The Italian data protection authority has fined IQVIA for creating a health database from allegedly anonymized information, finding that the persistence of a patient code and the richness of the information actually allowed re-identification.

Facts and context

The Italian data protection authority (Garante) today published a sanction decision against IQVIA Solutions Italy S.r.l. including the imposition of a €7,000,000 fine for breaches related to the creation of an allegedly anonymized health database.

The case originated from an investigation initiated following inspections conducted in April 2025, to which a data breach notification by the company itself was added, concerning a database containing information on one million patients from 800 general practitioners.

Grounds for the decision

The authority considered that the company should be qualified as the controller from the moment of data collection from the doctors and noted several violations:

• Lawfulness of processing obligation (Articles 6 and 9 of the GDPR): The authority rejected the company's argument that the data were anonymous. It found that the code associated with each patient allowed tracking over time. This longitudinal tracking, combined with a very detailed set of information (year of birth, sex, diagnoses, prescriptions, tests, etc.), made it possible to isolate individuals and re-identify them with reasonable means. Consequently, the company processed personal health data without a valid legal basis.

• Information obligation (Article 14 of the GDPR): Patients, whose data were collected indirectly via their doctors, were not properly informed about the processing carried out by the company for study purposes, notably for pharmaceutical companies.

• Storage limitation obligation (Article 5 of the GDPR): The company had not defined any retention period for the collected data, some dating back to 2001, in violation of the storage limitation principle.

• Data protection impact assessment obligation (Article 35 of the GDPR): Given the nature of the data processed (health) and the scale of processing (one million people), a data protection impact assessment should have been carried out before starting operations, which was not done.

• Security obligation (Article 32 of the GDPR): The authority found the security measures inadequate, corroborated by the unintentional presence of directly identifying data (names, tax codes, addresses) for more than 3,300 patients in the database.

Authority's decision

Consequently, the authority imposed a €7,000,000 fine on IQVIA Solutions Italy S.r.l.

Furthermore, the authority ordered the company to bring its processing into compliance within 120 days if it wishes to continue its activity. Otherwise, anonymization must be carried out directly by the doctors, according to the guarantees prescribed by the authority.

Lessons learned

This decision reminds that:

• Pseudonymized data, even without direct identifiers, are not considered anonymous if a persistent code allows tracking an individual over time and the richness of the collected information makes re-identification possible by reasonable means.

• An entity that collects data from third parties (here, doctors) and determines the purposes and means for its own studies is qualified as the controller from the moment of collection, not merely as a processor.

• The creation of a large-scale database containing detailed health data systematically requires carrying out a data protection impact assessment before starting processing.