How Anonymous Is Anonymous Enough? Lessons On Longitudinal Health Data From IQVIA's €7 Million Fine For Data Privacy Violations

Any organization that treats “de-identified” or “anonymized” health datasets as outside the scope of data privacy laws should revisit that assumption now.

Introduction

On October 2, 2026, the Italian Data Protection Authority (the Garante per la Protezione dei Dati Personali, or Garante) announced a decision¹ and accompanying €7 million fine against IQVIA Solutions Italy S.r.l., a wholly-owned subsidiary of IQVIA, the well-known global advanced health information provider. The Garante concluded that the health information of approximately one million patients, housed within an IQVIA database, was not anonymous (as IQVIA had argued ) but, rather, it was personal health data subject to the full weight of the General Data Protection Regulation (GDPR). While this particular decision may only be binding in Italy and is not controlling authority for U.S.-only companies, the inquiries made by the Garante are the same critical questions that HIPAA regulators, the Federal Trade Commission