Italy’s data protection authority fined IQVIA €7 million after finding that a health database covering about one million patients could be reidentified instead of being truly anonymized. The GPDP said IQVIA’s Italian unit aggregated records from 800 general practitioners and used persistent patient codes alongside detailed fields including birth year, sex, diagnoses, prescriptions, tests, vaccinations, and location data, making de-anonymization possible; a subset of 3,300 records also contained direct identifiers such as names, tax IDs, addresses, and contact details. Regulators also said IQVIA lacked a proper legal basis, failed to inform patients, and kept records dating back to 2001.
Why it matters: This matters to patients, healthcare providers, and privacy teams because data described as anonymized may still expose people if it can be linked back to them. Healthcare organizations and data processors should review anonymization, retention, consent, and legal-basis practices now, especially for longitudinal patient datasets.
Bill Toulas
2026.10.05
100% relevant
This article establishes a new story because it centers on a distinct regulatory action against IQVIA over a specific Italian healthcare data-processing dataset and de-anonymization risk, not an update to an existing tracked event.
← Back to all stories