IQVIA fined $7.8 million for failing to properly anonymize health data

IQVIA's anonymization approach was fundamentally flawed — using unique codes alone is insufficient if the accompanying dataset contains enough detailed attributes to re-identify individuals through linkage or inference attacks. The company compounded the violation by processing sensitive health data without a legal basis, failing to notify patients, and retaining records with no defined expiry policy, some dating back over two decades. This case highlights that pseudonymization is not the same as true anonymization under GDPR, and organizations must rigorously validate that de-identification techniques withstand re-identification risk assessments. Regulatory penalties at this scale serve as a clear warning that technical controls must be accompanied by proper governance, transparency, and lawful processing grounds.