The question at hand
You've stripped out names, replaced identifiers with random codes, and removed postcodes. Your processor assures you the dataset is anonymous. Your legal team signed off. But can a patient still be singled out from the crowd?
IQVIA Solutions Italy thought they had the answer. The Italian supervisory authority disagreed, to the tune of EUR 7,000,000. The company processed health information for approximately one million patients, claiming anonymization made GDPR health data rules irrelevant. The supervisory authority found that a persistent identifier, combined with year of birth, sex, diagnoses, symptoms, prescriptions, examinations, vaccinations, and location data, created a trail that could single out and potentially re-identify patients using reasonably available means.
This wasn't a theoretical risk. The database contained directly identifying information for approximately 3,370 patients, including health data for approximately 3,080 of them.
The enforcement decision forces a question many organizations dodge: when you can't prove anonymization holds up, should you treat the data as pseudonymous from the start and build your compliance program accordingly?
The case for claiming anonymization
Organizations processing health data at scale face a choice. If you can demonstrate true anonymization under GDPR, you're outside the regulation's scope entirely. No lawful basis required. No transparency obligations. No data protection impact assessment. No retention limits.
The efficiency gains are enormous. Research teams can work with datasets spanning years without consent mechanisms. Analytics can incorporate granular health outcomes without individual notices. Commercial partnerships don't trigger controller-processor agreements.
Industry groups have published anonymization guidelines. Statistical disclosure control techniques exist. K-anonymity, l-diversity, and differential privacy offer mathematical frameworks. If you apply these methods rigorously and document your approach, you've built a defensible position.
The IQVIA case involved specific failures. The persistent identifier tracked individuals over time. The combination of attributes made singling out possible. But these are execution problems, not proof that anonymization itself is unworkable. Organizations that invest in proper de-identification infrastructure, review datasets for residual disclosure risk, and update techniques as re-identification methods evolve can achieve genuine anonymization.
You're also protecting against future regulatory expansion. If you've truly anonymized the data, changes to GDPR enforcement priorities or new supervisory authority guidance don't affect your processing. You've eliminated the compliance surface entirely.
The case for treating it as pseudonymous
The Italian supervisory authority's reasoning cuts deeper than IQVIA's specific mistakes. They evaluated whether re-identification was possible using "reasonably available means." That standard includes information the controller holds, information easily accessible to third parties, and techniques that don't require disproportionate effort.
Health data creates unique challenges. A 58-year-old woman diagnosed with a rare autoimmune condition in a specific municipality might be identifiable even without a name. Add prescription history, vaccination records, and symptom timelines, and you've created a fingerprint. The richer your dataset, the harder true anonymization becomes.
Pseudonymization, by contrast, acknowledges this reality. You process special category data under Article 9, which means you need one of the specific conditions in Article 9(2). For health research, that's often explicit consent, public interest with suitable safeguards, or processing necessary for scientific research purposes with additional protections.
This approach requires more infrastructure. You'll conduct a data protection impact assessment. You'll document retention periods. You'll implement appropriate technical and organizational measures. You'll appoint processors where relevant (the Italian supervisory authority specifically required IQVIA to appoint the general practitioners as processors if continuing the processing).
But you'll also sleep better. Pseudonymous processing doesn't collapse if someone publishes a re-identification technique. Your compliance program adapts to new risks without requiring you to re-prove your entire anonymization methodology.
The IQVIA enforcement shows what happens when your anonymization claim fails mid-processing. You're not just facing a fine for inadequate anonymization. You're facing findings that you lacked a lawful basis, violated transparency obligations, skipped the data protection impact assessment, and failed to implement adequate security. Every GDPR obligation you thought didn't apply suddenly does, retroactively.
Where practitioners actually land
Most organizations processing health data at scale don't make a binary choice. They use pseudonymization for ongoing processing and reserve anonymization claims for specific, limited outputs.
Your research database? Pseudonymous, with Article 9(2)(j) processing for scientific research and appropriate safeguards. Your quarterly aggregate report showing prescription trends by age band and region? That might clear the anonymization bar if you've applied proper statistical disclosure controls and verified no individuals can be singled out.
This hybrid approach acknowledges that anonymization is context-dependent. A dataset that's anonymous for one purpose might not be for another. A dataset that's anonymous in 2025 might not be in 2027 when new linkage techniques emerge.
Organizations that succeed typically establish clear governance. They define when anonymization can be claimed (usually requiring DPO review and documented risk assessment). They maintain pseudonymous processing as the default. They build systems that can adapt if an anonymization claim needs to be reversed.
Our take
Treat anonymization as a high bar you might occasionally clear, not a default classification for de-identified data.
The IQVIA case demonstrates the cost of getting this wrong. EUR 7,000,000 is steep, but the operational disruption matters more. The supervisory authority gave the company 120 days to establish a lawful basis, comply with transparency obligations, conduct a data protection impact assessment, and restructure processor relationships, or else have general practitioners perform anonymization independently under specified safeguards.
If you're processing health data and claiming anonymization, ask yourself: could you prove to a supervisory authority that re-identification is impossible using reasonably available means? Not just today, but three years from now when machine learning techniques improve and public datasets expand?
If the answer isn't a confident yes, build your compliance program around pseudonymous processing. You'll have more obligations, but you'll also have a program that doesn't implode if your anonymization claim fails scrutiny.
The question isn't whether anonymization is theoretically possible. It's whether you can prove it holds up when a supervisory authority investigates. For most health datasets with the granularity organizations actually need, pseudonymization with appropriate safeguards is the honest answer.
