‘Anonymous’ Is a Test, Not a Checklist: Italy Fines IQVIA 7 Million Euros

What the Italian Authority Decided

Italy’s data protection authority has fined IQVIA Solutions Italy 7 million euros over a health database that IQVIA claimed was anonymous. The decision (No. 710) is dated Sept. 23, 2026. The authority announced it on Oct. 2, and the European Data Protection Board (EDPB) posted a summary on Oct. 9.

IQVIA checked many of the boxes on a standard HIPAA-style de-identification checklist. According to IQVIA’s account in the decision, the software that collected the data removed names, surnames and addresses, cut birth dates to the month, and had risk assessments conducted for re-identification. The authority still found the data was not anonymous. In effect, most patients lost their names but kept their detailed medical histories.

If you can follow a patient over time, assume the data is not anonymous until you can show otherwise.

HIPAA’s List vs. the GDPR’s Test

If you work with U.S. health data, you know the drill. The safe harbor method under the Health Insurance Portability and Accountability Act (HIPAA) takes the form of a list: remove 18 types of identifiers (the last being a catch-all for any other unique identifying number, characteristic or code, with a narrow exception) and have no actual knowledge that what remains could identify someone. HIPAA’s second method, expert determination, functions as a test, more similar to the GDPR. A qualified expert must find that the risk of identifying anyone from the data is very small.

The EU’s General Data Protection Regulation (GDPR) has no list. The authority asks three questions, drawn from the Article 29 Working Party’s 2014 opinion and the EDPB’s draft anonymization guidelines (adopted July 7, 2026, open for comment until Oct. 30, 2026). Using reasonably available means, could anyone [1] single a person out, [2] link records to other data about that person, or [3] infer new facts about that person? If any answer is yes, more analysis is needed before the data can be called anonymous.

Why the Data Was Not Anonymous

According to the authority, the database held health information on about 1 million patients of 800 general practitioners. This information was used for studies, some of them commissioned by pharmaceutical companies. Each patient carried a code which made it possible to follow the same person over time. The authority concluded that this code, in combination with a patient’s year of birth, sex, diagnoses, symptoms, prescriptions, examinations, vaccinations and location data, allowed individual patients to be singled out and, by reasonably available means, re-identified.

IQVIA’s risk assessments used k-anonymity, which hides a person among others who share the same details, such as age and location. The authority established that k-anonymity is not enough when other parts of the record, such as diagnoses and medication patterns over time, can single a person out. A checklist asks what you removed; the authority asked what could still be linked. Removing someone’s name tag does not help much if the same person shows up to every appointment, revealing the telling fingerprint of a long medical history.

The “We Are Only the Recipient” Argument

IQVIA argued that, from its own position, the data was anonymous: the key linking codes to patients sat in the doctors’ software, which it could not access. It relied on the EU Court of Justice’s judgment of Sept. 4, 2025 (case C-413/23 P, known as SRB), which, as the decision describes it, allows pseudonymized data to be non-personal for a recipient who cannot re-identify the people.

The authority did not reject the principle that pseudonymized data could be non-personal for a recipient of that sort. However, it found that IQVIA was not an ordinary recipient: it was the controller from the point of collection, because its contracts and instructions shaped the anonymization process. IQVIA was thus judged by what it could do, not by what it intended. Because, as the controller, it could re-identify patients by reasonable means, the data was personal for IQVIA.

What Else the Authority Found

The usual GDPR duties accompany personal health data. The authority treated IQVIA as the controller and found that it had:

• no suitable legal basis, and no adequate information for patients
• no retention periods; the data went back as far as 2001
• no completed data protection impact assessment (DPIA)
• inadequate security: identifying details of about 3,370 patients, with health data for about 3,080, arrived through free-text fields

IQVIA says it uses pseudonymization and encryption. Both are good security measures, but neither turns personal data into anonymous data.

What the Authority Ordered

Besides the fine, the authority gave IQVIA a few pathways. To keep processing, it had to, within 120 days of notification, take these steps and report back to the authority: find a legal basis, inform patients, carry out a DPIA and appoint the doctors as processors. Otherwise, the doctors could anonymize the data themselves, under safeguards specified by the authority.

