Healthcare authorities may use the telephone contact details of adult patients—provided in connection with previous healthcare services—to encourage participation in screening campaigns mandated under national or regional legislation, even where, at the time the data were collected, the privacy notice did not expressly refer to that specific purpose.

The Italian Data Protection Authority (Garante per la protezione dei dati personali) has clarified that—having regard to the principles of the EU General Data Protection Regulation and relevant EU case law—processing that is strictly necessary to promote public prevention programmes may be regarded as compatible with the original purposes of care, diagnosis and healthcare assistance, provided that appropriate safeguards are implemented.

To strengthen patient protection, the Authority has therefore adopted specific Guidelines. In particular, healthcare authorities must update their privacy notices, specifying that the most recent contact details collected for healthcare purposes—after verification of their accuracy—may be used exclusively to promote public prevention programmes and not for other purposes (such as scientific research or administrative activities).

Use of the data must also be limited to screening campaigns provided for under the applicable legal framework, and must exclude the use of contact details collected in the context of services subject to enhanced anonymity protections, such as voluntary termination of pregnancy, anonymous childbirth, services relating to HIV-positive individuals, or services provided to victims of violence.

Finally, the screening invitation message must clearly identify the healthcare authority as the sender and must set out, in a clear manner, the right to object to the sending of SMS messages and the simple and immediate means by which such right may be exercised.