IQVIA Italy: a persistent patient identifier did not make health records anonymous
The Italian authority imposed a EUR 7 million fine after finding that patient records used for analytics were identifiable rather than anonymous.
The problem
Removing names is insufficient when stable identifiers and detailed attributes still let a recipient distinguish or re-identify patients.
€7m
- Regulator or court
- Italian Data Protection Authority (Garante)
- Jurisdiction
- Italy
- Framework
- GDPR Articles 5, 9, 13, 25, 28 and 35
- Decision
- Procedural status
- Administrative fine and corrective requirements; later appeal status not established
Sensitive context in event data · Undisclosed data exchanges
Case record
- Italian Data Protection Authority (Garante)
- Italy
- GDPR Articles 5, 9, 13, 25, 28 and 35
- 23 September 2026
- EUR 7,000,000
- Administrative fine and corrective requirements; later appeal status not established
- 19 October 2026
Primary record: Garante notice published on EDPB.
What the authority found
The authority’s notice describes records concerning approximately one million patients of 800 general practitioners. It found that persistent identifiers and detailed health and location attributes made patients potentially identifiable. Garante notice published on EDPB.
The notice reports shortcomings involving legal basis, information, retention, a data protection impact assessment and security. It also describes directly identifying information in part of the database. Garante notice published on EDPB.
Outcome and limits
The authority imposed EUR 7,000,000. Its notice gives IQVIA 120 days to bring continued processing into compliance, or describes an alternative in which practitioners independently anonymise the data under specified safeguards. This is a decision snapshot, not verification of later compliance. Garante notice published on EDPB.
Checks for your own systems
These are implementation checks suggested by Inth, not additional findings about the company.
- Map stable identifiers and combinations of attributes through clinical exports and analytics jobs.
- Commission an assessment of re-identification risk and purpose-specific retention rather than relying on an 'anonymous' database label.
- Assign owners for the legal basis, patient information, impact assessment and controller/processor arrangements.
How Inth helps
Code audit can help map reviewed data flows and external destinations.
Inth cannot certify that a clinical dataset is anonymous, approve a legal basis or replace an impact assessment. Website audit does not inspect an internal clinical database.
Sources and limits
Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.