In short: on 23 September 2026, Italy's data protection authority (the Garante) fined IQVIA Solutions Italy S.r.l. €7 million over a health research database built from the records of around one million patients of about 800 GPs. It found that IQVIA was the Controller from the point of collection, that the data was pseudonymised rather than anonymous, and that the anonymisation step itself needed a lawful basis, an Article 9 condition and transparency.
In September 2026, the Italian data protection authority (the Garante) fined IQVIA Solutions Italy S.r.l. €7 million (decision no. 710 of 23 September 2026) in relation to its Longitudinal Patient Database (LPD), a health research database built from the records of around 800 Italian GPs.
This is the second European regulator decision against IQVIA this year. I covered CNIL's €5 million fine against IQVIA France a few months ago, and interestingly, the Garante expressly refers to that decision in its own decision. Whilst the Italian decision was made under Italian law, many of the findings mirror the French case, and there are important lessons for health research organisations across the UK and EU.
Background
The LPD is a database IQVIA inherited through a series of corporate acquisitions. It collects data from GPs, and then provides this to pharmaceutical companies to support retrospective observational studies.
Key elements of the process include:
The software – GP practice software was fitted with an add-on that extracted patient data and sent it to IQVIA. The GPs received the software free of charge, paid for by IQVIA.
The data – records for over one million patients, including diagnoses, prescriptions, tests, vaccines and visit dates, all linked by a persistent patient code (the Pat ID) so that each patient could be followed over time.
The safeguards – names and addresses were removed, the date of birth was reduced to month and year, and only the town was retained. IQVIA considered that these safeguards made the data anonymous.
DPIA – a DPIA was 'being drafted' but 'not yet formalised'.
The investigation began with inspections, and IQVIA later notified a personal data breach after discovering identifiable data it was receiving through free text fields.
The Garante found breaches of Articles 5(1)(a), (e) and (f), 5(2), 9, 13, 25, 28, 32 and 35 GDPR.
Controller or Processor?
As in France, controllership was a core consideration. IQVIA argued that it was only a 'technological and financial partner', with the software add-on built by a third-party software supplier and the GPs choosing whether to take part. On that basis it said it simply received data that was already anonymous, and so was not a Controller at all.
The Garante disagreed. The contracts showed that IQVIA owned the database, committed to give the software supplier instructions on how data was to be anonymised, and proposed the specification that supplier signed up to. IQVIA also funded the software and held the relationships with both the GPs and the supplier. The Garante stated:
"...it was IQVIA that determined both the purpose (i.e. the establishment of a flow of data relating to the patients of the GPs]...that allows its LPD database to be fed) and the means of such operations..." (our translation)
The Garante also pointed out that IQVIA's own contracts described it as the Controller.
One consequence was that, because the Garante considered IQVIA was the Controller for the anonymisation step, the GPs were acting on its behalf, and the Garante found that IQVIA should have appointed them as Processors under Article 28.
What this means
This is the same conclusion reached by the CNIL. Controllership is about who decides the "why" and the "how". If you commission, fund and specify a data extraction tool because you want the data for your own purposes, you are unlikely to be seen as uninvolved in determining why and how the processing takes place, even where others designed or operate the technology.
Organisations should also check that the roles they have documented, including any Processor arrangements down the supply chain, reflect how the project actually works.
Pseudonymised or Anonymised?
IQVIA also relied on the Single Resolution Board (SRB) judgment (Case C-413/23 P), arguing that it had no reasonable means of re-identifying patients, so the data was not personal data in its hands. This was based on the removal of direct identifiers, the generalised birth date, and the fact that the key linking the Pat ID to a patient sat in the GP's system, which it could not access.
The Garante did not agree with this.
First, IQVIA was not just a recipient of the data. It was the Controller from the point of collection and had played an active role in defining the anonymisation measures. The SRB judgment calls for a case-by-case assessment of the recipient's position, and does not mean that pseudonymised data is never personal data, so it did not assist IQVIA.
Second, the dataset itself was too rich. The Pat ID allowed each patient to be tracked, and IQVIA had itself demonstrated a patient appearing 34 times, allowing their clinical history to be followed.
