Italy's Garante Fines IQVIA EUR 7 Million: Data Not Anonymous

Italy's Garante Fines IQVIA EUR 7 Million: Data Not Anonymous

Italy's data protection authority has fined IQVIA Solutions Italy S.r.l. EUR 7,000,000 for building a database of health records on about one million patients. The company called the data anonymous. The Garante found it was only pseudonymised, and therefore still personal data under the GDPR.

Information last verified on October 13, 2026. This is a developing story; we update it as the record changes.

Status: Provvedimento n. 710 adopted 23 September 2026 and made public 2 October 2026. IQVIA publicly reserved the right to bring a challenge on 2 October 2026; no filed challenge is on the public record as of 13 October 2026. A Garante fine may be challenged before the Italian ordinary courts.

Jurisdiction scope: This article is about Italian and European Union law. The decision was taken by an Italian regulator applying Regulation (EU) 2016/679 (the GDPR) together with Italy's Codice Privacy, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. It is not a ruling on United States law, it creates no rights or obligations under any US federal or state privacy statute, and nothing in it binds a US company that does not process the personal data of people in the EU.

What Happened

The case began with an inspection. The Garante sent inspectors into IQVIA Solutions Italy S.r.l. in April 2025, according to the Authority's press release of 2 October 2026. The subject was a database the company owned, called LPD, short for Longitudinal Patient Data.

The LPD database was fed by the medical records of patients belonging to a panel of roughly 800 Italian general practitioners. Those doctors were members of SIMG, the Italian society of general practitioners and primary care. The project had a name, Health Search, and a long history: the decision traces it from SIMG's original concept, through a sale to a company in the French Cegedim group, through asset transfers to IMS Health, and finally to IQVIA, which renamed itself from IMS Health and became the database owner.

The mechanics mattered more than the history. IQVIA gave participating doctors a free licence for a practice-management software package, paying the software vendor itself. Installed on top of that software was an add-on whose job was to extract patient data and send it to IQVIA. In exchange, each doctor undertook to keep feeding the database.

The code that followed each patient

Inside LPD, every patient carried an identifier the decision calls the Pat ID. The company described it as a UUID, a 16 byte value rendered as a 22 character alphanumeric string, generated by the add-on on the doctor's own computer using the vendor's proprietary algorithm. The doctor could not see it. IQVIA said it had no access to the key linking the code back to a patient.

But the code was deliberately stable. As the company told inspectors, the patient is always recorded with the same Pat ID over time, because it is necessary to follow that patient longitudinally. It changed only if the patient switched doctor or the doctor replaced the computer.

Around that code sat a very rich record. The decision lists year of birth, sex, marital status, number of children, socio-professional category, dates of visits to the doctor, the diagnosis, symptoms, allergies, weight, height, drug prescriptions, vaccinations, tests and sickness certificates, plus location data. Date of birth had been blunted by defaulting every patient to the first day of the month, so month and year survived. According to the company's own account of the data flow, the patient's street address was not transmitted, only the patient's city, and for the doctor only the province. On this point the record is not consistent: elsewhere in the decision the company described removal of the city as one of the measures it applied. The Garante's own finding refers simply to location data.

During the inspection the company itself demonstrated the point without meaning to. It showed inspectors one patient appearing 34 times in the prescriptions table, so that the clinical history could be traced.

What IQVIA argued

IQVIA's defence had two legs. First, that it was a mere technological and financial partner, with SIMG leading the project, so it was not the controller. Second, that the data reaching it were already anonymous, because the pseudonymisation happened upstream, inside the doctor's software, under a process IQVIA neither controlled nor could modify.

The company leaned heavily on the EU Court of Justice judgment of 4 September 2025 in Case C-413/23 P, often called the SRB judgment, arguing it showed that pseudonymised data can be non-personal in the hands of a recipient who cannot re-identify anyone. It filed a re-identification risk assessment scoring the risk at 3 on its own scale, which it characterised as a low and non-significant threshold.

What the Garante found

The Garante rejected both legs.

On the controller question, the contracts were decisive. The decision quotes successive agreements in which IQVIA undertook to keep giving the software vendor instructions so that the sensitive data entered by doctors would be rendered anonymous before being loaded into LPD. IQVIA described itself as controller throughout its own contractual documents. It owned the database, held the contracts with the doctors and with the software vendor, and had appointed that vendor as its processor under Article 28. SIMG, the Garante concluded, never had the primary guiding role IQVIA attributed to it.