In its penalty decision, the authority took into account the number of patients and the sensitivity of the data. In IQVIA’s favor, the general practitioners had stopped sending data and IQVIA cooperated during the proceedings.

That said, this is the decision of a single national authority, so other EU data protection agencies are not bound by it. IQVIA says it cooperated with the authority, has taken the necessary measures to comply with its orders and does not use the dataset in its clinical research services. The company has reserved the right to appeal.

What This Means for GCs, CISOs and Founders

This matters most if you handle the personal data of people in the EU, because the GDPR may then apply to you. If you do not, the decision is still a useful test of what ‘anonymous’ should mean.

General counsel. ‘Anonymous’ in a contract is a statement of fact, and your name is on it. Calling yourself the recipient may not help if you shaped the process. An old assessment also may not survive a new ruling on a similar dataset. Check the controller and processor roles in your contracts too. If IQVIA continued processing the data, the authority wanted the doctors appointed as processors.

CISOs. Encryption and pseudonymization protect data but do not make it anonymous. The authority said hashing the patient ID does not prevent singling out. For security teams, the lesson concerns free-text fields. The authority faulted IQVIA for not checking, before or after collection, whether free-text fields were left out, and noted that such fields carry high risk.

Founders. If your product shares or sells ‘de-identified’ patient or user data, the claim that the data is de-identified is likely sitting in your pitch deck, your data-license terms and your privacy notice. All three should describe the data accurately and consistently. Regulators may test that claim, like Italy’s did.

U.S. companies accustomed to HIPAA ought to unlearn the checklist. A U.S. de-identification label does not answer the GDPR question, because the two systems set different standards.

Action Items

1. List every dataset you call anonymous or de-identified. Take note of identifiers and persistent codes. Our post on finding where personal data lives may help with the inventory.
2. Ask the three questions. Using reasonably available means, could anyone [1] single out a person, [2] link records to other data about that person, or [3] infer new facts about them? If any answer is yes, assume the data is personal until an analysis shows otherwise.
3. Check the free text. Find every free-text field that feeds a dataset you call anonymous, and test it for names, ID or phone numbers and addresses. Free-text boxes collect surprising things. As IQVIA’s case shows, people often type identifying details into them.
4. Check your roles and documents. Make sure contracts, decks and privacy notices describe your data accurately, and that controller and processor roles match what really happens.

These steps serve as a first pass. Whether a real dataset holds up is a judgment call. The contract language and the documentation also have to survive a regulator’s questions. If a dataset falls short, our series on privacy-enhancing technologies covers the alternatives, from synthetic data to how to choose between them.

Calling a dataset anonymous? Get in touch with General Legal to review the claim, the contracts and the analysis behind it.

Sources

Official sources

• Garante per la protezione dei dati personali, press release “Dati sanitari: 7 milioni di euro di sanzione” (Oct. 2, 2026)
• Garante per la protezione dei dati personali, decision No. 710 of Sept. 23, 2026
• EDPB, Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data (Oct. 9, 2026)

Coverage of the decision and IQVIA’s response (Oct. 2, 2026)

• Il Sole 24 Ore Radiocor, “Garante privacy: dati sanitari, sanzione a Iqvia per 7 milioni di euro”
• Il Sole 24 Ore Radiocor, “Garante Privacy: Iqvia, sempre collaborato e adottate le misure necessarie”
• Sky TG24, “Iqvia Italia, multa da 7 mln dal Garante della Privacy per la gestione dei dati sanitari”
• MLex, “IQVIA fined €7m in Italy for GDPR breach over identifiable patient data”

HIPAA de-identification rule

• 45 CFR § 164.514, de-identification of protected health information (Cornell Legal Information Institute)

EDPB draft anonymization guidelines

• European Data Protection Board, Guidelines 02/2026 on Anonymisation, version 1.0 (adopted July 7, 2026; public consultation until Oct. 30, 2026)

This post is general information, not legal advice. Reading it does not create an attorney-client relationship.