Privacy guarantor fines Iqvia seven million: non-anonymous health data

From the year of birth to sex, passing through diagnoses, symptoms, prescriptions, tests, vaccinations and location data. The health information of one million patients from 800 family doctors, entered into a database created by Iqvia Solutions Italy, would not have been anonymous.

Precisely for this reason the company, part of a multinational group active in the analysis of health data and clinical research, was fined seven million euros by the Guarantor for the protection of personal data. The dataset would have been used for studies also commissioned by pharmaceutical companies and would have also included identifying information such as names, tax codes, addresses and contact details of over 3,300 patients, of which more than three thousand together with health data.

According to the Guarantor's reconstruction, the code associated with each patient would have allowed him to be followed over time and, thanks to the information contained in the database, it would therefore have been possible to isolate and re-identify individual patients "with reasonable means".

The authority also accuses the company of having processed health data without an adequate legal basis and without adequately informing patients. In addition, Iqvia would not have defined the retention times. The data, in fact, dated back to 2001. Finally, according to the Guarantor, the impact assessment was not carried out and adequate security measures were not adopted.

In a note, the Guarantor specified that, if it intends to continue the activity, the company will have to adapt the data processing within 120 days, complying with the authority's requirements. Otherwise, anonymization must be carried out independently by doctors, always according to the guarantees indicated by the Guarantor.

Iqvia announced that it "reserves the right to appeal". In its defense, the company explained that the dataset to which the Guarantor refers is not used in carrying out clinical research services and is not related to the conduct of clinical studies on behalf of the sponsors.