The doctors could not be the ones anonymising, either. A general practitioner remains the controller of patient data for care purposes, but makes no decision at all about this extraction. As the decision puts it at paragraph 79: «non sono i MMG ad anonimizzare i dati dei loro pazienti bensì IQVIA», meaning it is not the general practitioners who anonymise their patients' data but IQVIA.

On the data itself, the Garante's core sentence appears at paragraph 100: «È infatti sufficiente che essa abbia la capacità di re-identificarle, mediante mezzi ragionevoli, affinché i dati in questione siano da qualificarsi come dati personali.» In English: it is sufficient that the company has the capacity to re-identify them, by reasonable means, for the data in question to qualify as personal data. Intention is irrelevant. The Garante rests that sentence on the EDPB's binding decision 1/2021 on WhatsApp Ireland and on the French CNIL's decision of 26 May 2026, which fined IQVIA Operations France EUR 5,000,000 over two health data warehouses.

The data breach folded into the case

A second strand joined the file. After the inspection, IQVIA notified the Garante of a personal data breach under Article 33. Doctors had typed information into free-text fields in their own software, and the add-on had extracted those fields too.

The result was that directly identifying data reached IQVIA: names, surnames, dates of birth, the Italian codice fiscale, postal addresses, email addresses and telephone numbers for 3,370 patients, of whom 3,080 also had health data attached. The data had been received daily on working days over a period and then passed to SIMG, which deleted it on request and confirmed the deletion.

The Garante refused to treat the doctors' data entry as the error. Doctors recording extra information in a system they use for patient care are doing their job. The responsibility, the decision says, lay with IQVIA for never checking that the add-on it commissioned did not scrape free-text fields it had no use for.

The findings, the fine and the deadline

The operative part of provvedimento n. 710 declares the processing unlawful for breach of GDPR Articles 5(1)(a), 5(1)(e), 5(1)(f) and 5(2), 9, 13, 25, 28, 32 and 35. In plain terms: no valid lawful basis and no proper transparency for health data, no storage limitation, no integrity and confidentiality, no accountability or data protection by design, no information notice, no appointment of the doctors as processors, inadequate security, and no data protection impact assessment.

On the money, the Garante applied Article 83(3) of the GDPR, which caps a single course of conduct at the amount for the gravest breach. Because the gravest breaches fell under Article 83(5), the ceiling was EUR 20,000,000 or 4 percent of total worldwide annual turnover, whichever is higher. The Authority treated IQVIA Solutions Italy S.r.l. and its US parent IQVIA Holdings Inc., which owns it outright, as a single economic unit, and took the parent's consolidated turnover as the reference. That made the 4 percent ceiling the higher of the two.

It then landed well below that ceiling, at EUR 7,000,000. Paragraph 157 explains why in unusually candid terms: the Authority balanced the rights of the patients against the fact that LPD had been created as a reference resource for health information in Italy and internationally, used for studies, health economics analysis and pharmacoepidemiological evaluation, and it did so partly in order to limit the economic impact of the fine on the company's organisational and functional needs.

The mitigating factors it listed were the re-identification checks the company had commissioned over the years, the doctors' suspension of all transmissions (from 2023, per the Authority's newsletter), reinforced pseudonymisation measures, the absence of any relevant prior violation in Italy, the absence of complaints from patients, and cooperation during the proceedings. The aggravating factor was the negligent character of the conduct.

The remedy is an engineering specification

The corrective order is the part practitioners will reread. IQVIA has 120 days from notification of the provvedimento, not from publication, and must send the Garante a documented report of what it has done within that period.

If IQVIA wants to carry on as before, it must find a valid lawful basis covering the patient data and any anonymisation of it, discharge the Article 13 information duty toward the patients, carry out the Article 35 impact assessment, and appoint the doctors as processors under Article 28.

