Pseudonymized Health Data After the IQVIA Fine: Real-World Data Licensing and the EDPB's Draft Anonymization Test

A US company licensing European health data for real-world evidence may expect one legal answer for the dataset. Under HIPAA the question is whether the data were de-identified, either by removing the listed identifiers under the safe harbor and having no actual knowledge that the remaining information could identify a person, or by an expert's documented determination that the risk of identification by an anticipated recipient is very small, and once the answer is yes the information is treated as no longer individually identifiable health information, and the Privacy Rule stops following it, subject to its rules on re-identification.145 C.F.R. § 164.502(d)(2) and § 164.514(a) to (c): de-identification by expert determination or identifier removal plus no actual knowledge of identification; special conditions for re-identification codes. Under 45 C.F.R. § 164.514(e)(1) to (4), a limited data set remains protected health information and its separate disclosure route requires a data use agreement. That HIPAA result cannot simply be carried across to the GDPR. Between September 2025 and July 2026, a judgment and draft guidance clarified the European assessment. The Court of Justice held that pseudonymized data are not personal data in all cases and for every person, which reads from a US desk like the arrival of a HIPAA-style exit. In May 2026 the French data protection authority, the CNIL, fined the operator of two pharmacy and physician data warehouses EUR 5 million after rejecting that reading, and in July 2026 the European Data Protection Board published a draft anonymization test that is run separately for each entity that might hold the data. The relevant entity and its means of identification matter alongside the content of the dataset.

1. When Pseudonymized Health Data Are Personal Data, and for Whom

Under Art. 4(1) GDPR, personal data are information relating to an identified or identifiable natural person, and Recital 26 GDPR tells the reader how to decide identifiability: by taking account of all the means reasonably likely to be used, such as singling out, "either by the controller or by another person". The same recital states that data which have undergone pseudonymization and could be attributed to a person by the use of additional information "should be considered to be information on an identifiable natural person", and Art. 4(5) GDPR defines pseudonymization as processing after which the data can no longer be attributed to a specific person without additional information that is kept separately.2Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (GDPR), recital 26; Art. 3, Art. 4(1) and (5), Art. 5, Art. 6(1), Art. 9(1) and (2), Art. 14, Art. 24 to Art. 26, Art. 28, Art. 44 to Art. 46 and Art. 83(5)(a): identification, processing duties, controller/processor roles, transfers and the higher administrative-fine ceiling. An absolute reading would make the data personal for every holder of the pseudonymized copy whenever someone retained the key. On that reading, a licensee in Boston without the key would process personal data solely because a vendor in Paris kept one. The Court of Justice rejected that categorical conclusion.

The Court of Justice rejected the absolute view in Case C-413/23 P, EDPS v SRB, decided on 4 September 2025 under the data protection regulation for the Union institutions, whose definition of personal data mirrors the GDPR's. The Single Resolution Board had sent pseudonymized comments from shareholders and creditors of a bank in resolution to an independent valuer. The Court accepted that, for the valuer, those comments might not be personal, but only if the valuer "is not in a position to lift those measures during any processing of the comments which is carried out under its control" and if the measures also prevented attribution by other means, including cross-checking with other factors. A means of identification is not reasonably likely to be used where the risk appears in reality to be insignificant, because identification is prohibited by law or impossible in practice. Where it cannot be ruled out that a recipient has means reasonably allowing it to attribute the data, the data subject is identifiable as regards both the transfer and the recipient's later processing. And for the controller's own duty to tell the data subject who will receive the data, identifiability is assessed at the time of collection and from the controller's point of view, whatever the recipient can or cannot do.3Case C-413/23 P European Data Protection Supervisor v Single Resolution Board ECLI:EU:C:2025:645 (Court of Justice, First Chamber, 4 September 2025), paras 76 to 86 and 111 to 112, interpreting Art. 3(1), Art. 3(6) and Art. 15(1)(d) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC [2018] OJ L295/39. Recipient identifiability requires a contextual assessment; the controller’s initial recipient-information duty is assessed at collection from its own perspective. The Court set aside the judgment below and remitted the case. Pseudonymized data, the Court concluded, are not personal data "in all cases and for every person". The recipient's position therefore requires its own assessment. For the controller's initial duty to inform about recipients, the relevant perspective and time were those of the controller at collection. This holding does not fix all later processing or transfer duties at that moment.

