In short
In 2026, two IQVIA companies were fined: €5M by the CNIL in France and €7M by the Garante in Italy.
In both cases, IQVIA described its health data as anonymous. The regulators found it was only pseudonymized.
The main reason: a unique identifier for each patient, combined with detailed medical data.
“Our data is anonymous, so the GDPR does not apply.”
That is the argument IQVIA, a multinational health data and analytics group, made to two European regulators in 2026.
Both rejected it.
The result: €12 million in fines for two companies of the group, €5 million in France and €7 million in Italy.
These cases draw a clear line between pseudonymization and anonymization (spelled anonymisation in the EU and the UK).
France: a €5 million fine from the CNIL
On May 26, 2026, the CNIL, France’s data protection authority, fined IQVIA Operations France €5 million.
The company runs two health data warehouses authorized by the CNIL:
- LRX.
Fed with data from about 14,000 pharmacies. - EMR.
Fed with data from several thousand doctors.
They cover tens of millions of people.
The data includes birth year, sex and prescriptions and, for EMR, diagnoses, symptoms, allergies, vaccinations and sick leave.
The CNIL found, among other things:
- Authorizations not respected.
No regular review of access logs, no multi-factor authentication on EMR, and studies carried out without any legal framework. - Patients not informed.
None of the four pharmacies inspected told their customers their data was being shared. - Poorly designed software.
The pharmacy software sent customer data to IQVIA even when customers had objected.
The company has six months to fix some of these issues, or face a penalty of €10,000 per day of delay.
The anonymity argument, rejected
Before the CNIL, IQVIA relied on the SRB ruling of the Court of Justice of the EU (September 4, 2025).
That ruling accepts that pseudonymized data may not be personal data for a recipient with no means of identifying people.
We explain it in our guide to pseudonymization vs anonymization.
The CNIL found that IQVIA’s data was not anonymous, only pseudonymized, for three reasons:
- A unique identifier per patient.
It allowed each person’s care pathway to be tracked. - The depth of the data.
The more detailed a record, the more unique it is. - Possible cross-checking with public data.
Matching with publicly available data could make it possible to identify people.
In other words, the SRB ruling is not a free pass.
It does not make pseudonymized data anonymous for the organization that runs the collection.
Italy: a €7 million fine from the Garante
On October 2, 2026, Italy’s data protection authority, the Garante, announced a €7 million fine against IQVIA Solutions Italy (decision of September 23, 2026).
The case concerned a health database of about one million patients, fed by 800 general practitioners and used for studies, some commissioned by pharmaceutical companies.
The reasoning matched the French one:
- A code attached to each patient, which allowed them to be followed over time.
- Highly detailed data: birth year, sex, diagnoses, symptoms, prescriptions, tests, vaccinations, location data.
- Re-identification possible by reasonable means.
The database even held direct identifiers (names, tax codes, addresses) for more than 3,300 patients.
The Garante also found no appropriate legal basis, inadequate information to patients, no retention period (the data went back to 2001), and no data protection impact assessment.
IQVIA has 120 days to comply if it wants to continue the processing.
Otherwise, the doctors themselves will have to anonymize the data, under safeguards set by the Garante.
IQVIA said it reserves the right to appeal.
Not an isolated case
In France, the CNIL had already fined three companies of the Cegedim group (GERS, Santestat and Cegedim Santé) in 2024, for a total of €1.8 million.
Their databases, fed by doctors’ and pharmacies’ software, identified patients by codes.
The CNIL showed that, with ordinary tools, care pathways could be traced and some people identified, especially for rare treatments.
France’s Council of State upheld these fines on February 13, 2026.
It recalled that data is anonymous only if the risk of re-identification is insignificant, meaning identification is impracticable in practice.
The CNIL had shown concretely that this was not the case, and the companies failed to rebut it.
Key lessons
- A constant identifier is pseudonymization.
Following a patient over time is useful, but the data then remains personal data, with every GDPR obligation. - Detail matters as much as names.
Birth year, sex, town, a rare diagnosis: combined, they point to one person. - Anonymity must be demonstrated.
Risk analysis, method, testing: without documentation, the claim does not hold. The EDPB says the same in its 2026 anonymization guidelines. - De-identify at the source.
This is the alternative the Garante set out: the doctors anonymize the data themselves, before it leaves. A central database then only receives data that is already anonymized. - Software must respect patients’ choices.
An objection must block the transfer: that is data protection by design (Article 25 of the GDPR).
For US and UK readers
The GDPR applies to companies established in the EU, and to companies elsewhere that offer services to people in the EU or monitor their behavior.
Health data exported from the EU also comes with strict transfer rules and contractual obligations.
In the UK, the ICO asks the same question with its “motivated intruder” test: could a determined person identify someone from the data?
Beyond the legal frameworks, the lesson travels: a unique patient key plus detailed records is a re-identification risk wherever the data ends up.
With NymData
NymData de-identifies health data on your own servers, before it is shared:
- Mapping first.
A scan that changes nothing, to see which personal data is present, including in the free text of medical reports. - The method that fits the use.
Anonymization by type ([PERSON], [EMAIL]) when tracking is not needed; a constant identifier when it is, knowing the data then remains pseudonymized. - Audit report.
Every run records what was detected and what was done: a basis for demonstrating your approach.
Frequently asked questions
Why did the CNIL fine IQVIA?
On May 26, 2026, the CNIL fined IQVIA Operations France €5 million over two health data warehouses fed by pharmacies and doctors.
Among other things, it found that the conditions of its authorizations were not met, that patients were not informed, and that security was lacking.
Was IQVIA's data anonymous?
No, according to both the French and the Italian regulators.
Each patient had a unique identifier that allowed their care pathway to be tracked, and the data was detailed: it was only pseudonymized.
Why did the Italian regulator fine IQVIA?
The Garante fined IQVIA Solutions Italy €7 million (decision of September 23, 2026) over a health database covering about one million patients of 800 general practitioners.
It found the data was not anonymous and noted, among other issues, the lack of an appropriate legal basis and of a data protection impact assessment.
Does a patient identifier make data personal data?
Not always on its own, but it links together everything known about the same person.
Combined with detailed data, it makes re-identification possible by reasonable means, so the data remains personal data.
Who has to prove that data is anonymous?
Whoever processes it: under the GDPR's accountability principle (Article 5(2)), they must be able to demonstrate compliance.
In the Cegedim case, France's Council of State held on February 13, 2026 that data is anonymous only if re-identification is impracticable in practice.
Does this matter outside Europe?
Yes, for companies established in the EU or serving patients there, for anyone receiving health data exported from the EU, and as a signal of how regulators test anonymization claims.
A unique patient key plus detailed records is a re-identification risk wherever the data is processed.