The alternative is that the doctors perform the anonymisation themselves, and here the Garante wrote something close to a technical standard:

• IQVIA must not determine the pseudonymisation method. The sending doctors must independently choose which attributes to pseudonymise and apply coding with a documented random element of adequate complexity, so that from IQVIA's standpoint the coded value is a semantically meaningless sequence, not reversible by reasonably available means.
• Quasi-identifiers and their generalisation can be agreed in advance, but the resulting k-anonymity equivalence classes must in every case contain no fewer than 10 individuals.
• Every remaining variable, neither hashed nor folded into an equivalence class, must be assessed for whether IQVIA can observe or measure it. If it can contribute to identification, it must either join the quasi-identifiers (with classes of at least 10), or be handled through distributed techniques such as secure multiparty computation so IQVIA never holds the whole value in the clear, or be removed.

If IQVIA passes the data on to any third party, the same conditions bind IQVIA as sender.

Paying, settling, appealing

The decision orders payment of EUR 7,000,000 within 30 days of notification, and adds the accessory sanction of publication of the order on the Garante's own website under Article 166(7) of the Codice Privacy.

Italian procedure offers an off-ramp. Article 166(8) of the Codice Privacy lets an offender settle by complying with the Garante's prescriptions, where any were issued, and paying half the fine imposed, which here would be EUR 3,500,000. That window is the same one allowed for bringing a challenge.

A challenge goes to the ordinary courts, not to an administrative tribunal. Article 152 of the Codice Privacy assigns these disputes to the ordinary judicial authority, and Article 10 of Legislative Decree 150/2011 governs the procedure. The decision records the deadline as 30 days from communication of the provvedimento, or 60 days if the applicant resides abroad.

Because the notification date is not public, there is no way to tell from the published record whether that window is still open. On 2 October 2026 IQVIA said publicly that it had always cooperated with the Authority and had adopted the measures required, while reserving the right to bring a challenge, and that the dataset the decision concerns is not used in its clinical research services and is not connected to running clinical studies for sponsors. No filed challenge is on the public record as of 13 October 2026, and we do not know whether IQVIA has paid or settled.

What the Law Actually Says

The entire case turns on one distinction that decides whether European data protection law applies at all.

Personal data, and the test of identifiability

Under the GDPR, personal data means any information relating to an identified or identifiable natural person, and a person is identifiable where they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity. The decision restates that definition at paragraph 82.

If data are personal, the whole regulation attaches: a lawful basis, transparency, storage limits, security, accountability, impact assessments. If data are genuinely anonymous, none of it does. This is why the anonymous label is such a valuable thing for a data business to claim, and why regulators scrutinise the claim rather than accept it.

Pseudonymisation is a safeguard, not an exit

Pseudonymisation is defined in the GDPR as processing personal data so that they can no longer be attributed to a specific data subject without the use of additional information, provided that information is kept separately and subject to technical and organisational measures. The decision quotes that definition at paragraph 83 and pairs it with Recital 26.

The consequence is settled and the Garante restates it at paragraph 84: pseudonymised data are personal data, and must be processed in compliance with the regulation. The decision cites the Article 29 Working Party's Opinion 05/2014 on anonymisation techniques (WP216) for the blunt formulation that pseudonymisation is not a method of anonymisation; it merely reduces the linkability of a dataset to a person's original identity, and is therefore a useful security measure. It also cites the European Data Protection Board's draft Guidelines 01/2025 on pseudonymisation to the same effect.

Anonymisation is the higher bar. Data are anonymous, the decision says at paragraph 86, only if they permit neither direct nor indirect identification, taking account of all the means (financial, informational, technological, in skills and in time) reasonably available to whoever might try. At paragraph 87 the Garante sets out the three classic criteria a complete anonymisation process must defeat: singling out an individual within a group, linking an anonymised record to data about a person in a separate dataset, and inferring new information about a person from the record. It notes those criteria are restated in the EDPB's Guidelines 02/2026 on anonymisation, adopted on 7 July 2026 and still in public consultation at the time of the decision.

One further point from paragraph 90 has broad consequences: the act of anonymising is itself a processing of personal data, so it needs its own lawful basis. The Garante cites EDPB material and a judgment of the Tribunale di Milano of 10 May 2024 for that proposition. It is the reason IQVIA could not escape by saying it only ever handled the output.

