IQVIA's Italian arm fined €7M over 1M patients' health data that wasn't anonymous

Italy's data protection authority, the Garante, fined IQVIA Solutions Italy S.r.l. €7 million in a decision of 23 September 2026 over a database holding health data on about one million patients of roughly 800 general practitioners. The data was extracted from doctors' practice-management systems via an add-on, and each patient carried a persistent identifier — a Pat ID — so people could be followed over time. IQVIA used the database for studies commissioned by pharmaceutical companies.

The Garante found the data was not anonymous, as the company claimed: the persistent identifier combined with year of birth, sex, diagnoses, symptoms, prescriptions, examinations, vaccinations and location data made it possible to single out and re-identify individuals.

The authority listed the infringements: health data processed without an appropriate legal basis and without adequately informing patients, no retention periods (the data went back to 2001), no data protection impact assessment, inadequate security, and the GPs never appointed as processors. Free-text fields also left about 3,370 patients directly identifiable — about 3,080 of them with health data — the breach IQVIA itself had notified.

IQVIA argued the data was anonymous, citing the CJEU's judgment in Case C-413/23, and said it never held the key linking the identifier to a person. The Garante reached the opposite conclusion and gave the company 120 days to bring the processing into compliance — legal basis, patient information, impact assessment, processors appointed — or have the doctors anonymise the data themselves. Mitigating factors: the doctors stopped sending data from 2023, and IQVIA cooperated during the proceedings.

€7M fine; 120 days to bring the processing into GDPR line or have the doctors anonymise the data themselves

It claimed the database was anonymous while a persistent patient ID plus birth year, sex, diagnoses and location could single individuals out.

It processed health data with no appropriate legal basis and without adequately informing the patients.

It set no retention limits, letting records accumulate from 2001 to the inspection.

It skipped the required impact assessment and adequate security, and never formalised the GPs as processors.

Its automatic scrubbing failed: free-text fields kept names, tax codes and addresses for about 3,370 patients, forcing its own breach notification.

Calling a dataset 'anonymised' doesn't make it so: a persistent patient ID plus diagnoses and locations is a re-identification kit, and regulators read it that way.

IQVIA has 120 days from the decision to make the processing GDPR-compliant or hand anonymisation to the doctors under Garante-specified safeguards; the EDPB reported the case as a national decision. It comes months after the group's French arm, IQVIA Operations France, was fined €5 million by the CNIL in May 2026 in a parallel dispute over the same 'anonymised' claim.