones since the resolution was proposed by Italy and co-sponsored by Algeria, Andorra, Botswana, Brazil, Egypt, Eswatini, Greece, India, Indonesia, Kenya, Luxembourg, Malesia, Malta, Portugal, Russian Federation, Serbia, Slovenia, South Africa, Spain, Sri Lanka, Uganda and Uruguay.

Many hope that transparency of prices of health products will result in greater fairness in health systems and will ultimately drive prices down. On the other hand, representatives of the industry claim that the focus on price will not shed light on the complexities of costs linked to research and manufacturing of health products. Instead, Gaelle Krikorian of Medecins Sans Frontieres believes that the resolution marks only a first step and that more disclosure is necessary.

Therapeutic cannabis in Italy: business opportunities

Italy’s only authorized medical cannabis facility is currently controlled by the military. However, the production site, located in the Florence area, cannot keep up with the increasing demand, creating shortages for patients and barriers to its prescription by physicians (whose patients are unlikely to be able to obtain the quantities needed).

As Colonel Modica of the Italian Military recognizedThe health ministry and the defense ministry are trying to fix the shortfall because there’s been a huge increase in cannabis prescriptions and the number of patients who need them”.

Meanwhile, pressed by the patients’ associations, the Italian Health Care Ministry Giulia Grillo announced not only the increase of import of therapeutic cannabis products from the Netherlands (to cover the short-term shortages), but also the start of a longer-term project, eventually leading to the creation of a public-private partnership for the production of cannabis. “An invitation to present expressions of interest will be published in order to increase the production of therapeutic cannabis“, Ministry said. Although underlining that an appropriate time frame will be needed in order to implement the project, the Ministry confirmed that the cannabis production activity is “of great interest for both the Defense and the Public Health Care” and crucial in order to satisfy the increasing needs of both domestic and foreign markets.

The increase in the domestic production of therapeutic cannabis, along with the overall demand for it, appears to be inevitable.

On the other hand, the boom of “light cannabis” products in Italy (i.e., containing THC in a percentage lower than 0.2 and, therefore, expressly declared legal in Italy starting from January 2017) seems to have encountered some obstacles lately.

The Advisory Board of the Italian Health Care Ministry (Consiglio Superiore di Sanità) issued a report last spring, recommending the adoption of measures aimed at prohibiting the sale of light cannabis products.

In addition to that, an internal note of the Ministry of Home Affairs, recently made public, promoted a zero-tolerance approach and a strict application of the relevant laws and regulations. Such steps have caused great uncertainty and concerns amongst those who have invested in what came to the media’s attention in 2017 as a State-backed business.

Hence, the latest developments relating to therapeutic cannabis in Italy indicate that new business opportunities for both exporters and producers of cannabis-based prescriptions are likely to be offered in the Italian market. Conversely, serious questions can be raised in connection to the light-cannabis boom, in view of the inconsistent approach recently taken by Italian authorities.

Tax Crimes Will Trigger Criminal Liability of Corporate Entities

As a result of the so called “PIF Directive”, starting from July 2019 criminal corporate liability under Italian law 231 may be triggered by tax crimes, too.

(If you are not overly familiar with the principles of Italian 231 legislation on criminal liability of corporate entities, perhaps you may start here.)

Under Italian 231 law, corporations are subject to criminal (rather, quasi-criminal) liability when certain specific crimes are committed in their interest or to their advantage. So far, such crimes have never included tax crimes, although the issue had been widely debated and several court decisions had attempted to combine other types of crimes with tax crimes (the Supreme Court had always disagreed, though).

Now, the PIF Directive, which Member States must implement by July 6, 2019, “establishes minimum rules concerning the definition of criminal offences and sanctions with regard to combatting fraud and other illegal activities affecting the Union’s financial interests, with a view to strengthening protection against criminal offences which affect those financial interests.” Liability of legal entities must be foreseen by national legislation and serious offenses against the common VAT system must be punished.

The Italian legislator will thus need to introduce such serious VAT crimes (i.e., having a value in excess of 10 million euros) in the list of crimes triggering corporate liability. This, in fact, may open the door to other tax crimes as a basis of 231 liability of corporate entities.