Why a random code did not deliver anonymity

The most useful passage in the decision is its treatment of k-anonymity, the technique IQVIA's assessments relied on. The Garante explains at paragraph 95 that k-anonymity requires each combination of certain attributes, for example locality and age, to be shared by at least k indistinguishable individuals grouped into equivalence classes. Then it identifies the structural limit: that constraint operates only on a subset of attributes, the quasi-identifiers, and not on the whole record.

So a record can sit inside a formally compliant equivalence class and still be unique once you look at the rest of it. Diagnoses, sequences of hospital admissions and patterns of drug use can be distinctive enough to identify a person on their own.

The decision is equally direct about hashing, at paragraph 96: «il semplice hashing delle identità non mitiga questo rischio, poiché non rimuove singolarità (anzi, esso è costruito per mantenerle in modo da riferire la storia clinica a un soggetto determinato)». That is, simple hashing of identities does not mitigate this risk, because it does not remove singularity; indeed it is built to preserve singularity, precisely so that the clinical history can be attached to one specific subject.

That sentence is the case in miniature. The stable Pat ID was not a bug in an anonymisation scheme. It was the product feature. A longitudinal patient database is valuable because it keeps one person's history together over years, and keeping one person's history together is exactly what makes that person singular in the data.

Health data carries an extra layer

Article 9 of the GDPR sets a general prohibition on processing special categories of data, health data among them, unless a specific exemption applies. The decision runs through the obvious candidates and finds none.

A contract could not supply the basis, the Garante reasons at paragraph 107, because the patients were not parties to the agreement between IQVIA and the doctors; their data were its object. Explicit consent was never obtained for IQVIA's processing. The Garante therefore found unlawfulness under Article 5(1)(a) together with Article 9, and a separate transparency failure under Article 13, since the information the doctors gave patients neither came from the responsible controller nor contained everything Article 13 requires.

Did the SRB judgment not change this?

This is the sharpest legal question in the decision, and the Garante's answer is narrow rather than dismissive.

In Case C-413/23 P, decided on 4 September 2025, the Court of Justice held, construing Regulation (EU) 2018/1725 in terms the Garante treats as applying equally under the GDPR, that pseudonymised data are not to be treated as personal data in every situation and for every person, because pseudonymisation may, depending on the circumstances, genuinely prevent people other than the controller from identifying the data subject. The decision quotes the relevant passages and reads them as continuity with Breyer (C-582/14, 19 October 2016) and OC v Commission (C-479/22, 7 March 2024), not a break.

At paragraph 93 the Garante distils three conditions under which data can lose their personal character for a recipient: the recipient must be unable to influence or alter the measures the original controller applied, must be unable to re-identify the data subject including by cross-referencing other material, and must not pass the data on.

Then it explains why none of that rescued IQVIA, at paragraph 99. IQVIA was not a simple recipient of pseudonymised data. It was responsible for the whole processing from the moment of collection at the doctors' surgeries, and the contractual record shows it actively shaping the asserted anonymisation measures. The SRB reasoning protects a genuine downstream recipient with no hand in the pseudonymisation. It does not protect the party that designed the pipeline.

Paragraph 89 draws out the reciprocal lesson, which cuts both ways for industry: the same dataset can be personal data for one entity, which holds or can obtain the additional information, and anonymous for another that holds neither and cannot reasonably obtain it. Anonymity is assessed in the hands of a specific actor, in its context and with its relationships, not in the abstract.

Where Italian law comes in

The GDPR supplies the substance. Italian law supplies the machinery, which is where the way the GDPR and Italy's Codice Privacy operate as a single framework becomes practical rather than academic.

Article 166 of the Codice Privacy, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, is the provision that gives the Garante, Italy's data protection authority the power to adopt corrective measures under Article 58(2) of the GDPR and to impose Article 83 fines by way of an ordinanza ingiunzione. The same article sets the procedure used here: notification of the alleged violations, 30 days for written defences, the option of a hearing, the accessory sanction of publication, and the half-payment settlement route in paragraph 8.

Article 152 routes any challenge to the ordinary courts under Article 10 of Legislative Decree 150/2011. The structure is worth understanding if you follow Italian enforcement at all, and it sits alongside the rest of the broader picture of data protection rules in Italy, which reaches well beyond pharmaceutical databases into everyday situations such as the rules that govern a home security camera in Italy.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The interesting thing about this decision is not the number. The Garante went out of its way to explain that it had deliberately moderated the EUR 7,000,000 figure, well below the statutory ceiling it had just calculated, because the database is a genuine research resource and it wanted to limit the economic impact on the company's operations. The interesting thing is the reasoning, because it tests an assumption a large part of the health data industry has been building on.

