France's data protection authority, the CNIL, fined IQVIA Operations France €5 million on May 26, 2026, over how the healthcare-analytics firm ran two authorized health data warehouses: LRX, fed by roughly 14,000 pharmacies since 2018, and EMR, supplied by several thousand doctors since 2021. The decision is one of the CNIL's largest health-data sanctions and lands squarely on the fault line running through EU data law in 2026 — when does removing a name from a dataset actually take it outside GDPR's reach?
What the CNIL Found
The case combines a doctrinal ruling with a list of ordinary compliance failures. On doctrine: IQVIA argued its warehouse data was anonymized and therefore outside GDPR's scope entirely. The CNIL rejected that, finding the data merely pseudonymized — re-identification remained possible "by reasonable means" given unique patient identifiers, the depth of clinical detail collected, and the potential to cross-reference with public information. On operations, the CNIL's inspections turned up the kind of gaps that would be a problem under any framework: no regular review of connection logs to catch abnormal access, no multi-factor authentication on the EMR warehouse, inaccurate patient information notices, an objection mechanism that didn't functionally let people opt out, and — in all four pharmacies the CNIL inspected — no disclosure to customers that their data was flowing to IQVIA at all. The regulator's own count puts the population affected across both warehouses at tens of millions of people, per health-law reporting on the decision. Alongside the fine, the CNIL ordered fixes within six months, backed by a €10,000-per-day penalty for delay.
The Timing Is Not a Coincidence
This ruling arrives eight months after the CJEU's own landmark word on the same question. In EDPS v. SRB (Case C-413/23 P), decided September 4, 2025, the Court held that pseudonymised data is not automatically personal data for every party that touches it — classification turns on whether the specific recipient can realistically re-identify individuals, not on the abstract theoretical possibility. It's a genuinely recipient-relative test, and companies handling pseudonymised datasets reasonably read it as room to argue certain transfers fall outside GDPR. The EDPB's own Guidelines 01/2025 on Pseudonymisation, adopted January 17, 2025, drew the same distinction from the regulator's side: pseudonymisation reduces risk and can support looser legal bases, but it does not convert personal data into non-personal data for a controller who still holds the keys.
That's the steelman for IQVIA's position, and it isn't frivolous — the CJEU really did open a door for recipient-side anonymization arguments. But the CNIL closed the specific door IQVIA tried to use: IQVIA itself held the re-identification keys to its own warehouses. EDPS v. SRB protects a downstream recipient who genuinely cannot re-identify anyone; it does not protect the entity that built the linkage in the first place. Read together, the two decisions aren't in tension — they're the same principle applied from opposite ends of a data-sharing chain, and IQVIA sat on the wrong end of it.
Two Different Kinds of Enforcement, One Fine
What should concern innovation-minded observers is less the pseudonymization holding — which is a defensible, narrow application of settled law — and more the fact that it's bundled into the same penalty as the MFA gap, the missing log review, and the pharmacies that never told patients where their data was going. Those are not close legal calls. They're the kind of baseline security and transparency failures that would draw scrutiny under any credible data-protection regime, GDPR or otherwise. Folding them into a single €5 million sanction alongside a genuinely contestable data-classification dispute makes it harder for other health-data operators to extract the actual lesson: is the exposure here about your security posture, or about how your lawyers read a data-scope statute? The CNIL's decision reads more like the latter is doing the heavy lifting reputationally, even though the former is arguably the more serious problem.
What This Means for Health Data Warehouses
The CNIL notes it processed 539 authorization requests for health data treatments in 2025 alone, and health-law commentary on the ruling puts the number of similarly structured operators at over 100 across France. All of them share IQVIA's basic architecture: pseudonymize at intake, retain keys centrally, argue anonymization when convenient. The CNIL's decision, taken with the CJEU's SRB ruling and the EDPB's guidelines, gives that population a genuinely workable test — recipient-side re-identification risk, not just technical form — rather than a blanket presumption against pseudonymization. That's the right outcome. France issued €486.8 million in CNIL fines across 83 decisions in 2025, and health data will keep drawing outsized attention given its sensitivity. Regulators applying a clear, technically grounded standard — rather than a maximalist "pseudonymized data is always personal data" rule — is what lets health-data analytics keep functioning in Europe at all. The risk is regulators using cases like this one to quietly expand scrutiny of ordinary security hygiene under the more headline-grabbing banner of data classification, when the two deserve to be judged, and communicated, separately.