Whilst k-anonymity assessments and hashing of the Pat ID had been applied, the Garante considered that given the detail within the dataset, these did not sufficiently remove the risk of re-identification through singling out, linkability and inference. It was also clear that intent is not the test:
"...the data processed by the IQVIA company bear a very significant informational asset that, thanks to the same PAT ID attributed to each patient of the GP] allows a longitudinal monitoring of each patient who by reasonable means could be re-identified regardless of the actual intention of IQVIA to re-identify such patients. It is sufficient that it has the capacity to re-identify them, by reasonable means, so that the data in question are to be classified as personal data" (our translation)
What this means
A large record-level health dataset is difficult to describe as anonymous, however many direct identifiers have been removed. A re-identification assessment which only looks at the quasi-identifiers is unlikely to be enough.
The SRB judgment is not binding in the UK, but the practical lesson is the same. If you rely on a recipient-based argument, be ready to show that you are genuinely in that position, rather than being involved in designing the anonymisation yourself.
Anonymisation Is Itself Processing
The decision also reconfirms that even if the data had ended up truly anonymous, the act of anonymising personal data is itself processing. It therefore needs a lawful basis, an Article 9 condition for health data, and transparency for data subjects.
The Garante considered:
Contract – the contract between IQVIA and the GPs could not be the basis for processing. Patients were not party to it, and in any event no Article 9(2) condition was identified.
Consent – no consent had been obtained from patients.
Transparency – the GP contract required GPs to tell patients that their data would be anonymised, but IQVIA could not rely on that. As Controller, it had to meet Article 13 itself, and the information given did not contain all the required parts of Article 13.
This aligns with the CNIL's finding that transparency cannot simply be delegated to the organisations collecting the data.
What this means
The argument that "we anonymise the data, so the GDPR does not apply" fails if the anonymisation is carried out by you, on identifiable data, for your own purposes. The anonymisation step needs to be mapped, justified and explained to patients like any other processing operation.
UK organisations should also consider the Common Law Duty of Confidentiality. A commercial contract with a GP practice is unlikely to be sufficient on its own to justify taking confidential patient information to build a research database. In England and Wales, where there is no consent or other legal basis for setting confidentiality aside, support from the Confidentiality Advisory Group under section 251 of the NHS Act 2006 is usually needed.
The Free-Text Fields Breach
One other area of review was the breach IQVIA itself notified. The add-on was supposed to strip identifying information before data left the GP system, but it also extracted the free-text fields. Some GPs had entered names, dates of birth, tax codes, addresses, email addresses and phone numbers there.
After review, it was found that IQVIA had received directly identifiable data for 3,370 patients, including health data for 3,080 of them.
IQVIA argued that the GPs had misused the fields and that it had believed the data was anonymous. The Garante did not accept this, as it considered that GPs record information in free text for care purposes, so it could not be treated as an error on their part. Because IQVIA specified the extraction, the responsibility lay with it for not checking that the add-on excluded fields which were not relevant to the project.
The Garante also criticised IQVIA for passively accepting the anonymous nature of the data. It relied on general re-identification assessments, without testing the supplier's software against objective, measurable criteria. This led to findings against it under Articles 5(1)(f), 5(2), 25 and 32.
What this means
Free text is a well-known risk in health data. If you commission a tool to extract data, you inherit the responsibility for what it actually extracts.
Controllers should be able to evidence ongoing testing of the pipeline, not just the design. A risk assessment of the dataset is not a substitute for checking the software that feeds it.
Acquisitions of Platforms and Systems
There were also findings to which any business acquiring pre-existing platforms or companies should pay particular attention.
Retention. IQVIA was not aware of a deletion policy for the LPD and had not considered deleting older data, some of which dated back to 2001. The retention policy it produced post-dated the inspections and covered administrative, tax and legal records rather than the database. IQVIA said that studies did not generally use data more than ten years old, but the Garante found a breach of the storage limitation principle because no procedures had been defined to delete data that was no longer needed. IQVIA has since set a ten-year retention period. Longitudinal research can justify keeping data for a long time, but that period needs to be defined and justified.
DPIA. IQVIA had only started a draft DPIA and had not completed it. It argued that processing had begun before the GDPR applied, so it was not caught. The Garante found a breach of Article 35 regardless. Health data about patients, processed at large scale, is a clear case where a DPIA is required.
More broadly, the Garante stressed that the obligation to maintain, verify and update measures applies to existing systems, including those designed before the GDPR came into force.