That assumption is that a strong pseudonymisation pipeline run upstream, plus a low re-identification risk score, converts a record-level health dataset into something outside European data protection law. The Garante did not reject risk assessment as a method. It rejected the way this one was scoped. Measuring k-anonymity across the quasi-identifiers while leaving a rich, longitudinal, record-level payload untouched measures the wrong thing, because in a dataset built to follow one person over years the payload is where the uniqueness lives.

The second point concerns the SRB judgment. When the Court of Justice ruled in September 2025, a good deal of commentary read it as a general softening of the personal data concept for pseudonymised datasets. This decision reads it as a rule about recipients, and declines to extend it to a party that designed the pseudonymisation it later relies on. One national authority's reading does not settle European law. The Court of Justice set aside the General Court's judgment in SRB v EDPS (T-557/20) and referred that case back to the General Court, so the underlying dispute is itself still pending, and the question of how far SRB travels will be worked out across several regulators and courts over the next few years. But the reading is a coherent one, and anyone whose compliance position rests on SRB should check whether they are in the recipient posture the judgment actually addressed.

The third point is the one most likely to be copied. The alternative remedy is not drafted as a principle but as a specification: equivalence classes of at least 10, independent determination of the coding by the sending party, and an explicit obligation to deal with residual variables either by generalising them, by removing them, or by secure multiparty computation. Regulators rarely name a cryptographic technique. Whatever happens to this particular decision, that paragraph is now a reference point for anyone designing a data flow between clinicians and a commercial analytics partner in the EU.

What the decision does not do is also worth naming. It does not find that the research was worthless or that the studies were improper. It does not say longitudinal primary care databases cannot exist in Italy. It does not decide anything about datasets with different attributes, shorter observation windows or different governance. And it is a first-instance administrative decision which the company may contest before the Italian courts; IQVIA has publicly reserved the right to do so, and no filed challenge is on the public record.

How This Affects You

This section is general information about Italian and EU law, not advice about any individual situation.

If you were a patient of an Italian general practitioner. Patients were never told clearly that their records were feeding a commercial database, which is part of what the Garante found unlawful. If your data may be involved, the GDPR gives you rights you exercise against the controller: access under Article 15, rectification, erasure, and the right to lodge a complaint with the Garante. There is no compensation fund and no claims process attached to this decision: an administrative fine under the GDPR is not compensation for patients. The Authority reports that the doctors stopped transmitting data from 2023.

If your organisation holds a dataset it calls anonymous. The practical lesson is that the label is only as good as the analysis behind it, and the analysis has to cover the whole record. Questions this decision suggests asking: does a stable per-subject identifier run through the data, and if so what was it for; does the k-anonymity work cover only quasi-identifiers; how unique are subjects once diagnoses, prescription sequences or event patterns are taken into account; and could your own organisation, with the means genuinely available to it, single out an individual, regardless of whether it ever intends to.

If you rely on a vendor's assurance. The Garante was unimpressed that IQVIA accepted the anonymous character of incoming data passively, on the strength of generic assessments by a group company, and did not revisit it after relevant national and European decisions. A contractual warranty that data arrive anonymous is not an accountability record, and the decision attributes the add-on's free-text extraction to the party that commissioned the add-on.

If you are mapping controller and processor roles. Roles are functional and not negotiable. Paying for the technology, owning the database and holding the contracts pointed to control here, even though a scientific society had originated the project and a third-party vendor wrote the extraction code. Labels in a contract did not decide the question; the real influence over purposes and essential means did.

If you operate from the United States. Nothing in this decision applies to US domestic processing. It becomes relevant only where an organisation processes the personal data of people in the EU, and in that case the exposure runs to a group-level turnover calculation, as it did here.

This article explains an enforcement decision under the law of Italy and of the European Union. It is general information, not legal advice, and it does not create a lawyer client relationship. Data protection rules differ by country, Italian enforcement decisions can be revised on appeal, and nothing here describes United States federal or state law. For your own situation, consult a lawyer qualified in the relevant jurisdiction.

