CNIL fined IQVIA Operations France 5 million euros on 26 May 2026 because safeguards failed and health data could still be re-identified through reasonable means. Under GDPR, the distinction between pseudonymized and anonymized health data turns on whether people can be identified. Describing the warehouse data as anonymous did not make it so.
Key Takeaways
- CNIL found IQVIA’s data pseudonymous, citing unique identifiers, data depth, and possible links with publicly available data.
- GDPR Recital 26 distinguishes genuinely anonymous information from personal data that additional information can reconnect to someone.
- The CJEU’s SRB judgment makes the recipient’s ability to identify people central; it does not declare all pseudonymized data anonymous.
Why CNIL fined IQVIA
On 26 May 2026, France’s data protection authority, CNIL, fined IQVIA Operations France 5 million euros over health-data-warehouse safeguard failures. Its central finding was that the information IQVIA held remained pseudonymous because people could be re-identified using reasonable means. The decision concerned data on tens of millions of individuals.
The distinction mattered because IQVIA argued that its warehouses were anonymous and therefore outside GDPR. CNIL rejected that position. According to the authority, IQVIA had never disputed processing personal data and had sought and obtained authorizations it had to respect.
For your team, the useful starting point is the authority’s reasoning, rather than the fine alone. What evidence supports an anonymity claim, and what processing has already been authorized? Those are questions to bring to counsel when evaluating your own arrangements.
When health data remains identifiable under GDPR
GDPR Recital 26 describes personal data that additional information can attribute to a natural person as still relating to an identifiable person. Genuinely anonymous information, by contrast, does not relate to an identified or identifiable person. The distinction concerns whether someone remains identifiable, rather than which label appears in a description.
Pseudonymized personal data: data that can still be attributed to a person using additional information. Anonymous information: information that does not relate to an identified or identifiable person, including data rendered anonymous so identification is no longer possible.
Recital 26 says data protection principles should not apply to that genuinely anonymous information. It also expressly addresses personal data that has undergone pseudonymization but remains attributable through additional information. Read those statements together before treating pseudonymization as an answer to whether GDPR applies.
For a procurement discussion, a useful question is: what additional information could connect these records to someone? Follow that with a question about whose ability to make that connection is being assessed. The CJEU ruling discussed below makes that second question particularly relevant.
Why CNIL found re-identification possible
CNIL identified a unique identifier, the depth of the collected data, and possible combinations with publicly available information. Together, these supported its finding that re-identification was possible through reasonable means. The authority assessed warehouses drawing on pharmacies and doctors, with separate authorization histories.
| Warehouse or finding | CNIL’s account |
|---|---|
| LRX | Authorized in 2018; fed by roughly 14,000 pharmacies. |
| EMR | Authorized in 2021; fed by several thousand doctors. |
| Unique identifier | Its existence contributed to the re-identification-risk finding. |
| Data depth | The depth of collected data contributed to the finding. |
| Publicly available data | Combining it with IQVIA’s data could identify individuals. |
The table separates the warehouses’ scale from the reasons CNIL gave for finding the information identifiable. Pharmacy and doctor counts describe the sources feeding the warehouses. The identifier, data depth, and possible combinations describe the authority’s reasoning about identification.
In your review, use those findings to frame questions rather than to assume an identical outcome. What identifier exists, how much information sits behind it, and what could be combined with it? Let counsel or the relevant regulator assess the answers for your case.
What the CJEU’s SRB judgment established
IQVIA relied on the CJEU’s judgment of 4 September 2025, Case C-413/23 P, European Data Protection Supervisor v Single Resolution Board. The judgment held that pseudonymized data is not automatically personal data for every person in every case. The specific recipient’s means of identifying individuals matter.
That qualification has conditions: pseudonymization must genuinely prevent attribution and must not be reversible by the recipient. The CJEU set aside the General Court’s judgment and referred the case back. It left open whether the third-party recipient Deloitte’s copy of the data was non-personal for Deloitte.
Keep the general principle and the specific ruling in view. SRB’s obligation to inform data subjects was assessed from its perspective at collection, before transfer. That obligation applied irrespective of whether the data was personal from Deloitte’s perspective after pseudonymization. The judgment did not settle Deloitte’s status.
CNIL, meanwhile, found that reasonable means of re-identification existed for the data IQVIA held. It also pointed to IQVIA’s recognition of personal-data processing and its existing authorizations. Those are the stated grounds to read alongside IQVIA’s reliance on the SRB judgment.
The editorial takeaway is narrow: a citation to the SRB judgment should prompt a recipient-specific explanation, not end the discussion. If your team is assessing such an argument, take the claimed barriers to identification to counsel. Ask how the evidence supports the particular recipient’s position.
CNIL’s corrective order and questions for a data review
CNIL ordered IQVIA to remedy certain breaches within six months, backed by a penalty of 10,000 euros per day of delay. That remedial order accompanied the fine. For readers evaluating the decision, both the monetary sanction and the required corrective action belong in the account.
Use the decision to organize a focused conversation about your own data description. Request an explanation of the identifier, the depth of the records, and possible links to public information. Bring the relevant authorizations and the claimed limits on recipient access into that conversation with counsel.
For a separate discussion about evidence in health technology, read Algorithmic Bias in Medical AI: The Problem Nobody Wants to Talk About. If your review also covers deployment across institutions, continue with One Model, Many Hospitals: The Sprawl Problem.
Keep the privacy question specific: who holds the data, and what means of identification are available to them? CNIL’s IQVIA decision and the SRB judgment give you reasons to insist on that precision. Your own classification belongs with counsel or the relevant regulator.
Frequently Asked Questions
What did CNIL fine IQVIA for?
On 26 May 2026, CNIL fined IQVIA Operations France 5 million euros for health-data-warehouse safeguard failures. CNIL found the data pseudonymous rather than anonymous because re-identification was possible using reasonable means.
What is the difference between pseudonymous and anonymous data under GDPR?
Under GDPR Recital 26, pseudonymized personal data remains identifiable when additional information can attribute it to a person. Genuinely anonymous information does not relate to an identified or identifiable person, and data protection principles do not apply to it.
Did a court ruling say IQVIA’s data was anonymous?
IQVIA cited the CJEU’s 4 September 2025 SRB judgment, Case C-413/23 P. The CJEU left Deloitte’s data status open on remand; SRB’s information duty applied at collection, independently of Deloitte’s re-identification means. CNIL rejected IQVIA’s anonymity argument and found re-identification possible using reasonable means.
What did CNIL order IQVIA to do?
CNIL ordered IQVIA to remedy certain breaches within six months, subject to a penalty of 10,000 euros for each day of delay.
Sources
- Health data: fine of 5 million euros against IQVIA, CNIL, decision of 26 May 2026.
- GDPR, Regulation (EU) 2016/679, Recital 26, European Union, EUR-Lex, 2016.
- European Data Protection Supervisor v Single Resolution Board, Case C-413/23 P: judgment summary, CJEU, EUR-Lex, 4 September 2025.
- European Data Protection Supervisor v Single Resolution Board, Case C-413/23 P: press release No 107/25, CJEU, 4 September 2025.
This article is for general information and is not legal, regulatory or medical advice.