Cybersecurity Policy Report, Italian DPA OKs Use of Patient Phone Numbers in Screening Campaigns, (Feb 19, 2026)

By Tony Foley

Garante, the Italian data protection authority (DPA), has said that adult patients’ telephone numbers obtained as part of providing health care services can be used in screening campaigns required by national or regional regulations, even if the potential use of information for these purposes was not expressly stated at the time of collection.

The agency explained in a Feb. 18 press release that, in light of the principles of the EU General Data Protection Regulation (GDPR) and European case law, data processing that is strictly necessary to promote public prevention programs can be considered compatible with the original purposes of treatment, diagnosis, and health care, provided that adequate safeguards are provided.

Garante has adopted specific guidelines that, among other provisions, require healthcare companies to update their information to specify that the most recent contact details collected for treatment purposes, subject to accuracy verification, may be used exclusively for the promotion of public prevention programs and not other purposes (like scientific research or administrative activities). In addition, the use pf the data must be limited to screening campaigns required by current legislation and must exclude the use of contact details collected for services requiring specific protection of anonymity, including voluntary termination of pregnancy, anonymous childbirth, and services for HIV-positive people and victims of violence. Finally, the guidelines mandate that a screening invitation message must identify the healthcare company as the sender and clearly state the right to object to the sending of text messages and all simple and immediate ways to exercise the right.

News: InternationalLegislation DataPrivacy GDPR