Related articles

• Italian privacy law from the ground up
• Where EU and Italian data protection rules meet
• Inside Italy's privacy regulator
• Home cameras and your neighbours in Italy
• Recording Laws in Italy

Last updated: 2026-10-13. This is a developing story; details verified as of 2026-10-13.

Frequently Asked Questions

What exactly did Italy's Garante decide about IQVIA?

In provvedimento n. 710 of 23 September 2026 the Garante declared IQVIA Solutions Italy S.r.l.'s processing unlawful and ordered it to pay EUR 7,000,000 in Italy. The central finding was that health records on about one million patients of roughly 800 Italian general practitioners were pseudonymised rather than anonymous, so the GDPR applied throughout, and that IQVIA was the controller from the moment the data were collected in the surgeries.

What is the difference between pseudonymised and anonymous data under the GDPR?

Pseudonymised data have had identifiers replaced so they cannot be attributed to a person without additional information held separately. They remain personal data and the whole regulation applies. Anonymous data permit neither direct nor indirect identification taking account of all means reasonably available to anyone who might try, and fall outside the regulation entirely. The Garante set out the three hurdles a real anonymisation must clear: singling out, linkability and inference.

Why did a random patient code not make the data anonymous?

Because the code was stable by design. It was there so that one patient could be followed over years, which is what makes a longitudinal database commercially useful. The Garante explained that hashing an identity does not remove singularity; it is built to preserve it. Around that code sat year of birth, sex, diagnoses, symptoms, prescriptions, vaccinations, tests and location data, and k-anonymity had been applied only to a subset of attributes, leaving the rich payload able to act as an identifier on its own.

Which GDPR articles did the decision actually find were breached?

The operative part of provvedimento n. 710 names Articles 5(1)(a), 5(1)(e), 5(1)(f) and 5(2), 9, 13, 25, 28, 32 and 35. Article 6 is not in that list, even though the decision discusses why a contract could not provide a lawful basis; the unlawfulness was framed through the Article 5(1)(a) lawfulness principle together with Article 9 on health data.

Did the EU Court of Justice SRB judgment of September 2025 not help the company?

Not on these facts. The Garante accepted that under Case C-413/23 P pseudonymised data may lose their personal character for a recipient who cannot influence the measures applied, cannot re-identify anyone including by cross-referencing, and does not pass the data on. It then found IQVIA was not a mere recipient: it was responsible for the whole processing from collection and had actively shaped the asserted anonymisation. How far that judgment reaches is still being worked out across EU regulators and courts.

Does IQVIA have to delete the database?

The published decision does not order deletion of the database. It gives the company 120 days from notification of the provvedimento either to bring the processing into compliance, which means finding a lawful basis, informing patients under Article 13, completing the impact assessment and appointing the doctors as processors, or to hand the anonymisation step to the doctors under specified technical conditions. A documented report to the Garante is due within the same 120 days.

Can the EUR 7 million fine be challenged?

Yes. Under Article 78 of the GDPR, Article 152 of Italy's Codice Privacy and Article 10 of Legislative Decree 150/2011, a Garante order is challenged before the ordinary Italian courts within 30 days of communication, or 60 days for an applicant resident abroad. Article 166(8) of the Codice Privacy separately allows the matter to be closed by complying with the Garante's prescriptions and paying half the amount, EUR 3,500,000. The notification date is not public, so the published record does not show whether that window is still open. IQVIA publicly reserved the right to bring a challenge on 2 October 2026, and no filed challenge is on the public record.

Was there also a data breach in this case?

Yes, and it was joined to the main proceeding. IQVIA notified the Garante under Article 33 that the extraction add-on had also pulled free-text fields from doctors' software, carrying directly identifying information including names, dates of birth, the Italian codice fiscale, postal addresses, email addresses and telephone numbers for 3,370 patients, with health data attached for 3,080 of them. The Garante placed responsibility on IQVIA for not verifying that the add-on it commissioned excluded those fields.

Does this decision apply outside Italy?

The decision itself binds only IQVIA Solutions Italy S.r.l. and applies Italian and EU law. Its reasoning has wider interest because the GDPR is EU-wide and because the Garante used the parent group's consolidated turnover to set the statutory ceiling. It has no effect on United States law and creates no US obligations.