Persistent IDs Are Not Anonymous: The €7M IQVIA GDPR Fine

On October 9, 2026, the European Data Protection Board (EDPB) highlighted a major enforcement milestone: the Italian Data Protection Authority (Garante per la protezione dei dati personali) hit health analytics giant IQVIA Solutions Italy S.r.l. with a €7,000,000 administrative fine (Decision No. 710, Docweb 10302141). For European software engineers, CTOs, and AI founders, this decision dismantles a widespread industry myth: that hashing identifiers or replacing user names with a persistent token creates "anonymous data" exempt from the GDPR.

Under EU data protection law, persistent identifiers tied to behavioral, diagnostic, or longitudinal telemetry constitute pseudonymised personal data, not anonymous data. Treating pseudonymised records as anonymous bypasses mandatory consent, skips required DPIA risk assessments, and creates immediate exposure under GDPR Article 83(5) to statutory fines of up to €20 million or 4% of global annual turnover.

---

What did the Italian DPA rule against IQVIA?

IQVIA built and operated a massive Longitudinal Patient Data (LPD) system containing health records from roughly 1,000,000 Italian patients collected through 800 general practitioners (GPs). IQVIA marketed this database to pharmaceutical clients and analytics teams as fully "anonymised" research data.

To strip direct identities, IQVIA assigned each patient a persistent numeric code (Pat ID) generated by practice management software. Direct identifiers—names, social security numbers, and contact details—were supposedly scrubbed before export.

The Garante rejected this characterization entirely. The authority found that:

1. Persistent tracking prevents anonymisation: A constant identifier mapped across multiple doctor visits enables longitudinal tracking over years. Combined with demographic data (year of birth, gender, geographic location) and medical events (prescriptions, diagnoses, treatment dates), the data allows individuals to be singled out.
2. Reasonably available means create re-identification risk: Under Recital 26 of the GDPR, determining whether an individual is identifiable requires accounting for all means reasonably likely to be used by any person. An external actor, an employer, or an insurer possessing partial external records could easily cross-reference the dataset and re-identify patients.
3. Unsanitized free-text fields leaked direct PII: Software used by doctors contained free-text symptom notes. Doctors inadvertently entered actual patient names, phone numbers, and fiscal codes into these fields. IQVIA ingested and processed unencrypted direct personal data for approximately 3,370 patients (including health data for 3,080 individuals) without detection.
4. Unlawful retention since 2001: IQVIA retained records spanning more than two decades without valid retention schedules or justification under Article 5(1)(e).

In addition to the €7,000,000 fine, the Garante issued a strict compliance injunction: IQVIA must bring all operations into full GDPR compliance within 120 days or cease processing.

---

Why are hashed user IDs and telemetry legally pseudonymised, not anonymous?

This decision strikes at common engineering practices across European B2B SaaS, mobile applications, and AI pipelines. Technical teams frequently state:

"We hash user_id with SHA-256 and remove email addresses before pushing event logs into our vector database or analytical warehouse. Therefore, our logs are anonymous and outside the GDPR."

This assumption is legally incorrect.

According to GDPR Article 4(5), pseudonymisation is the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information. Crucially, pseudonymised data remains personal data under EU law.

True anonymisation under Recital 26 requires irreversibility. Anonymisation is not a security measure applied to a record; it is the permanent destruction of any possibility of singling out, linkability, or inference across the entire dataset. When an engineering team maintains a consistent hashed key (user_uuid or device ID) across user sessions, they preserve linkability. That linkability keeps the dataset firmly within the scope of the GDPR.

When AI systems use these datasets for fine-tuning or evaluation, the models also inherit these compliance obligations under the EU AI Act.

---

What documentation is required before processing longitudinal datasets?

If your startup processes user telemetry, product analytics, or client records using persistent pseudonyms, European supervisory authorities expect structured compliance documentation on file:

1. Lawful Basis Identification (Articles 6 and 9)

You cannot rely on legitimate interest under Article 6(1)(f) for special-category data (health, biometric, political, or sexual orientation data). Processing special categories requires explicit consent under Article 9(2)(a) or a narrow statutory exemption.

2. Mandatory Data Protection Impact Assessment (Article 35)

Under EDPB guidelines and national DPA blacklists, tracking individuals across time, processing sensitive attributes on a large scale, or ingesting telemetry for algorithmic profiling mandates a formal DPIA. IQVIA failed to conduct a DPIA prior to aggregating longitudinal health data—a major factor in their €7M penalty.

3. Record of Processing Activities (Article 30)

Every data flow involving pseudonymised datasets must be categorized in your ROPA, detailing data categories, recipients, retention limits, and security controls.

4. Controller-to-Processor Contracts (Article 28)

If external partners, data brokers, or healthcare providers supply your data, clear Article 28 data processing agreements or Article 26 joint controllership contracts must define liability. In IQVIA's case, the GPs generating the data were never formally designated as data processors.

---

What are the penalties for false anonymisation under GDPR?

Treating personal data as anonymous strips away essential data subject safeguards. European DPAs treat false anonymisation as a foundational infringement rather than a technical clerical error:

| Infringement Area | GDPR Article | Maximum Statutory Penalty | | :--- | :--- | :--- | | Basic Principles of Processing | Article 5(1)(a), (e) | Up to €20,000,000 or 4% of global turnover | | Unlawful Processing of Special Category Data | Article 9(1) | Up to €20,000,000 or 4% of global turnover | | Missing Data Protection Impact Assessment | Article 35(1) | Up to €10,000,000 or 2% of global turnover | | Failure of Privacy by Design & Default | Article 25(1) | Up to €10,000,000 or 2% of global turnover | | Inadequate Processing Security (PII Leaks) | Article 32(1) | Up to €10,000,000 or 2% of global turnover |

For SMEs deploying machine learning workflows, penalties can compound if the system qualifies as high-risk under the EU AI Act, where governance and data quality infractions can reach up to €35,000,000 or 7% of annual turnover under Article 99.

---

What should SaaS and AI engineering teams do first?

Do not wait for a regulatory audit or customer security inquiry. Take four practical remediation steps this week:

1. Audit Telemetry Identifiers: Scan production databases, data lakes, and vector embeddings. Identify every table where records are linked by persistent keys (pat_id, client_id, device_hash). Reclassify these tables from "anonymous" to "pseudonymised personal data" in your ROPA.
2. Scrub Free-Text Input Fields: Build automated pre-ingestion regex filters and NER (Named Entity Recognition) sanitizers to strip phone numbers, names, and tax IDs before text notes reach analytical datastores.
3. Perform a DPIA on Analytics and AI Pipelines: Use a structured DPIA workflow to document singling-out risks, linkability assessments, and encryption-at-rest key separation.
4. Enforce Strict Retention Windows: Delete or irreversibly aggregate historical telemetry logs past your stated operational retention period. Storing raw event logs indefinitely creates toxic liability without business value.

To evaluate your organization's exposure across active EU regulations, run our free Regulation Checker or benchmark your automated workflows against our High-Risk AI Classifier.

---

Disclaimer: EuroComply provides compliance readiness tools and evidence drafts. This guide is for informational purposes and does not constitute legal, regulatory, or compliance advice. Have technical documentation and assessments reviewed by qualified counsel.