The EDPB took the judgment as its starting point when, on 7 July 2026, it adopted draft Guidelines 02/2026 for public consultation until 30 October 2026, updating the Article 29 Working Party's 2014 opinion on anonymization techniques. The Guidelines accept that information "may be anonymous for some entities, but not for others", and they turn the assessment into a question of perspective: "for whom is the data intended to be anonymous?" Three refinements matter for a data license. An entity processing on behalf of a controller for whom the data are personal takes that controller's perspective and is a processor. Where a transfer to a third party is reasonably likely, and that recipient cannot be ruled out as having means reasonably likely to be used to identify the individual, the data are personal for that transfer, for the recipient's processing and, indirectly, for the entity that transferred them. And the likelihood of identification need not be zero, only insignificant in reality, which the Guidelines test against three criteria (no record isolation, no linkage and no inference) under either a contextual approach that weighs each entity's actual capabilities or a simplified approach that deliberately sets the differences between them aside.4European Data Protection Board, Guidelines 02/2026 on Anonymisation (Version 1.0, adopted 7 July 2026 for public consultation, feedback period 8 July to 30 October 2026), paras 6 to 15, 20 to 22, 28 to 41, 45 to 55, 60, 67, 90 and 92: relevant perspectives, identification means, contracts as a complement, reassessment and anonymity criteria. Failing a criterion requires further analysis. Footnote 3 preserves assessments correctly made under the prior opinion. Background: European Data Protection Board, Guidelines 1/2026 on processing of personal data for scientific research purposes (adopted 15 April 2026 for public consultation), para 156; Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques (WP216, adopted 10 April 2014); and European Data Protection Board, Guidelines 01/2025 on Pseudonymisation (adopted 16 January 2025 for public consultation).

The legislature may yet codify the relative reading, although the Council has so far moved away from the form first proposed. The Commission's Digital Omnibus proposal of 19 November 2025 would add to Art. 4(1) GDPR that information is not personal for an entity that cannot identify the person with the means reasonably likely to be used by that entity, and would let the Commission specify by implementing act when pseudonymized data cease to be personal for certain entities. Its recitals give the re-identification ban in Art. 61(3) EHDS as an example of a prohibition by law.5European Commission, Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus), COM(2025) 837 final, 19 November 2025, procedure 2025/0360(COD), recital 27 and Art. 3 of COM(2025) 837, points 1(a) and 10 (proposed entity-relative definition and Commission implementing-act power; neither is enacted law). See also European Data Protection Board and European Data Protection Supervisor, Joint Opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) (adopted 10 February 2026). The Council Presidency's revised compromise text of 18 June 2026 struck the amendment to the definition and moved the Court's holding into a proposed stand-alone Art. 29a GDPR on the application of pseudonymization, with an EDPB opinion in place of the Commission's implementing act. The Coreper vote on a negotiating mandate, scheduled for 26 June 2026, was called off when agreement on open issues could not be found, and on the Parliament's own account of 1 August 2026 its two lead committees had discussed a draft report and received more than 1,750 amendments, with no vote recorded.6Council of the European Union, Digital Omnibus: Presidency revised compromise text, Council doc ST-10677/26 (18 June 2026), procedure 2025/0360(COD), Art. 3 of ST-10677/26, points 1(a) and 10: the definition amendment and Commission empowerment are struck; proposed Art. 29a GDPR preserves other obligations, excludes processors from its recipient provision and requests an EDPB opinion. European Parliament, Legislative Train Schedule: The Digital Omnibus Regulation Proposal (information updated as of 1 August 2026): Coreper’s 26 June vote was cancelled; the committees discussed a report on 13 July; over 1,750 amendments were tabled; status “Tabled”. The proposal's wider effects are examined in the analysis of the proposed Digital Omnibus. The narrower point here is that, as of publication, a supervisory authority applying the GDPR to a health dataset applies the definition as it stands, interpreted in light of SRB. The July draft describes the Board's proposed guidance; it is not an adopted amendment to the GDPR. When the CNIL applied the post-SRB reading to a real-world data warehouse in May 2026, the judgment did not help the warehouse.

