A database can be protected against external access and still contain information it should never have received. This deserves attention: assessing security also means examining how data is collected, transformed and transferred. The IQVIA case makes this particularly tangible.

When a claim of anonymity is not enough

In its statement of 2 October, Italy's data protection authority, the Garante, describes a database fed by around 800 general practitioners and used for studies commissioned by clients including pharmaceutical companies.

IQVIA maintained that the information was anonymous. The authority reached a different conclusion: the code associated with each patient allowed them to be tracked over time. Combined with detailed information about health, year of birth, sex and location, it made reidentification possible through reasonable means.

The fine also concerns other issues, including the legal basis, privacy information, retention, impact assessment and security measures. Reducing the case to a software error would therefore be misleading.

The weakness in free-text fields

A passage in the full decision helps explain the operational problem. In the breach notified by the company, some doctors had entered identifying information in free-text fields. The process intended to remove it before transmission had not done so. Names, Italian tax identification numbers and contact details had consequently appeared in the extracts.

The figures need to be distinguished: around one million patients is the size of the database deemed not anonymous. The 3,370 patients relate instead to direct identifiers present in the notified breach. The sources do not describe attackers stealing the entire archive.

The lesson for anyone managing data is straightforward: a control must hold up even when actual use differs from what was expected.

From procedures to evidence

For a business, checking a control means turning a promise into an observable test. If a filter is supposed to remove personal information, it must also be tested with unexpected data. If access is meant to be restricted, the operations it actually permits need to be checked.

Assessments and targeted tests help identify these gaps. A penetration test checks the resilience of applications and infrastructure through an authorised simulation; anonymisation and information flows require specific checks alongside privacy expertise.

The useful question for management becomes: when did we test this control, against which scenarios and with what result?

Test today and monitor what changes

After an assessment, the environment continues to evolve: users, software, configurations and connections between systems change. The evidence collected therefore needs to lead to fixes, follow-up checks and monitoring.

ARGUS — Managed Security Operations Center by Redaxer supports this process with infrastructure monitoring, security event detection, alerts, reporting and support for the initial response. Anonymisation checks remain a specific activity; the managed service provides visibility into what happens across systems over time.

For business leaders, the practical step is to identify the most important controls, ask for evidence that they work and define who will follow up on anomalies.

Sources and references