IQVIA Holdings Inc.—Italian privacy regulator fined IQVIA €7M for unlawfully processing 1 million patients' health records mischaracterized as anonymous
Italy's Garante per la protezione dei dati personali issued Decision No. 710 on September 23, 2026, fining IQVIA Solutions Italy €7 million for unlawfully processing health data on roughly 1 million patients collected from about 800 general practitioners. IQVIA treated the data as anonymous, but the Garante found it was only pseudonymized: a persistent patient code was retained for years alongside diagnoses and prescriptions, making individuals re-identifiable. The company obtained no patient consent and had no valid legal basis for the processing (its contract with doctors could not serve as one, since patients were not party to it); no data protection impact assessment was conducted and data was retained with no defined limits, in some cases since 2001. The database also contained direct identifiers (names, tax codes, addresses, contact details) for about 3,370 patients, with health data exposed for roughly 3,080 of them. IQVIA has 120 days to establish a valid legal basis and comply with GDPR transparency obligations, or shift anonymization responsibility to the doctors themselves.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Corporate Transparency | -against | contextual | -0.20 |
| Data Security | -against | secondary | -0.50 |
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.251 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.59)× agency (negligent ×0.5)
Evidence (1 signal)
Garante issued Decision No. 710 fining IQVIA Solutions Italy €7 million over health data of ~1 million patients
Italy's data protection authority published its official decision and press release fining IQVIA Solutions Italy €7 million for processing pseudonymized health data of roughly 1 million patients from 800 GPs without a valid legal basis or patient consent, after treating the data as anonymous.