[Enforcement library](/enforcement)

# IQVIA Italy: a persistent patient identifier did not make health records anonymous

The Italian authority imposed a EUR 7 million fine after finding that patient records used for analytics were identifiable rather than anonymous.

## Key facts

- **Regulator or court:** Italian Data Protection Authority (Garante)
- **Jurisdiction:** Italy
- **Framework:** GDPR Articles 5, 9, 13, 25, 28 and 35
- **Record date:** 2026-09-23
- **Procedural status:** Administrative fine and corrective requirements; later appeal status not established

The Italian authority imposed a EUR 7 million fine after finding that patient records used for analytics were identifiable rather than anonymous.

Italian Data Protection Authority (Garante) · GDPR Articles 5, 9, 13, 25, 28 and 35 · Decision: 23 September 2026

## The problem

Removing names is insufficient when stable identifiers and detailed attributes still let a recipient distinguish or re-identify patients.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Italian Data Protection Authority (Garante) |
| Jurisdiction | Italy |
| Law | GDPR Articles 5, 9, 13, 25, 28 and 35 |
| Decision date | 23 September 2026 |
| Recorded fine | EUR 7,000,000 |
| Procedural status | Administrative fine and corrective requirements; later appeal status not established |
| Source review | 19 October 2026 |

Primary record: [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en).

## What the authority found

The authority's notice describes records concerning approximately one million patients of 800 general practitioners. It found that persistent identifiers and detailed health and location attributes made patients potentially identifiable. [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en).

The notice reports shortcomings involving legal basis, information, retention, a data protection impact assessment and security. It also describes directly identifying information in part of the database. [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en).

## Outcome and limits

The authority imposed EUR 7,000,000. Its notice gives IQVIA 120 days to bring continued processing into compliance, or describes an alternative in which practitioners independently anonymise the data under specified safeguards. This is a decision snapshot, not verification of later compliance. [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Map stable identifiers and combinations of attributes through clinical exports and analytics jobs.
- Commission an assessment of re-identification risk and purpose-specific retention rather than relying on an 'anonymous' database label.
- Assign owners for the legal basis, patient information, impact assessment and controller/processor arrangements.

## How Inth helps

Code audit can help map reviewed data flows and external destinations.

Inth cannot certify that a clinical dataset is anonymous, approve a legal basis or replace an impact assessment. Website audit does not inspect an internal clinical database.

## Sources and limits

- [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.