Italy Fines IQVIA €7 Million Over Patient Data Privacy Failures
Italy’s Data Protection Authority (GPDP) has fined medical data analytics company IQVIA €7 million ($7.8 million) for inadequate data processing practices that may have exposed approximately 1 million patients to data breaches and re-identification.
IQVIA is a multinational provider of medical data analytics, technology, and clinical research services. The company says it operates in more than 100 countries and manages 68 petabytes of data and 1.2 billion patient records.
GPDP found patient data could be re-identified
Italian authorities investigated IQVIA’s data processing practices in April 2025. Last month, they determined that the company had not provided adequate guarantees for anonymizing medical data, despite its claims.
According to the GPDP, IQVIA’s Italian arm aggregated data from 800 general practitioners to build a database containing health information for approximately 1 million patients.
Although the database replaced patient names with proprietary codes, data protection authorities found that the codes could be used to track patients over time and potentially re-identify them.
“The code associated with each patient has enabled long-term patient tracking,” the GPDP said in its announcement, published last weekend.
“Combined with a highly detailed set of information (year of birth, gender, diagnosis, symptoms, prescriptions, tests, immunizations, and location data), it is now possible to identify individual patients and re-identify them using any reasonable means.”
GDPR violations and inadequate data retention
The GPDP also found that IQVIA processed the data without a proper legal basis and did not notify patients, violating the European Union’s General Data Protection Regulation (GDPR).
The authority said the findings involved records dating back to 2001 and that IQVIA allegedly failed to establish or follow appropriate data retention periods.
In addition, IQVIA’s database included names, tax identification numbers, addresses, and contact details for a subset of 3,300 patients.
Along with the €7 million ($7.8 million) fine, Italian authorities ordered IQVIA to bring its practices into compliance within 120 days.
IQVIA says it may appeal the decision
BleepingComputer contacted IQVIA about the fine. A company spokesperson provided the following statement:
“IQVIA is committed to the responsible use of data and information and will continue to cooperate with authorities. Data protection is a top priority for IQVIA and we maintain robust safeguards, including the use of pseudonymization and encryption, to support the responsible use of data in healthcare.
IQVIA reserves the right to acknowledge and appeal the decision adopted by the Italian Data Protection Authority. The datasets relevant to the decision of the Italian Data Protection Authority are not used by IQVIA in carrying out clinical research services, nor are they relevant to carrying out clinical trials on behalf of the Sponsor.
We are cooperating constructively with the Italian data protection authorities throughout this process and have already taken steps to take the necessary steps to ensure full alignment with the authorities’ guidance. ”
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com