On 2 October 2026, the Italian data protection authority Garante announced a €7 million fine against IQVIA Solutions Italy S.r.l. for processing the health data of around one million patients, collected through around 800 general practitioners (GPs) and used for studies commissioned, among others, by pharmaceutical companies.
For the Garante, the data were not anonymous, contrary to what IQVIA claimed. The code assigned to each patient made it possible to follow them over time and, due to the combination with additional detailed information, it made it possible to single out individual patients and, by reasonable means, to re-identify them.
The interesting aspect of this decision is how the Garante deals with the CJEU's SRB judgment (see our previous article on this judgment), on which IQVIA built much of its defence. It is a clear reminder that SRB is not a shortcut to anonymity, and that a precise test has to be passed before claiming that a database is fully anonymous.
How the Database Worked
IQVIA ran a database called LPD (Longitudinal Patient Data), used for observational studies. The data flow worked as follows:
- The GPs used practice management software provided free of charge, with the licence paid by IQVIA.
- An add-on, built by the software house on IQVIA's instructions, extracted patient records and sent them encrypted to IQVIA.
- Before sending, the add-on removed names and addresses, reduced the date of birth to month and year, and replaced the patient's identity with a random code, the Pat ID.
The Pat ID stayed the same over time, changing only if the patient moved to another GP or the GP replaced their computer, so each patient could be followed across years of visits, diagnoses, prescriptions, vaccinations and tests.
The Data Breach
After the Garante's inspections at IQVIA, the company notified a data breach. Some GPs had written names, tax codes, addresses and phone numbers in the free-text fields of the software, and the add-on did not filter them out. As a result, directly identifying data of 3,370 patients, 3,080 of them together with health data, reached IQVIA.
In the Garante’s view, it was IQVIA's responsibility to check what the add-on actually extracted and removed, not the GP’s.
Why IQVIA Was the Controller
According to the Garante, IQVIA owned the database, paid for the software, contracted with both the GPs and the software house, appointed the latter as its processor, instructed it on how to anonymise the data and commissioned the risk assessments.
The anonymisation was therefore carried out solely for IQVIA's benefit. For this reason, IQVIA was the controller of the whole processing, from collection onwards. For the extraction of the data, the GPs had no decision-making power.
Why the Data Were Not Anonymous
Data are anonymous only if no one, with the means reasonably available, can:
- single out a person within the dataset (singling out)
- link the data to data about the same person held in another dataset (linkability)
- deduce new information about a person from the data (inference)
IQVIA argued that, after the SRB judgment, not all three criteria had to be met. The Garante recalled that if even one criterion fails, further analysis is needed before the data can be considered anonymous.
Here, singling out was possible. IQVIA relied on k-anonymity, a technique that generalises some attributes, such as age or place of residence, so that each combination of them is shared by at least a given number (k) of people. It protects only those attributes, not the rest of the record. A stable Pat ID combined with years of diagnoses, prescriptions and other clinical data can identify a person on its own, and k-anonymity could not prevent that. For the Garante, IQVIA's ability to re-identify patients by reasonable means was enough, regardless of its intention to do so.
The Limits of SRB
In SRB, the CJEU accepted that pseudonymised data may not be personal data for a recipient that cannot reverse the pseudonymisation or identify people by other means. IQVIA argued it was in that position, since it never held the key to the Pat ID.
The Garante disagreed. SRB protects an outside recipient with no influence on the pseudonymisation measures. IQVIA had shaped those measures as controller, so it could not treat the data as objectively anonymous. Not holding the key is not enough. This is not the first time in Europe: see our article on the very similar decision issued by the CNIL against the group's French company.
The other violations followed from the same premise: no adequate legal basis under Art. 9 GDPR, even for the anonymisation itself, inadequate information to patients, no retention periods (some records dated back to 2001), no completed DPIA and inadequate security measures.
Lessons for Anyone Relying on “Anonymous” Data
- Do not over-rely on SRB: it only helps a recipient with no influence on the pseudonymisation.
- Test anonymity against all three criteria and quantify the risk.
- Treat anonymisation as processing: it needs a legal basis, transparency and, where the risk is high, a DPIA. Filter free-text fields before any extraction.
This is, once again, a reminder of how important it is to involve your DPO or privacy counsel whenever a project relies on data being anonymous, both to qualify the role of each party correctly and to verify that the measures in place actually meet the anonymisation threshold.
No comments