A health dataset need not have the same legal status for every entity, and that status can change as identification means change. The controller's initial duty to inform about recipients is assessed at collection from its own perspective; its later processing and transfer duties remain separate questions.

2. What the CNIL Decided About IQVIA's Warehouses, and Why SRB Did Not Help

IQVIA Operations France, a subsidiary of the IQVIA group, carries out studies on its own account and for pharmaceutical companies on particular diseases and treatments. It works from two health data warehouses the CNIL had authorized it to establish: LRX, authorized in 2018 and drawing on a network of about 14,000 partner pharmacies, about 10,000 of which participated in its patient panel, and EMR, authorized in 2021 and fed by data from several thousand physicians. After a television investigation and complaints from individuals and associations, the CNIL inspected the company and a number of partner pharmacies. On 26 May 2026 its formation restreinte, the body that imposes sanctions, fined the company EUR 5 million and ordered it to remedy certain breaches within six months of notification of the decision on pain of EUR 10,000 for each day of delay, citing the sensitivity of the data, the tens of millions of people concerned, the company's market position and its financial capacity.7Commission nationale de l'informatique et des libertés, Délibération de la formation restreinte n° SAN-2026-008 du 26 mai 2026 concernant la société IQVIA OPERATIONS FRANCE, paras 36, 88–113, 227–270 and 285–315, and operative part; CNIL, 'Health data: fine of 5 million euros against IQVIA' (28 May 2026). The study-reuse finding concerned data from four inspected pharmacies; the Art. 25 GDPR finding concerned pharmacist refusal. Security and confidentiality defects had been remedied during the proceedings.

The company's principal defense relied on a reading of SRB that a US licensee might also invoke: the data in both warehouses were anonymous, so the GDPR did not apply. The restricted committee rejected it on grounds that go to the structure of the business rather than to a lapse in it. The judgment, it held, continued the Court's earlier case law rather than breaking with it. IQVIA was not a mere recipient of pseudonymized data but the controller of the whole processing, and its data differed from the comments at issue in SRB because of their richness and because they allowed each patient to be followed over time through a unique identifier. Each pharmacy customer received an identifier that stayed the same whichever partner pharmacy the customer visited, each patient of a physician received one within that practice, and the records carried location data by zones of nine pharmacies or five physicians of the same specialty. That combination, the committee found, let the company single out each individual with ease. The rapporteur's own example, a real-world study of patients treated for spinal muscular atrophy, showed that external information sufficient to single out a patient in the pharmacy warehouse could be found in a few minutes with ordinary internet access, and the opt-out procedure pointed the same way, because a patient objecting to EMR processing had to supply the date and time of the appointment and the content of the prescription, which was enough to find the record. The committee held the intention or motivation of anyone to re-identify irrelevant, and it noted that the company had itself described the data as personal health data at the time of the inspections.7

Two further holdings bear directly on licensing. The committee rejected the argument that the company's contracts made re-identification unlawful, and therefore not a means reasonably likely to be used. Reading contracts into what the Court's case law calls "prohibited by law" misread that case law, and cross-referencing the warehouses with open sources was not prohibited by law in the absence of an explicit prohibition. Pseudonymization, it concluded, reduced the risk of linking the data to identities without removing it. The breaches it sanctioned also began upstream of the warehouse. None of the four pharmacies inspected told its customers that their data went to IQVIA, and although the company had left that task to the pharmacists, the duty under Art. 14 GDPR was its own as controller. The pharmacy software transmitted patient data to the first trusted third party even where the pharmacist had declined to transmit those data. The committee treated the failure to filter at the pharmacy software as a breach of Art. 25 GDPR. For studies on its own account using LRX data from the four inspected pharmacies, the company also lacked the required authorization or compliance with the reference methodology, in breach of Art. 66 of the Loi Informatique et Libertés. The warehouse authorization did not itself authorize those separate studies. The CNIL accepted that the security and confidentiality defects had been remedied during the proceedings and imposed no injunction on those points; its other compliance orders remained.7

