Italian Authority Imposes Multi-Million Euro Fine on IQVIA
Italy's Data Protection Authority (GPDP) has levied a fine of €7 million, equivalent to approximately $7.8 million, against the global healthcare data company IQVIA. The penalty stems from an investigation into the company's data-processing practices in Italy, which authorities determined violated key provisions of the General Data Protection Regulation (GDPR). The investigation was initiated in April 2025 and culminated in the enforcement action announced last month.
IQVIA operates as a multinational provider of healthcare data analysis, technology solutions, and clinical research services. According to its public disclosures, the company functions across more than 100 countries and manages vast volumes of information, including 68 petabytes of data and approximately 1.2 billion patient records.
Investigation Reveals Flaws in Pseudonymization Approach
The GPDP's investigation focused on IQVIA's Italian division, which had compiled a database containing the health information of roughly one million patients. This dataset was created by aggregating records supplied by approximately 800 general practitioners operating within Italy.
While IQVIA did not use patients' direct names in these records, instead assigning each individual a unique code, the authority found this pseudonymization method to be insufficient. The GPDP determined that the persistent use of the same code over time, when combined with highly detailed health and demographic attributes, allowed for the tracking and potential re-identification of individuals.
The code associated with each patient made it possible to track them over time. Combined with a very detailed set of information (year of birth, sex, diagnoses, symptoms, prescriptions, tests, vaccinations, as well as location data), it made it possible to single out individual patients and, using reasonable means, reidentify them.
This conclusion directly contradicts IQVIA's claims regarding the adequacy of its data anonymization warranties for the dataset in question.
Additional GDPR Violations Identified
Beyond the flawed anonymization, the GPDP found several other violations of GDPR requirements in IQVIA's handling of the Italian patient data. The authority determined that the company processed this sensitive health information without establishing a valid legal basis under the regulation and failed to provide adequate information to the patients whose data was being used.
Furthermore, the investigation revealed that IQVIA did not implement or adhere to defined data retention periods for the records in this database. The GPDP found evidence of patient data being retained dating back as far as 2001, with no apparent justification for such long-term storage under GDPR principles.
In a particularly concerning finding, the authority noted that for a subset of approximately 3,300 patients within the database, IQVIA had included direct personal identifiers such as names, tax identification numbers, home addresses, and contact details alongside their health information.
Enforcement Actions and Company Response
As part of its enforcement decision, the Italian Data Protection Authority has not only imposed the financial penalty but has also mandated that IQVIA bring its data-processing practices into full compliance with GDPR requirements within a 120-day period. This corrective action order requires the company to overhaul its handling of health data for the Italian operations.
In response to the fine and the authority's findings, IQVIA issued a statement through a spokesperson. The company affirmed its commitment to responsible data use and stated that it continues to cooperate with the GPDP. IQVIA emphasized that protecting data is a core priority and highlighted its use of safeguards such as pseudonymization and encryption.
While acknowledging the GPDP's decision, IQVIA confirmed it reserves the right to appeal the ruling. The company also clarified that the specific dataset examined by the Italian authority is not utilized in its clinical research services or in the conduct of clinical trials sponsored by pharmaceutical clients. IQVIA stated it has engaged constructively with the regulator throughout the process and has already begun implementing measures to align with the authority's guidance.
Source: BleepingComputer