Italy’s Data Protection Authority fines IQVIA €7 million over data protection breach
Italy’s privacy authority fined IQVIA €7 million for processing re-identifiable health data on one million patients.
Italy’s Data Protection Authority fined IQVIA Solutions Italy €7 million in provision no. 710 of 23 September 2026. The company held health information on one million patients of 800 general practitioners for pharmaceutical studies, and the authority found the data were not anonymous because patient codes plus clinical and location details could re-identify individuals. More than 3,300 records included direct identifiers, over 3,000 linked to health data, and processing lacked a proper legal basis, notice, retention limits, an impact assessment, and adequate security; some data dated to 2001. IQVIA must comply within 120 days or have doctors carry out the required anonymization.
- The authority fined IQVIA Solutions Italy €7 million.
- The database covered one million patients of 800 doctors.
- Stable codes plus clinical detail made re-identification possible.
- More than 3,300 records contained direct identifiers such as tax codes.
- IQVIA has 120 days to comply or doctors must anonymize the data.
- Countries
- Italy
From the original article
2 min read at databreaches.netThe following is a machine translation of a press release by Italy’s privacy guarantor: Healthcare data: The Privacy Guarantor fines IQVIA 7 million euros. The data of one million patients of 800 family doctors are not anonymous. The Italian Data Protection Authority has fined IQVIA Solutions Italy Srl €7 million.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.