The decision did not come from nowhere. On 13 February 2026 the Conseil d'État, the court that hears challenges to the CNIL's sanctions, upheld three fines imposed in 2024 on companies that operated or fed two other databases built from physicians' practice software and from pharmacies. It held that data cannot be regarded as having been rendered anonymous by pseudonymization unless the risk of identification is insignificant, accepted the CNIL's finding that customers and their conditions could be singled out with a commonly used spreadsheet program and the nomenclature the companies supplied, noted that the risk was high where the treatments prescribed were rare, and saw no serious difficulty that called for a reference to the Court of Justice.8Conseil d'État (10ème et 9ème chambres réunies), GERS et autres, nos 498628, 498629 and 498749 (13 February 2026), ECLI:FR:CECHR:2026:498628.20260213, points 9, 11–12 and 24–26, and the operative part. The restricted committee cited that decision. Between them, France's supreme administrative court and its data protection authority have held four pharmacy and physician databases to the insignificant-risk standard, and in each the persistent patient or customer code that lets a care pathway be followed, the feature that makes such a panel valuable for real-world evidence, was part of what made the data personal. The exposure is not modest: Art. 83(5)(a) GDPR sets the ceiling for infringements of the basic principles for processing, Art. 9 GDPR among them, at EUR 20 million or 4 % of total worldwide annual turnover, whichever is higher.2

3. The Data License Written for a Different Test: Warranties, Re-Identification Bans and Audit Rights

US law gives agreements different functions. A HIPAA limited data set remains protected health information. Under the limited-data-set route, a covered entity may use or disclose it for research, public health or health care operations only with the prescribed data use agreement, including a recipient undertaking not to identify the information or contact the individuals. That permission is distinct from HIPAA de-identification. California separately makes reasonable measures, a public commitment and recipient contractual obligations conditions of its definition of deidentified information.9California Civil Code (Cal. Civ. Code) § 1798.140(m)(1) to (3): reasonable measures, a public commitment and recipient contractual obligations condition deidentified status. Separately, 45 C.F.R. § 164.514(e)(1) to (4) permits limited-data-set use or disclosure while the data remain protected health information. A real-world data license may carry similar terms across the Atlantic: a vendor warranty that the data are anonymized or de-identified, a licensee covenant not to re-identify, link or pass them on, and an audit right to check both. Neither US example establishes a universal contractual safe harbor. Under the Board's draft, an enforceable covenant can complement technical measures but cannot independently anonymize data or become the statutory prohibition discussed in the case law. A prohibition in a contract, "even if it is legally binding upon its parties", should not be treated as a prohibition by law, and contractual terms may affect the means reasonably likely to be used only as a complement to technical measures and only where they are "reliable, verifiable and enforceable". Technical, organizational and contractual measures that restrict access "are not by themselves sufficient to make data anonymous", and the assumption that people follow the law can be rebutted by evidence that a prohibition is not monitored, not enforced or not dissuasive.4 The CNIL's reading of contracts was the same.

The warranty is harder to read than the covenant. A vendor that warrants that licensed data are anonymous warrants a status the Board describes as belonging to a perspective, not to a dataset, and as capable of changing over time: if the likelihood of identification rises to a level that is no longer insignificant, previously anonymous data become personal again and the controller is accountable for processing them, which is why the Guidelines describe periodic reassessment as good practice. For a vendor retaining reasonably usable means of identification, the data remain personal. The CNIL's finding about IQVIA depended on the warehouses' richness, longitudinal identifiers and available linkage, alongside its role as controller. The Court likewise referred to the additional information held by the Single Resolution Board. Controller status or assigning a code alone does not establish the status of every resulting extract. For the licensee, the answer depends on what the licensee can link the data to, and linkage is tested against other datasets reachable with means reasonably likely to be used, which in a US life-sciences group may include claims data, patient-support program records, trial databases and the other real-world datasets it licenses. The vendor may lack visibility of those other datasets. A licensee relying on the warranty without examining its own identification means can therefore miss a different legal position; the warranty does not remove an assessment the licensee otherwise owes. The Guidelines also tell controllers, when informing data subjects, not to describe data as "anonymous", "de-identified" or "de-personalised" where individuals remain identifiable, and the same vocabulary in a license or in a vendor's product literature can become evidence of what the parties understood.4

