"We removed the names, so it is anonymous." It is one of the most common sentences in data protection, and Italy's data protection authority, the Garante, has just put a €7 million price tag on it.
The Garante's decision (no. 710 of 23 September 2026, announced on 2 October) concerns IQVIA Solutions Italy. The company held a database containing health information on about one million patients of around 800 general practitioners, used for studies commissioned partly by pharmaceutical companies. IQVIA said the data was anonymous. The Garante disagreed.
Why it was not anonymous
According to the Garante, the code attached to each patient made it possible to follow that person over time. Combined with detailed information such as birth year, sex, diagnoses, symptoms, prescriptions, tests, vaccinations and location data, individuals could be singled out and re-identified by reasonable means. The data was therefore personal data, and the full weight of the GDPR applied.
The Garante went on to list other failings. It found no defined retention period for the database, which held data from 2001 even though IQVIA said its studies used data no older than ten years. It found no adequate legal basis for processing health data, and that patients had not been properly informed. IQVIA had never carried out a data protection impact assessment, arguing that none was needed because the processing began before the GDPR applied; the Garante rejected that, saying existing systems must be reviewed and adjusted too (Article 25). It also found the security measures inadequate, and treated IQVIA as the controller from the point the data was collected at the doctors' surgeries.
Separately, free-text fields in the database exposed identifying details, including names, tax codes, addresses and contact details, for 3,370 patients, 3,080 of whom also had health data (the Garante's press release rounds this to "over 3,300"). The Garante linked this to a data breach the company had notified, which was folded into the same proceeding.
IQVIA has 120 days to bring the processing into line if it wants to continue the activity. That means identifying a legal basis, informing patients, carrying out an impact assessment and appointing the doctors as processors. Alternatively, the doctors must anonymise the data at source under the safeguards the Garante has set out. In setting the fine the Garante weighed the number of patients, the nature of the data, the fact that the doctors stopped sending data from 2023, and the company's cooperation. PPC Land reports that, under Italian law, IQVIA could settle by paying half the fine (€3.5 million) within the appeal period, and that an appeal must be filed within 30 days. We have not seen any public statement from IQVIA.
The key distinction
Pseudonymised data has had direct identifiers, such as names, replaced, but can still be linked back to a person with additional information or by following patterns. It remains personal data. UK GDPR and EU GDPR treat it the same way.
Anonymous data cannot reasonably be linked to a person by anyone likely to try. True anonymisation is hard, especially for rich health data, because combinations of age, location, dates and conditions can identify someone. Recital 26 of the UK GDPR says to look at all the means "reasonably likely to be used" to identify a person, which is exactly the test the Garante applied.
What UK organisations should take from this
The decision is not binding in the UK, but it is a clear illustration of how a European regulator reads a test that also applies here. Many UK organisations share or receive data from EU partners, and many describe data as anonymous because names were removed. The risk is the same whether the data is patients, customers, pupils or website visitors.
A worked example
A retailer shares "anonymised" loyalty data with an analytics firm. Names and emails are removed, but each record keeps a customer ID, a postcode district, a date of birth and a list of purchases. A customer with a rare purchase pattern in a small postcode could easily be picked out. The retailer's description of the data as "anonymous" would not survive a challenge. A short test, asking "could someone with the data and a few other sources identify a person?", would have caught it before the file was sent. (An invented example, for illustration.)
A practical checklist
- List every dataset you describe as anonymous or de-identified. For each, record who did the de-identification and how.
- Ask whether a persistent ID, a postcode, a date of birth or a rare combination of attributes remains. If so, treat the data as personal.
- Carry out a DPIA for any project that creates a research, analytics or product-improvement dataset from health or customer records.
- Set and apply retention periods. Data kept from 2001 needs a reason.
- Check contracts. If another organisation prepares or holds data for you, work out who is controller and who is processor.
- Re-test regularly. Anonymisation is not a one-off label, because what can be linked changes as other data becomes available.
Frequently asked questions
Is pseudonymised data personal data? Yes. It lowers risk but does not remove it from data protection law.
Can I ever use truly anonymous data freely? If it genuinely cannot identify anyone, data protection law does not apply to it. The difficulty is proving that.
Does this apply to non-health data? Yes. The test applies to any personal data, though health data is a special category and carries higher expectations.
Does an Italian decision apply in the UK? Not directly. It shows how a European regulator applies a principle that also exists in the UK GDPR.
How Pathway 2 Privacy can help: a DPIA gives you a documented answer on whether data is really anonymous, Data Protection by Design support builds de-identification into new projects, and a Policy Review brings your retention and sharing rules in line with what you actually do. See our data protection support for healthcare and retail, or start with a free data protection review.
Sources: Garante press release, 2 Oct 2026 (Italian); PPC Land; Cybersecurity360 (Italian); UK GDPR Recital 26 (legislation.gov.uk).
