Italian regulator slaps €7 million penalty on IQVIA over alleged health‑data anonymity lapses

Italy's data protection watchdog, the Garante per la protezione dei dati personali (GPDP), announced a €7 million fine against global health‑data firm IQVIA, citing serious shortcomings in the way the company anonymised patient information. The sanction, equivalent to about $7.8 million, is among the largest ever imposed for violations of the European Union's General Data Protection Regulation (GDPR) in the health sector.

According to the regulator, IQVIA's processing practices fell short of the strict standards required to prevent re‑identification of individuals. The GPDP estimates that roughly one million patients could have been exposed to a heightened risk of their medical records being linked back to them, a scenario that breaches GDPR's core principle of data minimisation and security.

IQVIA, a U.S.-based analytics company, aggregates clinical, prescription and outcomes data from a network of hospitals, pharmacies and research institutions worldwide. The firm markets these datasets to pharmaceutical firms, insurers and public‑health agencies, arguing that the insights help accelerate drug development and improve care pathways. Under GDPR, any personal health information must be rendered effectively anonymous before it can be shared for secondary purposes, a requirement that the GPDP says IQVIA failed to meet.

The investigation, which began after complaints were lodged by privacy advocates, focused on the company's internal de‑identification protocols. Inspectors found that certain data fields—such as dates of service, geographic markers and rare disease codes—were insufficiently masked, creating a plausible route for re‑identification when combined with other public datasets. While the regulator did not disclose whether any actual breaches occurred, it warned that the mere possibility of de‑anonymisation could undermine public confidence in health‑data initiatives.

The fine signals a tightening of enforcement across Europe as authorities grapple with the balance between data‑driven innovation and individual privacy rights. IQVIA has indicated it will cooperate with the GPDP and is reviewing its anonymisation methods, though it has not commented on whether it will appeal the penalty. Industry observers note that the case could prompt broader audits of data‑handling practices in the pharmaceutical and health‑tech sectors, urging firms to adopt more robust technical and organisational safeguards to avoid similar penalties in the future.