Status is only half of what a warranty would need to cover. The Board states that anonymization is itself processing, that it needs a legal basis under Art. 6 GDPR and, where the dataset contains health data, an exemption under Art. 9(2) GDPR, and that both are presumed to coincide with those of the processing that preceded it where the anonymization forms part of the same processing activity and serves the same purposes. The process should also be documented, the Board adds, and the documentation kept.4 A dataset that is anonymous in the licensee's hands can therefore have been created unlawfully in the vendor's, and the IQVIA findings show where that happens: at the pharmacy counter where no notice was given, in software transmitting patient records despite a pharmacist's refusal, and in studies using the inspected pharmacies' data without the required authorization or compliance with the reference methodology. A licensee cannot cure any of those defects, and a warranty that the data are anonymous does not speak to them. Whether the license also warrants the lawfulness of the dataset's creation, whether it gives the licensee any means of verifying that, and what becomes of the licensee's derived analyses if a regulator later orders processing at the source to stop are separate questions. A general clause on compliance with applicable law may leave their practical consequences unresolved.

The audit right carries a paradox of its own. The Guidelines count as an entity's means those it can reach through another entity: identification may be indirect where an entity can obtain additional information, apply methods controlled by other parties or put the data at the disposal of others who have the means, and a business partner that could simply hire a third party to run a re-identification technique is treated as having that technique available.4 An audit clause wide enough to let the licensee inspect the vendor's pseudonymization, direct queries against the source warehouse or obtain linkage on request may be the chain of means that makes the licensed extract personal in the licensee's hands. The role question follows. Where a vendor runs studies on a sponsor's instructions, the Guidelines assess a processor's position by its controller's perspective, and the Board recalls the Court's holding that a party can be a joint controller without access to the data. Whether a sponsor commissioning analyses on a key-holding warehouse receives anonymous outputs or determines the purposes and means of personal-data processing must be assessed separately. Joint controllers face Art. 26 GDPR allocation; a controller engaging a processor faces Art. 28 GDPR requirements. Personal health-data processing also needs the applicable Art. 9(2) GDPR condition. Transfers require their own assessment of the exporter, recipient, relevant processing, territorial scope and personal-data status; a recipient's anonymity claim alone does not settle Chapter V GDPR. For a US recipient the Board's list of entities whose means count includes foreign intelligence agencies, which it notes may not be limited by the laws that bind domestic ones.

4. Switzerland and the EHDS: Identifiability, Coded Data and Re-Identification Bans

Switzerland is not an EU Member State, the GDPR is not part of Swiss law, and nothing in the Digital Omnibus would change Swiss law. The Swiss answer to the identifiability question is older than SRB and differently built. Art. 5(a) DSG defines personal data as all information relating to an identified or identifiable natural person.10Bundesgesetz über den Datenschutz (Datenschutzgesetz, DSG) vom 25. September 2020 (SR 235.1), Art. 5(a) and (c) DSG, Art. 6(4) DSG and Art. 31(1) and (2)(e) DSG: identifiability, sensitive health data, purpose-related retention and the qualified research justification. The predecessor statute used the same test of identifiability, and under it the Federal Supreme Court held in the Logistep case in 2010 that whether information relates to an identifiable person "beurteilt sich aus der Sicht des jeweiligen Inhabers der Information", from the perspective of whoever holds it, that on a disclosure it is enough that the recipient can identify the person, and that the discloser is then within the statute too. It also held that not every theoretical possibility of identification suffices, that there is no identifiability where the effort is so great that, on general experience of life, no interested party can be expected to undertake it, and that what matters is not only the effort objectively required but also the interest the processor or a third party has in the identification.11BGE 136 II 508, judgment 1C_285/2009 of 8 September 2010 (Logistep), E. 3.2 and E. 3.4: effort and interest in identification, assessment from the respective holder's perspective, and the discloser's position where the recipient can identify.

