Privacy Policy
INFORMATION ON THE PROCESSING OF PERSONAL DATA
pursuant to and for the purposes of art. 13 and 14 of Regulation (EU) 2016/679
Premise
With DGRV n. 2024 of 6 December 2017, the Veneto Cancer Registry has been transferred to Azienda Zero which therefore, as “Data Controller”, provides the following information regarding the use of personal data, to explain the purposes for which such data is processed and how the data subject can exercise his or her rights.
Legal basis and purpose of processing personal data
The legal references for data processing by the Veneto Cancer Registry are:
Regional finance law for the financial year 2010 n. 11 of 16 February 2010, which formally established the Veneto Cancer Registry;
Regional Regulation 3/2013 of 12 August 2013, “Rules for the operation of the Veneto Cancer Registry”, approved by the Garante for the protection of personal data;
Regional Board Resolution n. 2524/DGR of 23/12/2014 “Approval guidelines and instructions for the approval of the privacy regulation of the Register of Cancers of Veneto – Regional Regulation n. 3/2013”.
General (EU) Regulation for the protection of personal data n. 2016/679 (General Data Protection Regulation or GDPR): article 6 paragraph 1 letter e) (Performance of a task of public interest), article 9 paragraph 2 letter h) (Treatment for the management of health systems and services), and letter j) (Treatment necessary for archiving in the public interest, scientific or historical research or for statistical purposes), article 2-sexies, paragraph 2, letter. u) and v) (Processing of particular categories of personal data necessary for reasons of relevant public interest) and article 110, paragraph 1 (Medical, biomedical and epidemiological research).
The purposes of data processing by the Veneto Cancer Registry are:
To produce cancer incidence, mortality, survival and prevalence data;
Describe the risk of disease by location and type of cancer, age, gender and any other variable relevant to citizen information and scientific research;
Carry out epidemiological studies on cancer risk factors, the results of early diagnosis interventions, therapies and diagnostic-therapeutic pathways;
Carry out statistical and epidemiological analyses of the data referred to in the preceding paragraphs.
Categories of data processed and conferment
The Veneto Cancer Registry collects and processes the following categories of data:
Personal details: name, surname, tax code, health card code, sex, date of birth, address;
data of a particular nature ex art. 9 of the GDPR: a) anamnestic information; b) admissions and diagnostic-therapeutic services and related documentation for admission and discharge; c) primary and secondary cancer prevention interventions (including oncology screening); d) surgical interventions and diagnostic and therapeutic procedures; e) clinical-instrumental investigations and medical treatments; f) diagnosis of neoplastic pathology (primary and secondary), with indication of the site, morphology, and the predictive-prognostic parameters of the neoplasia; g) Diagnostic techniques adopted; h) Ticket exemptions; i) Date and cause of death, morbidity relevant to the death, post-mortem health examinations.
Origin of the data collected
The Veneto Cancer Registry collects data from:
Veneto Region – Ministerial flows (hospital discharge cards, outpatient services, pharmaceuticals);
Veneto Region – Regional archives and/or flows (patient registry, reports of pathological anatomy, ticket exemptions, death cards, performance of oncology screening programs);
Health Companies: ULSS companies, Hospital Companies, private accredited healthcare facilities and Institutes of Scientific Hospitalization and Care (IRCCS) (medical records, radiodiagnostic services, outpatient reports).
Communication and dissemination of data
The Veneto Cancer Registry makes available on its website indicators of incidence, prevalence and survival. These data, as well as the results of specific processing, are published in an aggregated form to ensure that the right to confidentiality of registered parties is respected.
The processing of data is carried out in compliance with the ethical principles of proportionality, necessity, relevance and non-excess.
Specific technical, organisational and confidentiality measures are implemented to ensure an adequate level of security, in accordance with the provisions of art. 32 of the GDPR, in order to prevent loss, destruction, alteration, unlawful or unauthorized uses of the processed data.
For the purposes described above, the Veneto Cancer Registry transmits information in a pseudo-anonymized form (personal and health data) to the following recipients:
-
International Agency for Research on Cancer (IARC) of the World Health Organization:
Personal data: sex, date of birth, state of life;
data on health events with oncology relevance: date of incidence, diagnosis of incidence, common residence at the date of incidence, diagnostic basis, variables related to cancer staging and biological characterisation, Diagnostic and treatment performance. -
AIRTUM (Italian Association of Cancer Registries):
Personal data: sex, date of birth, state of life;
Data on health events with oncology relevance: date of incidence, diagnosis of incidence, common residence at the date of incidence, diagnostic basis. -
Health institution (Health Company) belonging to the patient:Personal data: name, surname, tax code, health card code, sex, date of birth, address of residence, state of life;
Data on health events with oncology relevance: date of incidence, diagnosis of incidence, common residence at the date of incidence, diagnostic basis. -
Research centres within the EU:Personal data: sex, date of birth, state of life;
data on health events with oncology relevance: date of incidence, diagnosis of incidence, common residence at the date of incidence, diagnostic basis, variables related to cancer staging and biological characterisation, Diagnostic and treatment performance.The communication of data to the indicated subjects is carried out by means of computer.
The data processed may be communicated to subjects, entities or authorities to which the communication of data is mandatory by law.
Transfer of data to non-EU countries
The personal data listed above are processed within the European Union and stored on servers located in the territory of the Veneto Region. In addition, within the framework of international collaborations CONCORD and VENUSCANCER, personal data are also transmitted to the United Kingdom pursuant to the Commission Implementing Decision of 28.6.2021 pursuant to article 45 of the Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom.
Retention period of the collected data
The data stored in the computer system of the Veneto Cancer Registry is irrevocably anonymized, after a period of 30 years from the death of the subject to which the data refer.
Automation and profiling
The registration of neoplastic pathology (tumours) is partly done through automated decision-making processes, which use the following logic. A computer program compares data from admissions, pathology reports and deaths: cases with congruent and sufficient data (according to international rules – for example, a patient admitted for prostate cancer, with biopsy diagnosed with prostate cancer and deceased for prostate cancer) are automatically recorded. In other cases, registration shall be made after consultation of clinical records by recording technicians.
The processing of data does not involve profiling of the data subjects.
For the exercise of the above rights, the user will send a written request to the Data Controller, using the contact details below. For further information regarding the processing of personal data carried out by the Veneto Cancer Registry, the interested party may contact the Data Protection Officer using the contact details below.