Italy's data protection authority has fined health data company IQVIA 7 million euros, about $7.8 million, after finding that a patient database the company treated as anonymous could be used to identify individuals, BleepingComputer reported Monday. The regulator, known as the Garante, also found that IQVIA processed the data without a valid legal basis and without telling patients.

What Happened

The investigation, which began in April 2025, centered on a database built by IQVIA's Italian business from about 1 million patient records supplied by 800 general practitioners. IQVIA replaced patient names with unique codes. The Garante found that those codes allowed individuals to be tracked over time and, combined with the detailed attributes stored alongside them, singled out.

Those attributes included year of birth, sex, diagnoses, symptoms, prescriptions, tests, vaccinations and location data. For about 3,300 patients, the database also held direct identifiers: names, tax identification numbers, addresses and contact details.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

The regulator further found that IQVIA had set no proper retention periods, with records going back to 2001. It concluded that the processing lacked an appropriate legal basis and that patients had not been informed, both breaches of the European Union's General Data Protection Regulation. The decision was announced in late September, and IQVIA has 120 days to carry out the corrective measures it orders.

Why It Matters

The case turns on the difference between anonymized and pseudonymized data. Under the GDPR, data that has truly been anonymized falls outside the law, while pseudonymized data, where identities are masked but can be linked back to a person, remains personal data subject to all its obligations. The Garante's finding is that replacing names with codes is not enough when the remaining record is detailed enough to point to one patient.

That has implications well beyond one company. Primary-care records are a valuable input for pharmaceutical market research and, increasingly, for training AI models, and many such datasets are licensed on the basis that they are anonymous. A regulator testing that claim against the actual contents of a database, rather than the labeling, raises the compliance bar for data brokers and their customers.

IQVIA, a U.S.-based firm that sells health data analytics and clinical research services in more than 100 countries, is one of the largest players in that market.

IQVIA's Response

In a statement to BleepingComputer, IQVIA said it acknowledges the decision and reserves the right to appeal. The company said it maintains robust safeguards, including pseudonymization and encryption, and has already begun adopting measures to align with the regulator's guidance.

IQVIA also said the dataset covered by the decision is not used in its clinical research services and does not relate to trials it runs for sponsors, distancing the case from its contract research business.

What to Watch

The next steps are whether IQVIA files an appeal and how it restructures the database within the 120-day window, including whether it deletes older records or the directly identifying data for the 3,300 patients. Also worth watching is whether other European data protection authorities, which coordinate on GDPR enforcement, apply the same test to primary-care datasets marketed as anonymous in their countries.