{"id":74898,"date":"2026-10-07T10:57:41","date_gmt":"2026-10-07T08:57:41","guid":{"rendered":"https:\/\/www.lexia.it\/?p=74898"},"modified":"2026-10-07T11:23:25","modified_gmt":"2026-10-07T09:23:25","slug":"data-technology-insight-october","status":"publish","type":"post","link":"https:\/\/www.lexia.it\/en\/2026\/10\/07\/data-technology-insight-october\/","title":{"rendered":"Data & Technology Innovation | October 2026 Insight"},"content":{"rendered":"\n

Health data and anonymisation: Italian DPA fines IQVIA EUR 7 million<\/strong><\/em><\/strong><\/h2>\n\n\n\n

Data Protection<\/em><\/p>\n\n\n\n

By Decision No. 710 of 23 September 2026, the Italian Data Protection Authority imposed a EUR 7 million fine on IQVIA Solutions Italy S.r.l. in relation to a database containing health information relating to approximately one million patients, collected from 800 general practitioners.<\/p>\n\n\n\n

The decision centres on the dividing line between anonymisation and pseudonymisation<\/span>: assigning each patient a unique and persistent code, combined with a particularly granular body of information (i.e. <\/em>diagnoses, prescriptions, examinations, vaccinations and geographical information), made it possible to single out data subjects, track their clinical history over time and re-identify them using reasonably available means. In other words, the data therefore remained subject to the GDPR.<\/p>\n\n\n\n

The Authority classified IQVIA as a controller from the point at which the data were collected from the doctors and found, among other matters, that there was no appropriate legal basis for processing health data, the information provided to data subjects was inadequate, no defined retention periods had been established, no DPIA had been carried out and the security measures adopted were insufficient.<\/p>\n\n\n\n

The decision is an important warning for health-tech<\/u><\/em> operators, data <\/em>providers, healthcare platforms and entities developing AI systems using health datasets<\/span>, as it makes clear that merely removing direct identifiers does not render a dataset<\/em> anonymous. The architecture of data flows, data granularity and combinability, the persistence of identifiers and the practical possibility of singling out and re-identification must be assessed by design<\/em>, together with the correct allocation of data-protection roles and the legal basis for the processing.<\/p>\n\n\n\n

For businesses seeking to derive value from health data for research, analytics<\/em> or technological development, prior technical and legal verification of whether datasets have been effectively anonymised is therefore essential not only for compliance<\/em>, but also for the sustainability of the business model<\/em>.<\/p>\n\n\n\n

Privacy by design<\/em> in digital payments: the role of PETs<\/strong><\/h2>\n\n\n\n

Data Protection<\/em><\/p>\n\n\n\n

In September 2026, the Bank of Italy published the paper<\/em> \u201cPrivacy-Enhancing Technologies and Auditability in Digital Payment System<\/em><\/a>s<\/em>\u201d in its Markets, Infrastructures and Payment Systems series. The paper examines technologies that can reconcile the protection of users\u2019 privacy with oversight and compliance requirements in digital payment systems.<\/p>\n\n\n\n

The paper starts from a premise that is also particularly relevant from a data-protection perspective: privacy should not be treated as a feature to be added ex post<\/em>, but as a requirement to be embedded from the system-design stage, in line with the principles of data protection by design<\/em> and by default<\/em> laid down in Article 25 GDPR. The underlying idea is that technical and architectural choices determine who may access transaction data, in what circumstances and at what level of detail.<\/p>\n\n\n\n

Privacy-Enhancing Technologies (PETs) are particularly relevant in this context: these technologies can limit data exposure or allow data to be disclosed only selectively. Among them, the paper<\/em> also examines zero-knowledge proofs<\/em>, which can, for example, demonstrate that a transaction complies with a given threshold without disclosing the exact amount. The key concept is auditability<\/em>, namely the ability of authorised parties to verify compliance with the applicable rules without necessarily having access to all data relating to the user or the transaction.<\/p>\n\n\n\n

The message is therefore that privacy<\/em> and compliance<\/em> need not be competing objectives: through appropriate technological choices, data minimisation and selective-disclosure<\/em> mechanisms, they can be designed together from the outset.<\/p>\n\n\n\n

Brevetti+, Disegni+ and Marchi+: EUR 32 million for SMEs\u2019 industrial property<\/strong><\/h2>\n\n\n\n

Intellectual Property<\/em><\/p>\n\n\n\n

By Director-General\u2019s Decree of 28 July 2026, published in Official Gazette No. 200 of 29 August 2026, the Ministry of Enterprises and Made in Italy (MIMIT) scheduled the reopening, for 2026, of the three measures supporting the commercial exploitation of industrial property rights held by micro, small and medium-sized enterprises. The total allocation of EUR 32 million is divided as follows:<\/p>\n\n\n\n