Developing
The decision can be appealed. No public statement from IQVIA appears in the sources.
In 60 seconds
- The Garante's decision no. 710 was adopted on September 23, 2026 and announced on October 2.
- Each patient carried a persistent code, so records could be followed over time; one patient appeared 34 times in the prescriptions table.
- The Garante found IQVIA was the controller from collection and listed failures including no legal basis, no patient information, no retention period and no impact assessment.
- IQVIA must within 120 days fix its legal basis, patient information, impact assessment and processor appointments, or stop.
Impact Layer
- What changed
- A regulator rejected the claim that hashed, persistent patient codes make data anonymous.
- Why it matters
- Marketers and data teams buying or sharing "anonymised" datasets cannot rely on the label alone.
- Who is affected
- Health data vendors, pharma marketers, and anyone using pseudonymised data for audiences or analytics.
- Martech stack area
- Data
- Stack impact
- Ask data suppliers how they test for singling-out, who the controller is at the point of collection and what legal basis applies.
- Business impact
- High Based on PPC Land's reading of the decision and press release. Several dates in the decision are redacted, and the turnover figure behind the fine is not public.
- Related technologies
- What to watch
- Whether IQVIA pays (half if paid within the appeal window), settles or appeals.
Italy’s data protection authority, the Garante, fined IQVIA Solutions Italy S.r.l. EUR 7 million. Decision no. 710 was adopted on September 23, 2026 and announced on October 2, according to PPC Land. The database held records of about one million patients from roughly 800 general practitioners.
Why the data was not anonymous
- Each patient carried a persistent code (a 22-character UUID), so records could be followed over time. One patient appeared 34 times in the prescriptions table.
- The Garante found hashing does not remove singularity, and k-anonymity applies only to quasi-identifiers.
- IQVIA relied on assessments from a group company; the Garante said it accepted them “passively” and did not quantify single-out cases.
Controller and breaches
The Garante held that IQVIA was the controller “from the collection of the data”, not a mere recipient. It listed failures including no valid legal basis, no patient information, no retention period, inadequate security, no processor appointments for the doctors and no impact assessment. A free-text extraction exposed direct identifiers of 3,370 patients, 3,080 of whom also had health data.
The order
If IQVIA continues, within 120 days it must identify a valid legal basis, inform patients, carry out an impact assessment and appoint the doctors as processors, then report back. The fine is payable within 30 days, or half (EUR 3.5 million) if paid within the appeal deadline. IQVIA’s French subsidiary was fined EUR 5 million by the CNIL on May 26, 2026.
Our read
“Anonymised” is a claim you can test. If a record can be followed over time, assume it is personal data until the supplier shows otherwise.
Sources
- PPC Land: Italy's Garante fines IQVIA EUR 7m over data on 1m patients it called anonymous (opens in a new tab)
Source of the decision, reasoning, corrective orders and discrepancies.