TL;DR
By decision no. 710 of 23 September 2026, announced on 2 October, the Italian Garante fined IQVIA Solutions Italy €7 million. The database fed by the practice software of about 800 GPs held the clinical history of about one million patients. It was not anonymous: each patient had a stable code allowing them to be tracked over time. IQVIA was found to be controller from the point of collection. Infringements: legal basis and Article 9 condition, information, retention (data going back to 2001), failure to appoint the GPs as processors, no DPIA, security. 120 days to comply; the company says it reserves the right to appeal.
What happened
An add-on installed in GPs' practice management software extracted patient data and sent it to the company's database: year of birth, sex, marital status, visits, diagnoses, symptoms, allergies, weight, prescriptions, vaccines, tests, sick-leave certificates, plus location data. In return the doctors received the software subscription. The data fed observational studies requested by pharmaceutical companies and delivered in aggregate form. The inspections took place in April 2025. Meanwhile the company notified a breach: names, tax codes and contact details of 3,370 patients had ended up in free-text fields, for 3,080 of them together with health data.
Why the data were not anonymous
- THE STABLE CODE. Each patient kept the same identifier throughout the collection: that was precisely its purpose, to follow them over time. It is the condition that lets a person be singled out of a group, the first of the three anonymisation criteria.
- k-ANONYMITY IS NOT ENOUGH. The constraint applied only to quasi-identifiers. But a sequence of diagnoses, admissions and medicines observed over years is itself an identifier: large equivalence classes are useless if the rest of the record is unique.
- HASHING DOES NOT REMOVE UNIQUENESS. Hashing the code makes the identity unreadable but keeps the one-to-one link between a record and a person intact: it is designed to do exactly that.
- NOT A MERE RECIPIENT. The Court of Justice's SRB judgment (C-413/23, 4 September 2025) says pseudonymised data may not be personal for a recipient who cannot remove the measures. IQVIA had designed those measures: it was controller from collection, and the ability to re-identify by reasonable means is enough.
Anonymising is processing
This is the point that applies to everyone. Anonymisation is processing of personal data and needs a legal basis. The contract with the doctors could not be one for the patients, who were not party to it; for health data an Article 9 condition was also needed, and there was none. The information notice, delegated to the doctors, lacked the Article 13 elements. And the doctors, who did not decide the purposes and means of the operation, should have been appointed processors under Article 28: the Garante found that infringement too.
The other infringements and the fine
No retention period: the oldest data went back to 2001, although the company said studies do not need data older than ten years; the policy it produced covered administrative and tax documents. No impact assessment, inadequate security measures. The company has 120 days to bring the processing into line if it wants to continue; otherwise anonymisation must be carried out by the doctors themselves, with the safeguards set by the Garante. The amount reflects the number of patients and the nature of the data, but also the halt in transfers from 2023 and the company's cooperation. On 26 May 2026 the CNIL had fined the group's French company €5 million, reaching the same conclusion: pseudonymised does not mean anonymous.
What it means for a DPO
Five checks
First: any dataset a client calls 'anonymous' should be checked for two things — a stable identifier and rich content. If both are there, it is pseudonymised and belongs in the record as processing of personal data. Second: whoever designs the anonymisation is its controller and needs a legal basis, with Article 9 for health data. Third: free-text fields are where names leak; test them on real data before extraction. Fourth: research databases also need a written retention period. Fifth: large-scale health data needs a DPIA before, not after. In DPO Workspace a processing activity with special categories and no Article 9 condition cannot be activated.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
