Italy fines IQVIA €7 million over patient data anonymization issues
Understand this event
On September 23, 2026, Italy’s data protection authority, Garante, issued Decision No. 710, fining IQVIA Solutions Italy €7 million. The decision was published on October 2. Reports on October 3–4 said that the LPD database it built using prescription and diagnosis records from about 800 family doctors still contained personal data: fixed 22-digit patient identifiers retained uniqueness and could not constitute anonymization. The company was also found to have processed health data without a legal basis, failed to inform patients, lacked a deletion policy, and failed to conduct an impact assessment, among other issues. It was ordered to remedy the violations within 120 days. A new report on October 11 further said that about 1 million patients were affected and that the patient codes in continued use could be used to trace medical histories. IQVIA was a controller from the data collection stage and could not claim exemption as a recipient of anonymized data.
AI 根据报道生成 · 4 days ago更新
Impact and actions
AI compilation of public coverage, separating facts, inference and scenarios. Verify rules against the original sources.
Italy fines IQVIA €7 million: fixed patient codes do not equal anonymization
First update · Latest update (Beijing time)
Impact level
🟡 Consider
⚠ Risk:This case involves health data and cannot be directly extrapolated to mean that all ordinary e-commerce data practices are unlawful or that all platforms have changed their rules.
Deadline / window:120 days [1]
What happened
According to reports, Italy’s Garante issued its decision on September 23, 2026, and published it on October 2, fining IQVIA €7 million. Its database involved about 1 million patients and 800 family doctors. The regulator found that fixed codes combined with medical histories and other information could still identify individuals, and that IQVIA had been a controller from the data collection stage onward. Remediation is required within 120 days for continued use; the date from which that period runs is unknown, so the current deadline needs verification. [1]
Seller impact
- InferenceFor businesses that commission the design of data collection or anonymization processes, this case suggests that merely removing names while retaining fixed codes may not be enough to avoid liability. Compliance responsibility depends on actual control and the ability to re-identify individuals. We recommend reviewing these vendors’ basis for anonymization over the next two weeks; any additional costs are unknown. [1]
Suggested action
If you engage a vendor to process personal data, check whether its anonymization assessment covers fixed identifiers, cross-record linkage, and its own control over the data collection process.
Evidence that would disprove the assessment
- Assessment 1：This assessment should be revised if a later court ruling overturns the findings on controllership or re-identification, or if an evaluation of the relevant processes shows that individuals cannot be re-identified by reasonably available means.
Coverage timeline
Follow coverage to understand different perspectives.
- PPC Land advertising and platform updatesOriginal ↗Italian privacy regulator fines IQVIA €7 million, rejecting its claim that data on one million patients were anonymized
Italy’s data protection authority, Garante, fined IQVIA Solutions Italy €7 million, finding that it unlawfully processed the health data of about 1 million patients. The decision was issued on September 23, 2026, and published on October 2. It found that patient codes in continued use could be used to trace medical histories and that IQVIA was a controller from the data collection stage, so it could not claim exemption as a recipient of anonymized data.
- PPC Land advertising and platform updatesOriginal ↗Italy fines IQVIA €7 million over the failure to anonymize patient records
Italy’s data protection authority found that IQVIA Solutions Italy’s “anonymous” patient database could in fact be reidentified and fined the company €7 million. The authority said that fixed 22-digit patient identifiers retained uniqueness and therefore could not constitute anonymization. IQVIA was also found to have processed health data without a legal basis, failed to inform patients, lacked a deletion policy, and failed to conduct an impact assessment, among other issues. It was ordered to remedy the violations within 120 days.
- PPC Land advertising and platform updatesOriginal ↗Italy fines IQVIA €7 million over health data of about one million patients
Italy’s data protection authority, Garante, adopted Decision No. 710 on September 23 and published it on October 2, finding that the LPD database IQVIA Solutions Italy built using prescription and diagnosis records from about 800 family doctors still contained personal data, contrary to the company’s claim that the data were anonymous. It fined the company €7 million.
Interest trend for this event
Current interest 3·Comparable scope peak 10（10/11 05:00）·Change over 24 hours within comparable scope -51%
Trends compare the same continuously observed entities, which may be fewer than the current interest count. Move the pointer or select the chart to see hourly values; use arrow keys to navigate.