The Italian Data Protection Authority recently authorised a US pharmaceutical company and an Italian hospital to use the personal data of people without capacity to make their own decisions, including those with no legal representation, within the framework of a specific clinical trial although this is not legal under current Italian legislation. This action effectively acknowledged the validity of consent given by persons with family ties to patients, or those in hospitals caring for patients, in contrast with Italian legislation which regards as valid only consent that is given by a legally appointed guardian. This article considers the present state of the regulations governing trials involving incapacitated adults, the paradoxes generated by the discrepancy between the authorisation granted by the Authority and current legislation, and (possible) future developments.