What this means
When acquiring platforms or companies, appropriate due diligence should be carried out, with reviews at relevant points, rather than assuming that everything was set up correctly initially.
The Garante's Next Steps
This is a particularly interesting part of the decision. GPs stopped sending data to IQVIA in 2023, which the Garante took into account when setting the fine, so the question is what IQVIA must do if it wants to restart.
The Garante stated that if IQVIA wants to continue the activity, it must within 120 days identify a lawful basis (including for anonymisation), meet its Article 13 obligations, complete a DPIA and appoint the GPs as Processors.
Alternatively, the anonymisation can be carried out by the GPs themselves, as Controllers with their own legal basis and transparency duties, subject to the following conditions:
Independent pseudonymisation – the GPs, not IQVIA, determine how identifiers are pseudonymised, using a documented random element so the code is meaningless to IQVIA.
Equivalence classes of at least 10 – the quasi-identifiers and their generalisation can be agreed in advance, but each resulting class must contain at least 10 individuals.
Assessing everything else – any remaining variable that IQVIA could observe or measure and that might contribute to identification must either be added to the quasi-identifiers (keeping classes of at least 10), processed using distributed techniques such as secure multiparty computation, or removed.
Onward sharing – if IQVIA passes the data on, the same requirements apply to it as the sender.
What this means
This is specific to the facts of this case and should not be treated as a general standard. However, it offers a useful perspective: if IQVIA wants to continue with the dataset "as is", it must undertake all its operations as Controller and put in place the appropriate controls. If it does not want to be Controller for this processing, it needs to hand responsibility for the pseudonymisation process to the GPs and accept that it will receive a less rich dataset.
Conclusion
Alongside the CNIL's recent decision in France, the Italian case shows two regulators reaching very similar opinions in relation to similar processing, even though the French case also turned on French-specific requirements such as CNIL authorisations and the MR-004 methodology. Controllership follows the facts, pseudonymised health data is hard to treat as anonymous, and responsibility for transparency and security stays with the Controller whatever the contracts say.
The decision also offers an interesting alternative approach. However, it is hard to see how it would be commercially viable for private health research companies, with each GP needing its own legal basis and transparency arrangements, and classes of at least 10 reducing the detail available.
The case also turns on the specifics of this operation and on Italian law, and there are further scenarios that could impact the roles of the parties involved. Whether you are setting up a new health research project or want to review the set-up of a current programme, now would be the perfect time to do so following these two decisions.
IQVIA Italy Fine: Common Questions
Why did the Garante fine IQVIA €7 million?
The Garante found that IQVIA processed health data about around one million patients of roughly 800 Italian GPs without a lawful basis, without adequate patient information, without defined retention periods, without a completed DPIA, without appropriate security testing and without appointing the GPs as Processors, while wrongly treating the data as anonymous.
Was the IQVIA Italy data anonymous?
No. The Garante held that it was pseudonymised personal data. A persistent patient code let each patient be followed over time and, combined with detailed clinical data, allowed patients to be singled out and re-identified by reasonable means. The capacity to re-identify was enough, whatever IQVIA intended.
Is anonymising personal data itself processing under the GDPR?
Yes. Even where the end result is anonymous, the act of anonymising personal data is processing. It needs a lawful basis, an Article 9 condition for health data, and transparency for the people whose data is used.
How does the Italian decision compare with the CNIL's IQVIA fine?
Both regulators found that IQVIA was the Controller for collecting data into its research databases, both rejected the argument that the pseudonymised health data was anonymous, and both held that transparency could not be left to the organisations supplying the data. The CNIL fined IQVIA's French subsidiary €5 million in May 2026, and the Garante cited that decision.
What should UK health research organisations take from the decision?
The decision is not binding in the UK, but UK GDPR applies the same principles. Check that documented roles match how the project works, test extraction tools for free text, define retention periods, complete DPIAs, carry out data protection due diligence on acquired platforms, and consider the Common Law Duty of Confidentiality.
Iniver provides outsourced DPO services and GDPR guidance for health research and life sciences organisations, including controllership, anonymisation and privacy-by-design questions of exactly this kind.
Joe Stock LLM, Managing Director, Iniver. Joe has over 14 years' experience in data protection across in-house and consultancy roles. Before founding Iniver he was Director of Data Protection at a consultancy firm. He holds a Master's in Information Rights Law and Practice.