The Italian Italy’s Data Protection Authority fines IQVIA €7 million over data protection breach
Italy’s privacy authority fined IQVIA €7 million for processing re-identifiable health data on one million patients.
Italy’s Data Protection Authority fined IQVIA Solutions Italy €7 million under provision no. 710 of 23 September 2026. The company built a health database on about one million patients of 800 general practitioners for pharmaceutical studies, claiming the data were anonymous. The Garante found patient codes plus detailed attributes enabled re-identification, and that IQVIA lacked a legal basis, patient notice, retention limits, an impact assessment, and adequate security. Identifying details for more than 3,300 patients were also stored; IQVIA must bring processing into compliance within 120 days or have doctors perform the anonymization.
- Italian DPA fined IQVIA Solutions Italy €7 million in provision 710.
- Database covered one million patients of 800 general practitioners, dating to 2001.
- Patient codes plus detailed attributes allowed re-identification, the authority found.
- More than 3,300 records included names, tax codes, and contact details.
- IQVIA must remediate within 120 days or doctors must anonymize the data.
- Countries
- Italy
From the original article
2 min read at databreaches.netThe following is a machine translation of a press release by Italy’s privacy guarantor: Healthcare data: The Privacy Guarantor fines IQVIA 7 million euros. The data of one million patients of 800 family doctors are not anonymous. The Italian Data Protection Authority has fined IQVIA Solutions Italy Srl €7 million.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.