Italy fines IQVIA €7 million over health data
The 5 October report adds a $7.8 million equivalent, more specific re-identification attributes, addresses among direct identifiers, and IQVIA’s statement that the data are not used for clinical trials, that it used pseudonymization and encryption, and that it may appeal. It also uses “roughly one million” patients and “about 3,300” records rather than the firmer earlier counts.
Italy fined IQVIA €7 million, about $7.8 million, for re-identifiable health data on roughly one million patients; IQVIA may appeal.
Italy’s Data Protection Authority fined IQVIA Solutions Italy €7 million—about $7.8 million, according to a later report—under provision no. 710 of 23 September 2026 for processing health data drawn from 800 general practitioners for pharmaceutical studies. Sources describe the database as covering one million patients or about or roughly one million, with some records dating to 2001. The authority found the data were not anonymous because patient codes plus clinical and location details could re-identify individuals; the newest account specifies birth year, sex, diagnoses, prescriptions, tests, vaccinations, and location data. Reports disagree slightly on direct identifiers: more than 3,300 records versus about 3,300, with tax codes or tax IDs, names, and contact details, plus addresses in one account, and one report saying over 3,000 were linked to health data. The authority cited a missing legal basis, failure to inform patients, and no retention limits; earlier reports also cite no impact assessment and inadequate security, and say that if IQVIA does not comply within 120 days, doctors must anonymize the data. IQVIA said the dataset is not used for clinical trials, cited pseudonymization and encryption, and reserved the right to appeal.
- Italy’s Data Protection Authority fined IQVIA Solutions Italy €7 million (about $7.8 million in one report) under provision no. 710 of 23 September 2026.
- The database covered patients of 800 general practitioners—one million in one account, about or roughly one million in others—with some records dating to 2001, for pharmaceutical studies.
- The authority found stable patient codes plus clinical and location details could re-identify people; the newest report lists birth year, sex, diagnoses, prescriptions, tests, vaccinations, and location data.
- Direct-identifier counts differ: more than 3,300 records versus about 3,300, including tax codes or tax IDs, names and contact details, and addresses in one account; one report said over 3,000 were linked to health data.
- Cited gaps include no proper legal basis, no patient notice, and no retention limits; earlier reports also cite no impact assessment and inadequate security.
- IQVIA must comply within 120 days; two reports say that otherwise doctors must anonymize the data.
- IQVIA said the dataset is not used for clinical trials, cited pseudonymization and encryption, and reserved the right to appeal.
- Countries
- Italy
Coverage
oldest first · one row per article · UTC- · 27d ago
DataBreaches.netFirst report
The Italian Italy’s Data Protection Authority fines IQVIA €7 million over data protection breach
Italy’s privacy authority fined IQVIA €7 million for processing re-identifiable health data on one million patients.
- · 27d ago
Italy’s Data Protection Authority fines IQVIA €7 million over data protection breach
Italy’s privacy authority fined IQVIA €7 million for processing re-identifiable health data on one million patients.