Italian Regulator Fines IQVIA €7 Million: Anonymisation Claim Fails

Rock Consultancy

Oct 13

2 min read

Updated: 4 days ago

October 2026

A €7 million fine for a health data company shows that patient data with names removed is not automatically anonymous. If a person can still be singled out, data protection law applies in full.

Introduction

On 23 September 2026, the Italian Data Protection Authority (the Garante) fined IQVIA Solutions Italy S.r.l. €7 million for unlawfully processing patients’ health data. The decision matters for any organisation that uses health or research data it believes to be anonymous, wherever it is based. Pharmaceutical, life sciences, research and health technology companies outside the EU may also be affected if they process EU based patients’ data.

Details

IQVIA, part of a multinational health data group, held a database of health information on about one million patients, supplied by 800 general practitioners (GPs). The data was used for studies, some commissioned by pharmaceutical companies. The investigation followed inspections in April 2025 and was joined with a data breach reported by the company.

IQVIA said the data was anonymous. The Garante disagreed. Each patient had a code that allowed them to be tracked over time. Combined with year of birth, sex, diagnoses, prescriptions, vaccinations and location, individuals could be singled out and potentially re-identified. The database also held names, tax codes or addresses for about 3,370 patients, with health data for about 3,080 of them.

The Garante found that IQVIA:

had no valid legal basis to process health data
did not properly inform patients
set no time limits for keeping data (data retention), some of which dated back to 2001
did not carry out a data protection impact assessment;
did not have adequate security in place

The following impacted the fine imposed by the Garante:

The number of patients and the sensitivity of the data
IQVIA’s cooperation, and the GPs’ decision to stop sending data, reduced it

If IQVIA wishes to continue with its processing activity, it has 120 days to comply, including identifying a legal basis, informing patients, completing an impact assessment and formalising agreements with GPs. Alternatively, the GPs must anonymise the data themselves, under safeguards set by the Garante.

Key Takeaways

Test anonymity claims: Removing names is not enough. A patient code combined with other details can allow people to be identified. Before claiming that data is anonymous, properly test it.
Confirm your legal basis: Processing health data needs a clear and recorded legal basis and additional conditions under the GDPR before you use it.
Clarify roles: Agree in writing who is responsible for the data with every organisation that supplies or receives it.
Assess the risks: Large-scale use of health data almost always requires a data protection impact assessment
Set retention periods: Keeping data indefinitely increases risk and is hard to justify.

Italian Regulator Fines IQVIA €7 Million: Anonymisation Claim Fails

Introduction

Details

Key Takeaways

Further Reading

Recent Posts