That last element separates the Swiss test from the French reading of the same question and only partly matches the Board's. The CNIL held the intention, interest or motivation to re-identify irrelevant, while the Board cautions against relying on a lack of motivation but allows the value of re-identified data to the re-identifying entity to be weighed against the cost and effort involved.4 Processing governed by Swiss law and processing governed by French and EU law may therefore be assessed under different doctrines even where the data are the same. Server location alone does not determine the applicable regime. The Swiss statute also frames onward disclosure for research from the recipient's side. Art. 31(2)(e) DSG lists, among the overriding interests that can justify processing, the use of personal data for purposes not related to specific persons, research among them, on three conditions: that the data are anonymized as soon as the purpose allows or, where that is impossible or disproportionate, measures prevent identification; that sensitive data are disclosed to third parties in a form in which the person is not identifiable or, where that is not possible, it is ensured that the third parties use them only for such purposes; and that results are published without identifying anyone. It is a ground of justification within the statute, not an exit from it, and a contractual use restriction intended to secure that fallback is the device the Board declines to treat as a prohibition by law.

Swiss research regulation separately distinguishes coded data from anonymized data by its statutory definitions. The HFG applies to research on human diseases and the structure and function of the human body conducted with health-related personal data, and does not apply to research with health-related data that were collected anonymously or have been anonymized. It defines coded data as data linked to a specific person by means of a key, and anonymized data as data that cannot be traced to a specific person, or only with disproportionate effort. Coded non-genetic health data may be reused for research only where the person was informed in advance and did not object, coded genetic data only with consent, and reuse without that consent or information is permitted only exceptionally, on the conditions of Art. 34 HFG and with an ethics committee's authorization under Art. 45(1)(b) HFG. Art. 45(1)(a) HFG separately requires authorization for research projects within the Act's scope.12Bundesgesetz über die Forschung am Menschen (Humanforschungsgesetz, HFG) vom 30. September 2011 (SR 810.30), Art. 2 and Art. 3(f), (h) and (i) HFG, Art. 32 to Art. 35 HFG and Art. 45(1) HFG: research scope, coded and anonymized data, consent or objection conditions, exceptional reuse and ethics authorization. The HFV treats data as correctly coded if, without access to the key or the source data, attributing them to a person would take disproportionate effort, and it requires the key to be kept separately by a person or unit not involved in the research project. In the version in force since 1 November 2024 it also requires anonymization to follow a methodical approach based on the state of the art, and its methodology to be documented, including a description of the remaining risk of re-identification.13Verordnung über die Humanforschung mit Ausnahme der klinischen Versuche (Humanforschungsverordnung, HFV) vom 20. September 2013 (SR 810.301), Art. 25 and Art. 26 HFV, in force in this version since 1 November 2024: methodical anonymization and coding, documented remaining re-identification risk, and separate key custody. A coded Swiss dataset that a US recipient might, on the Logistep reading, regard as not identifiable in its own hands is, for the research rules, coded health-related personal data by definition. The consent side of that regime is examined in the analysis of Swiss research consent. What the definitions do not settle is whether an analysis run in the United States on a coded extract from a Swiss hospital is research the HFG governs, and the answer shapes which authorization the licensor needed before the extract left.

