Privacy Guarantor: 7 million fine to Iqvia for illicit processing of health data

According to the Authority, the company processed health information relating to approximately one million patients without adequate guarantees, contesting the absence of a valid legal basis, deficiencies in security measures and the risk of re-identification of the interested parties.

The Guarantor for the protection of personal data has imposed a fine of seven million euros on Iqvia Solutions Italy S.r.l., a company belonging to a multinational group specialized in the analysis of health data and clinical research. According to the Authority, the company "had created a database with information on the health of one million patients from 800 general practitioners, used for studies also commissioned by pharmaceutical companies". The provision came at the end of an investigation started after inspections carried out in April 2025, to which the proceeding relating to a personal data breach notified by the same company was subsequently added.

Non-anonymous data and risk of re-identification

The Guarantor rejected the company's argument that the information used was anonymized. According to the Authority, "the code associated with each patient allowed, in fact, to follow him over time. Combined with a very detailed wealth of information (year of birth, sex, diagnosis, symptoms, prescriptions, tests, vaccinations, as well as localization data) it made it possible to isolate individual patients and, with reasonable means, re-identify them".

The disputed violations

For the Guarantor, Iqvia was the data controller since the data collection phase from general practitioners. The Authority accuses the company of having "processed health data without an appropriate legal basis and without adequately informing patients. It did not define the retention times: the data dated back to 2001. It did not carry out the impact assessment and did not adopt adequate security measures. The database also included identifying information (names, tax codes, addresses, contact details) of over 3,300 patients, of which more than 3,000 together with health data".

Adjustment times

The Guarantor has ordered that the company, if it intends to continue the activity, adapts the treatments carried out to the Authority's requirements within 120 days. "Alternatively", concludes the note, "the anonymisation must be carried out independently by the doctors, according to the guarantees indicated by the Guarantor. In quantifying the fine, the Authority took into account the number of patients involved, the nature of the data processed and the cessation of their sending by the doctors, starting from 2023, and the collaboration provided by the company during the procedure".