--- title: "Italy — Lawful Processing & Special Data | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/italy/lawful-processing-and-special-data/ source_html: /jurisdictions/italy/lawful-processing-and-special-data/index.html description: "Italy — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 3 claims Green ▾ # Core lawful-basis and special-category doctrine is settled and actively enforce" generated_at: 2026-10-25T04:46:50Z content_sha256: acb80caee225ae4a50e7bb8db3fb7bf46a170ccb3cd1359b4f3da4ee168a506a generator: "fe-fleet/md-twin@1.0" --- # Italy — Lawful Processing & Special Data | Data Protection Monitor ### D2Lawful Processing & Special Data4 sub-modules3 claimsGreen▾# Core lawful-basis and special-category doctrine is settled and actively enforced; anonymisation-specific guidance coverage is thinner. Primary framework GDPR Arts. 6, 7, 9 + Codice Privacy Artt. 2-sexies, 2-septies, 2-quinquies Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green Core lawful-basis and special-category doctrine is settled and actively enforced; anonymisation-specific guidance coverage is thinner. #### Sub-modules (4) #### Lawful BasesGreen Garante enforcement confirms Art.6 GDPR consent/legitimate-interest requirements, e.g. sanctioning promotional emails sent absent consent or another suitable legal basis. Claims (1): - The Garante fined a law firm for sending promotional emails absent consent and absent any other suitable lawful basis, in violation of Art.6(1)(a) GDPR and Art.130(2) of the Codice. #### Consent ThresholdsGreen Marketing consent must be documentable and is always revocable; Garante guidance requires unambiguous, specific, freely-given consent, rejecting scroll-based or pre-ticked mechanisms. Claims (1): - Consent to marketing communication in Italy must be documentable in writing to the Garante and can, in any event, always be withdrawn by the data subject at any time. #### Special CategoriesGreen The Garante applies a broad reading of special-category/health data, extending protection even to indirect health indicators such as sickness-absence records. Claims (1): - Under settled Garante case law, the notion of health-related personal data extends even to information about an employee's absence from service for illness, independent of whether a specific diagnosis is disclosed. #### Pseudonymisation And AnonymisationAmber No dedicated Garante pseudonymisation/anonymisation guidance surfaced in this research cycle; GDPR Art.4(5)/Art.25 concepts apply by default as directly-applicable EU law. Absence provenance: No Garante-specific anonymisation/pseudonymisation guideline document was returned; only general references within AI-training case files.. Searched: Garante anonymisation pseudonymisation guidance Italy. Category narrative 61 words Lawful bases follow GDPR Art.6 as construed by the Garante (consent, contract, legal obligation, legitimate interest); consent for marketing/telemarketing must be freely given, specific, and revocable at any time. Special categories (Art.9) receive heightened protection under Codice Art. 2-septies, with a broad interpretation of 'health data' extended even to sickness-absence notices. Dedicated pseudonymisation/anonymisation guidance was not located in this research pass. Periodic update · new data 2026-10-11 #### Lawful Processing & Special Data The Garante's decision against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, found that the company processed the health data of approximately one million patients, drawn from around 800 general practitioners, without an adequate legal basis and without adequately informing patients. The decision carries a second, structurally more significant finding: the Garante rejected IQVIA's claim that the dataset was anonymous. It found that a persistent per-patient code, combined with detailed health, demographic and location attributes, made re-identification reasonably possible, so the data remained personal data subject to the full special-category regime rather than falling outside GDPR's scope as genuinely anonymous information. The decision reportedly sets, for the first time in the Garante's enforcement practice, a numeric equivalence-class threshold for assessing anonymity claims over health data — a test grounded in how many individuals could plausibly share the same combination of attributes within the dataset, rather than a simple assessment of whether direct identifiers were removed. This reasoning establishes a more demanding evidentiary standard for any controller in Italy seeking to rely on anonymisation as a basis for processing health data outside the special-category lawful-processing regime. A controller can no longer assume that removing a name or similar direct identifier is sufficient; it must be able to demonstrate, with some degree of rigour, that the remaining combination of attributes does not make re-identification reasonably possible. The decision's reasoning was reported via secondary press sources rather than the Garante's own published text, which has not yet been directly retrieved. #### Outlook The clearest next step is confirmation of the IQVIA decision's full text against the Garante's own publication, to establish the precise contours of the equivalence-class threshold the decision reportedly introduces. Controllers processing health data in Italy under an anonymisation rationale should treat this decision as a signal that the bar for such claims is rising, pending that confirmation. Evidence 3 Sources and claims (3) - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10225019) — The Garante fined a law firm for sending promotional emails absent consent and absent any other suitable lawful basis, in violation of Art.6(1)(a) GDPR and Art.130(2) of the Codice.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1785597) — Consent to marketing communication in Italy must be documentable in writing to the Garante and can, in any event, always be withdrawn by the data subject at any time.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10243180) — Under settled Garante case law, the notion of health-related personal data extends even to information about an employee's absence from service for illness, independent of whether a specific diagnosis is disclosed.observed 2026-08-03