The Italian Data Protection Authority has fined IQVIA Solutions Italy S.r.l. EUR 7,000,000 for unlawful processing of patients' health data, according to a notice published by the European Data Protection Board. The EDPB lists it as a national case and gives 23 September 2026 as the date of the final decision. The full summary is at the EDPB website.

IQVIA Solutions Italy belongs to a multinational group active in health data analytics and clinical research. The investigation concerned a database holding health information on approximately one million patients of 800 general practitioners. The database was used for studies, including studies commissioned by pharmaceutical companies.

The case started with inspections in April 2025. The Italian DPA then joined that investigation with separate proceedings concerning a personal data breach that IQVIA itself had notified. In other words, the company reported an incident, and the regulator used the visit to look at the whole operation. Anyone who has notified a breach and then watched the scope of the questions grow will recognise the pattern.

The central finding is blunt. The data were not anonymous, despite IQVIA's claim that they were. Each patient had been assigned a persistent identifier, and that identifier allowed individuals to be tracked across the dataset. The EDPB summary available at the time of writing cuts off mid sentence on this point, so the exact wording of the DPA's reasoning is not fully reproduced in the notice. The direction is clear enough: a stable key that follows the same person from record to record is pseudonymisation, not anonymisation, and pseudonymised data is still personal data under the GDPR. Health data on top of that is a special category under Article 9.

The EDPB notice lists six GDPR provisions as the legal references for the decision:

• Article 5, the principles relating to processing of personal data
• Article 9, processing of special categories of personal data
• Article 13, information to be provided where data are collected from the data subject
• Article 25, data protection by design and by default
• Article 28, processor obligations
• Article 35, data protection impact assessment

The keywords attached to the decision are data protection impact assessment, health and research, anonymisation and pseudonymisation, privacy by design and by default, fines, basic principles, and controller and processor.

Several things are not in the published summary. It does not describe the notified breach, how the fine was apportioned across the six articles, which processing operations lacked a DPIA, or what the processor arrangements with the pharmaceutical clients looked like. It does not include any statement from IQVIA. Those details, if they are public, sit in the Italian DPA's full decision rather than in the EDPB notice, and this report does not speculate on them.

Why does an identity publication care about a health data fine? Because the thing that sank the anonymity claim is an identifier. Stripping the name column and leaving a persistent patient key in place is the data equivalent of locking the front door and leaving the key taped to it. Identity teams already know this from other contexts. OpenID Connect offers pairwise subject identifiers precisely so a relying party can't correlate the same user across services. Tokenization vaults exist so that a stable surrogate value can be reversed only by the party holding the mapping. The question a regulator asks is the same one an IAM architect should ask of any dataset: can this key, on its own or combined with other data, put a person back together? If yes, it is personal data, and every downstream control (purpose, notice, DPIA, processor contract) still applies.

The encouraging part is that none of this requires new technology. It requires an honest inventory. Most organisations already have the pieces: a data catalogue, a DPIA template, a processor contract register, and identity engineers who understand correlation. The gap is usually that the people who label a dataset "anonymous" and the people who understand identifiers have never been in the same meeting. Fix the meeting and you fix a large share of the risk, at a cost considerably lower than seven million euros.

For identity and security teams, three checks are worth doing now. First, pull the list of datasets your organisation describes as anonymous or de identified and look for any stable, per person key, including hashed values that are reused across records or across time; if one exists, treat the dataset as pseudonymised personal data and confirm a DPIA covers it. Second, review Article 28 processor agreements for any analytics or research partner that receives patient level data, and verify the contract matches what actually flows. Third, confirm that the privacy notice patients receive at the point of collection actually mentions the research and commercial uses the data ends up serving, because Article 13 is listed in this decision for a reason.