1 deeksha nidhi, Author at Sourcepoint by Didomi

Do you want to receive these privacy recaps in your inbox each week? Subscribe here or follow us on LinkedIn.

This week, Governor Newsom signed SB 690, amending the California Invasion of Privacy Act so that only the Attorney General may bring certain pen register claims over conduct on websites and apps. Meanwhile, Italy’s Garante fined IQVIA Solutions Italy €7 million for building a health database of roughly one million patients without a valid legal basis or adequate transparency.

Here’s what changed and why it matters.

United States

California Governor Signs SB 690, Eliminating Only One Type of CIPA Private Claim and Leaving Others Unaddressed

Governor Newsom signed SB 690, amending a single provision of the California Invasion of Privacy Act: Penal Code § 637.2, the section authorizing private civil actions for damages and injunctive relief.

Under new § 637.2(d)(1), only the Attorney General may bring an action under § 637.2 against a private actor for a violation of § 638.51 if the conduct is alleged to have occurred on a website, online application, or mobile application. Section 638.51 is CIPA’s prohibition on installing or using a pen register or trap and trace device without a court order, subject to statutory exceptions. Nothing else in CIPA is amended (including § 631 wiretap claims), and the private remedy (the greater of $5,000 per violation or three times actual damages, with no requirement that a plaintiff show actual damages) remains untouched. The law takes effect January 1, 2027, under the default rule for statutes enacted in a regular session. It also reaches backward. Under § 637.2(d)(2), the restriction applies retroactively to any pending claim in an action commenced within two years before the law’s operative date. How courts will apply that language to particular pending cases, especially actions commenced outside the two-year window, remains to be seen.


Takeaway

The USB 690 is welcome relief for businesses, but it closes only one of the two main tracks of CIPA website litigation. The wave against analytics, session replay, and ad-tech integrations has run on § 638.51 pen register theories and on § 631 wiretap claims. The new law will only impact § 638.51 pen register theories though. The § 631 track, the older of the two, survives intact and remains a continuing source of exposure, and plaintiffs may increasingly rely on it. 

The Governor’s signing message points to that gap. He described the bill as eliminating the private right of action for pen register and trap-and-trace violations arising from websites and apps and framed it as a response to “vexatious” lawsuits and demand letters aimed at small businesses that unknowingly installed software that tracked and shared visitor information, but he said that the work is not finished. He noted that other long-standing CIPA provisions are open to similar abuse, and urged the Legislature to take up the issue next year. 

The Governor’s call for further reform therefore suggests CIPA may return to the legislative agenda in 2027. Unless and until that gap is addressed, though, companies remain exposed to risk of CIPA actions. This is also a California-specific development, so other states’ wiretapping and eavesdropping statutes are unaffected. Appropriate controls, whether consent, enhanced disclosures, or server-side tagging, should therefore stay in place until the remaining gaps are addressed.

Europe

Garante Fines Healthcare Data Company Over Insufficient Anonymization

Italy’s data protection authority, the Garante, fined IQVIA Solutions Italy €7 million for building a health database of roughly one million patients without a valid legal basis or adequate transparency. 

IQVIA collected records from about 800 general practitioners through an add-on to their practice software, building a longitudinal database used for pharmaceutical-sponsored studies and IQVIA’s own commercial work. The add-on was designed to strip direct identifiers, generalize birth dates to the first of the month, and assign each patient a random ID to track their history over time. The contract IQVIA offered the GPs described the database as ensuring “absolute anonymity” and treated that as eliminating any need for patient consent. GPs were responsible for telling patients, through their own privacy notices, that their data would be anonymized for research by medical and pharmaceutical actors. 

The Garante concluded the data was never anonymous. The persistent patient ID allowed longitudinal tracking, and IQVIA showed inspectors one patient appearing 34 times in the prescriptions table. Combined with birth year, sex, diagnoses, prescriptions, tests and location, the records could be singled out. 

IQVIA relied on assessments by a group affiliate using k-anonymity, which requires each combination of selected attributes, such as age and location, to match at least a minimum number of people. The Garante found this protected only those attributes, not diagnoses or prescriptions that can make a record unique. It criticized IQVIA for accepting the assessments without checking what the add-on extracted or measuring how often records could be singled out. IQVIA invoked the CJEU’s SRB judgment, which recognizes that pseudonymized data may not be personal data in a recipient’s hands. The Garante held that IQVIA was not a mere recipient. It was the controller from collection onward, having defined the “anonymization” through its vendor contracts.


Takeaway

The decision shows anonymization is a conclusion a company must prove, not a label it can assert. A persistent identifier and a detailed record can defeat anonymity despite generalization, and an assessment of the method rather than the data collected may not suffice. The decision also shows that a company determining the purposes and essential means of de-identification may be a controller from that stage, which limits the SRB argument. Finally, the decision treats anonymization as processing in its own right. Telling people their data “will be anonymized” does not substitute for notice and a legal basis for the anonymization step itself. 

A Little More Privacy, if You Please

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.

Keep in touch

Sign up for our newsletter to keep up with privacy news for adtech and martech,
plus occasional company news.

© Sourcepoint 2026. All Rights Reserved

Let's explore what we can do together.

We'll be in touch within 48 hours

    First name *

    Last name *

    Email address *

    Company *

    Message *

    * indicates required fields