It is a time of major changes in the private health sector. Foreign investment funds are purchasing healthcare facilities in Italy, and within the territory various mergers and acquisitions are under way as well. What happens in these cases with regard to patient data? At the time of transfer of a healthcare facility, the patient data whose originator was the initial data controller, pass on to the acquirer (which then becomes the controller).
From the point of view of the data protection legislation, the question arises whether the acquirer is obliged to implement the following steps:
send new informative material and obtain new consent (this being sensitive data) As a preliminary remark, it should be noted that the Italian legal system does not contain any specific rules regarding the processing of data in the case of acquisitions or transfers of companies or branches of business.
It is therefore necessary to make a legal reasoning starting from the general principles and analysing the measures taken on the subject by the Data Protection Authority and the recent relevant case-law.
(a) with regard to the obligation of the acquirer to provide an informative note
Regarding the obligation of the buyer (new data controller) to send a new statement in which the transfer of ownership is communicated to the interested parties (patients), the content of the provision of the Data Protection Authority n. 664 of December 17, 2015 shall be considered.
In this provision, regarding the transfer of a business line between two companies, the Authority has thus stated:
On the occurrence of the divestiture of a business branch, Art. 2558 (succession in contracts), Art. 2559 (receivables for the transferred company), Art. 2560 (debts relating to the transferred company) and Art. 2112 (protection of workers' rights in the case of transfer of company) of the Civil Code shall apply. Due to this peculiar discipline, a legal succession of the new business owner is established in all legal relationships and in all the active and passive positions held by the transferor (except in relation to contracts, relationships of a personal nature).
Hence, since the acquirer takes over the position of the transferor by law, the processing of personal data of employees, suppliers, retailers and customers [...] associated with the management of the transferred business branch, does not require any further consent, since the equivalent basis referred to in art. 24, paragraph...