Trattamento dei dati personali e standard di legalità: elementi di preminenza delle esigenze di circolazione?

Abstract

Personal data processing and legality standards: evidence of the growing primacy of data free movement?
Starting from the features of the meta-principle of purpose limitation and the necessity clause, the essay shows how the GDPR constructs a functional standard of legality, including with regard to data processing carried out for the performance of a task in the public interest. Given the margin of discretion left by the GDPR in this domain, the Italian legal system was initially characterised by a framework inspired by a strict legality standard (requiring detailed legislative predetermination of data, operations, and purposes), before subsequently aligning with functional legality as a result of the amendments to the Privacy Code introduced in 2021. The two standards analysed entail a different balance between the need to protect personal data and the need to ensure their circulation. The essay concludes by illustrating two examples – one at the national level (the national-interest databases in the context of the PDND) and one at the European level (the EHDS Regulation) – in order to show how, more recently, regulatory strategies have emerged that, through a “strategic” use of lawful bases for data processing and of the meta-principle of purpose limitation, aim to encourage the circulation and secondary use of personal data. These developments signal a trend toward the progressive erosion of the centrality of consent and a shift in the balance between data protection and data-sharing needs.