IQVIA Solutions Italy S.r.l. – €7,000,000 Fine (Italy, 2026)

The DPA started an investigation after IQVIA (the controller) notified a data breach which had been uncovered following the routine inspection of their services. The inspection concerned the collection of personal data from patients from 800 general practitioners (GP) used for observational studied sponsored by pharmaceutical companies. The data breach revealed that the system was able to transfer information entered by GP’s and primary care physicians into free-text fields. This resulted in personal data, capable of identifying patients and doctors, to be found in the controller’s database. Approximately 3,780 patients’ data was affected, of whom 3,080 individuals’ health data was disclosed. An add-on was installed onto the GP’s software which extracted all information concerning patients and transmitted it to the controller’s database which contained over 1 million individuals’ personal data. This database was construed of longitudinal records which meant that a singular patient could be followed by the use of the persistent patient identifier. Amongst the personal data included therein was diagnoses, prescriptions, medical exams, and other health related data. During the investigation the controller emphasised that during the extraction process the collected data was anonymised prior to it reaching their database. All directly identifiable personal data points were removed and the patient was assigned a random patient ID. The controller further maintained that it did not have the key necessary to be able to link a patient with the patient ID. It considered the data that it had in its possession to be anonymous and thus not falling within the scope of the GDPR. Furthermore, it was established that the historical data contained in the controller’s database went back further than 10 years. The controller clarified that data dating back more than 10 years was not processed for research purposes. However, the controller did not provide a procedure for the erasure of s