#
Core lawful-basis and special-category doctrine is settled and actively enforced; anonymisation-specific guidance coverage is thinner.
Sub-modules (4)
Lawful BasesGreen
Garante enforcement confirms Art.6 GDPR consent/legitimate-interest requirements, e.g. sanctioning promotional emails sent absent consent or another suitable legal basis.
Claims (1):
- The Garante fined a law firm for sending promotional emails absent consent and absent any other suitable lawful basis, in violation of Art.6(1)(a) GDPR and Art.130(2) of the Codice.
Consent ThresholdsGreen
Marketing consent must be documentable and is always revocable; Garante guidance requires unambiguous, specific, freely-given consent, rejecting scroll-based or pre-ticked mechanisms.
Claims (1):
- Consent to marketing communication in Italy must be documentable in writing to the Garante and can, in any event, always be withdrawn by the data subject at any time.
Special CategoriesGreen
The Garante applies a broad reading of special-category/health data, extending protection even to indirect health indicators such as sickness-absence records.
Claims (1):
- Under settled Garante case law, the notion of health-related personal data extends even to information about an employee's absence from service for illness, independent of whether a specific diagnosis is disclosed.
Pseudonymisation And AnonymisationAmber
No dedicated Garante pseudonymisation/anonymisation guidance surfaced in this research cycle; GDPR Art.4(5)/Art.25 concepts apply by default as directly-applicable EU law.
Absence provenance: No Garante-specific anonymisation/pseudonymisation guideline document was returned; only general references within AI-training case files.. Searched: Garante anonymisation pseudonymisation guidance Italy.
Lawful Processing & Special Data
The Garante's decision against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, found that the company processed the health data of approximately one million patients, drawn from around 800 general practitioners, without an adequate legal basis and without adequately informing patients. The decision carries a second, structurally more significant finding: the Garante rejected IQVIA's claim that the dataset was anonymous. It found that a persistent per-patient code, combined with detailed health, demographic and location attributes, made re-identification reasonably possible, so the data remained personal data subject to the full special-category regime rather than falling outside GDPR's scope as genuinely anonymous information. The decision reportedly sets, for the first time in the Garante's enforcement practice, a numeric equivalence-class threshold for assessing anonymity claims over health data — a test grounded in how many individuals could plausibly share the same combination of attributes within the dataset, rather than a simple assessment of whether direct identifiers were removed.
This reasoning establishes a more demanding evidentiary standard for any controller in Italy seeking to rely on anonymisation as a basis for processing health data outside the special-category lawful-processing regime. A controller can no longer assume that removing a name or similar direct identifier is sufficient; it must be able to demonstrate, with some degree of rigour, that the remaining combination of attributes does not make re-identification reasonably possible. The decision's reasoning was reported via secondary press sources rather than the Garante's own published text, which has not yet been directly retrieved.
Outlook
The clearest next step is confirmation of the IQVIA decision's full text against the Garante's own publication, to establish the precise contours of the equivalence-class threshold the decision reportedly introduces. Controllers processing health data in Italy under an anonymisation rationale should treat this decision as a signal that the bar for such claims is rising, pending that confirmation.
Sources and claims (3)
- ConfirmedGarante Privacy — The Garante fined a law firm for sending promotional emails absent consent and absent any other suitable lawful basis, in violation of Art.6(1)(a) GDPR and Art.130(2) of the Codice.observed
- ConfirmedGarante Privacy — Consent to marketing communication in Italy must be documentable in writing to the Garante and can, in any event, always be withdrawn by the data subject at any time.observed
- ConfirmedGarante Privacy — Under settled Garante case law, the notion of health-related personal data extends even to information about an employee's absence from service for illness, independent of whether a specific diagnosis is disclosed.observed