A Statutory Ban That a License Cannot Replicate

The EHDS offers the contrast that makes the licensing problem visible. The EHDS secondary-use chapter generally applies from 26 March 2029, with certain data categories following in 2031. Under that framework, health data access bodies must supply data in anonymized form where the applicant's purpose can be achieved with it, and in pseudonymized form only where the applicant has shown that it cannot, with the information needed to reverse the pseudonymization held only by the access body or a trusted third party. Health data users "shall not re-identify or attempt to re-identify" the persons to whom the data relate, and the results of their work may contain only anonymous data.14Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (EHDS) [2025] OJ L 2025/327, Art. 61(3) and (4), Art. 66(2) and (3) and Art. 105, fifth paragraph: a statutory re-identification ban, anonymous outputs, anonymous access where sufficient and pseudonymized access where justified, with the key held by the access body or a trusted third party. Chapter IV EHDS generally applies from 26 March 2029; specified data categories follow in 2031. That is a prohibition in a regulation, not in a contract, and the Commission's Omnibus recitals cite Art. 61(3) EHDS as their example of a prohibition by law of the kind that can take a means of identification out of what is reasonably likely to be used.5 The same pseudonymized records may therefore reach one user through a permit, behind a statutory ban and a key held by a public body, and another through a commercial license, behind a covenant the Board treats as a complement to technical measures. The Board's caveats attach to both routes: the assumption that the law is obeyed can be rebutted by evidence, and it offers less comfort where the entities that could reach the data are not effectively bound by that law.4 A Nordic permit regime of the same design, and what it means for a US sponsor's use of registry data, is examined in the analysis of Nordic health-data access.

5. Contractual Risk for US Licensors and Licensees of European Real-World Data

The allocation of contractual risk begins with whose legal status the anonymity warranty describes. A license that defines the data as anonymized treats anonymity as a property of the file. Whether the vendor's assessment was contextual or simplified, which entities it treated as relevant, whether the licensee's own claims, trial and patient-support data were among the linkage sources it considered, and whether changes in identification means have been reassessed are questions with documentary answers that may not be the intended ones. For a dataset built on a longitudinal patient key, the IQVIA and GERS decisions describe the features French authorities have examined, and they are the features that give the dataset its value.

An anonymity assessment does not resolve lawfulness upstream. A licensee inherits the consequences of how the dataset was made without inheriting the ability to repair it. Whether the source pharmacies, physicians or hospitals gave the notices the controller owed, whether the anonymization rested on an Art. 6 GDPR basis and an Art. 9(2) GDPR condition that the vendor can document, whether a national authorization regime applied and was respected, and what happens to derived analyses, regulatory submissions or trained models if a supervisory authority orders processing at the source to stop are consequences a general compliance clause may leave unresolved. Whether an indemnity drafted for third-party claims also answers for a fine the licensee incurs as a joint controller is a drafting question that rests on a regulatory premise.

Upstream responsibilities also depend on role and territorial reach. Whether commissioning analyses on a key-holding warehouse makes the sponsor a licensee of anonymous outputs or a controller of personal health data, whether an audit or query right is itself the chain of means that decides the point, and whether record-level extracts hosted in the United States are assessed against the means of entities, public and private, that EU law does not bind, inform the analysis but do not alone decide whether the transfer rules apply. That question also requires the exporter's position, the relevant processing and the GDPR's territorial scope. Swiss-sourced data add a further layer, because the HFG classifies coded data by the existence of the key while the DSG looks to the holder's perspective and to the holder's interest in identification, and the documentation the HFV requires of an anonymization may be relevant to a Swiss ethics committee's assessment.

These allocations must also accommodate change over time. The Board's Guidelines are open for consultation until 30 October 2026 and may change before they are adopted, the Council's treatment of pseudonymization in the Omnibus had not settled as of publication, the EHDS secondary-use framework generally applies from March 2029, with later dates for certain categories, and the Guidelines themselves expect developments in AI to lower the time and cost of re-identification. A license with a multi-year term, a perpetual right to derived analyses and no mechanism for a change in the data's legal status may leave the parties' obligations unclear if the identification risk changes; contractual allocation does not determine whom a regulator may hold responsible. What the license requires when data it describes as anonymous become personal again, whether deletion, return, conversion into a processing agreement or nothing at all, depends on the agreed terms and the applicable law.

For a US-listed licensor or licensee the consequences do not stay in Europe. A dataset reclassified as personal can interrupt a revenue line built on licensed data assets, call into question the provenance of real-world evidence in a regulatory submission, and lead to regulatory proceedings with consequences for insurance coverage and securities disclosures. Coverage depends on the policy, and disclosure on the applicable requirements and materiality. Which of these a given arrangement faces depends on which entities hold which keys, how the datasets and contracts are wired, and how each authority reads them. Those are questions of fact and of drafting, and they require analysis tied to the dataset, the parties and the commercial context.