Who Can Defend Your Anonymised Data?

IQVIA commissioned two assessments that rated its Italian patient database a low risk for re-identification. Italy’s data protection authority fined the company €7 million regardless. It also read those assessments as a sign of who was in charge.

The case concerns health records, but the lesson travels. Any organisation that buys, sells or builds on anonymised data relies on the claim IQVIA made. The Garante has now shown how a regulator tests that claim.

What the Garante found in the anonymised data

IQVIA Solutions Italy ran a database with health information on one million patients of 800 general practitioners, according to the authority’s press release. The records went back to 2001 and fed studies commissioned in part by pharmaceutical companies. An add-on in the doctors’ practice software extracted the records. In return, the doctors received their software licence free of charge.

The company’s position was simple. Names were gone, each patient had a code and the result was anonymised data. On that reading, the GDPR did not apply at all.

The Garante disagreed in decision no. 710 of 23 September 2026. It gave IQVIA 120 days to bring the processing into line if the company wants to continue. Alternatively, the doctors themselves must anonymise the records under safeguards the authority set out. IQVIA has said it reserves the right to appeal, BleepingComputer reports.

A stable code is a name

The patient code stayed the same over time. Consequently, every diagnosis, prescription, test and vaccination for one person lined up behind one identifier. Year of birth, sex and location data sat next to it. The authority held that this combination made it possible to isolate individual patients and re-identify them by reasonable means.

IQVIA pointed to its safeguards. The code itself was a meaningless string. Moreover, an assessment based on k-anonymity had produced a final risk value of 3, which the company called a low threshold. Neither argument held. Hashing an identifier makes it unreadable, the Garante said, but it does not remove what makes a record unique. K-anonymity, meanwhile, works on a subset of the attributes and can leave a residual risk of singling a person out.

One sentence in the decision deserves a place in every data strategy. The ability to re-identify is enough, whether or not the company ever intended to use it.

Why the risk score did not help

So what does a regulator ask instead of a score? The decision applies three tests to any claim of anonymised data:

• Singling out. Can one person be isolated within the group?
• Linkability. Can a record be linked to other data about the same person?
• Inference. Can new information about a person be deduced?

A dataset that fails one of them is not anonymised data. It is pseudonymised, and pseudonymised data is personal data. The full GDPR then applies, which is where IQVIA’s problems multiplied. The authority found no adequate legal basis, no proper information for patients, no retention periods, no impact assessment and inadequate security.

Whoever designs the pipeline owns it

IQVIA described itself as a mere technological, financial and operational partner. In its account, the doctors’ professional society led the project. The Garante looked at the facts instead. IQVIA chose the add-on, paid the software company, owned the database and used it for its own business. It had also commissioned the two risk assessments from a company in its own group. Together, those facts pointed to a controller, from the moment of collection in the doctor’s practice.

That finding closed off one of the company’s main legal arguments. The Court of Justice gave its SRB ruling in September 2025. On the Garante’s reading, pseudonymised data need not be personal data for a recipient who cannot re-identify anyone. However, the Garante held that IQVIA was no mere recipient. A company that designs the whole flow cannot stand at the end of it and claim to see only anonymised data.

Free text defeats the filter

The plainest failure sat in the free-text fields. Doctors typed identifying details into them. The add-on did not strip those fields, and IQVIA had not verified what the tool extracted. As a result, the database held direct identifiers for 3,370 patients, with health information attached for 3,080 of them.

In other words, the anonymised data contained names, tax codes and addresses.

What this means for your anonymised data

A million patient files is an unusual asset. The structure, though, is familiar well beyond healthcare. A supplier delivers a dataset with the names removed. A contract calls it anonymised data. An analytics dashboard or an AI project is then built on top. After this decision, three questions belong in that conversation.

First, who can defend the label? Anonymised data is a conclusion that someone must be able to argue in front of a regulator. It is not a property a supplier can assign. So ask which of the three tests the dataset passes, and who checked.

Second, does a stable identifier survive in the anonymised data? A code that follows one person across years of records does the work of a name, however it was generated.

Third, what flows in through free-text fields, and who verified the extraction? In the IQVIA case, nobody had.

Roles follow design, not paperwork

There is a governance point as well. The role IQVIA gave itself on paper did not decide who was responsible; the design decisions did. The same logic ran through the Swedish fine we covered in Supplier Security Is Not A Brand Name. There, a supplier’s missing version check exposed data on about 2.2 million people. It also extends the argument we made on model provenance: a vendor’s reassurance is no substitute for evidence.

Meanwhile, the guidance is moving. The European Data Protection Board adopted new guidelines on anonymisation in July, and its public consultation runs until 30 October 2026. The Garante cites them in support of the same three tests. Therefore, an assessment of anonymised data written before this summer may deserve a second look.

That leaves one question for the next board meeting. For which datasets does the organisation rely on anonymised data, and who could defend that word if a regulator asked?