October 2026 A €7 million fine for a health data company shows that patient data with names removed is not automatically anonymous. If a person can still be singled out, data protection law applies in full. Introduction On 23 September 2026, the Italian Data Protection Authority (the Garante) fined IQVIA Solutions Italy S.r.l. €7 million for unlawfully processing patients’ health data. The decision matters for any organisation that uses health or research data it believes to