IQVIA Solutions Italy S.r.l. – €7,000,000 Fine (Italy, 2026)

The DPA started an ex officio investigation after IQVIA (the controller) notified a data breach which had been uncovered following the routine inspection of their services. The inspection concerned the collection of personal data from patients from 800 general practitioners (GP) used for observational studied sponsored by pharmaceutical companies. The data breach revealed that the system was able to transfer information entered by GP’s and primary care physicians into free-text fields. This resulted in personal data, capable of identifying patients and doctors, to be found in the controller’s database. Approximately 3,780 patients’ data was affected, of whom 3,080 individuals’ health data was disclosed. An add-on was installed onto the GP’s software which extracted all information concerning patients and transmitted it to the controller’s database which contained over 1 million individuals’ personal data. This database was construed of longitudinal records which meant that a singular patient could be followed by the use of the persistent patient identifier. Amongst the personal data included therein was diagnoses, prescriptions, medical exams, and other health related data. During the investigation the controller emphasised that during the extraction process the collected data was anonymised prior to it reaching their database. All directly identifiable personal data points were removed and the patient was assigned a random patient ID. The controller further maintained that it did not have the key necessary to be able to link a patient with the patient ID. It considered the data that it had in its possession to be anonymous and thus not falling within the scope of the GDPR. Furthermore, it was established that the historical data contained in the controller’s database went back further than 10 years. The controller clarified that data dating back more than 10 years was not processed for research purposes. However, the controller did not provide a procedure for the erasure of such data. The controller and their obligations The DPA held that the contractual agreement and conduct undertaken by the controller clearly demonstrated their role in determining the means and purpose of the personal data processing. The DPA took account of the controller’s ownership of the database, contracts presented, instructions on the extraction and anonymisation of the data and their own use of the database. The DPA therefore held that the controller could not have alleviated itself from its obligations under Article 4(1)(7) and Article 24 GDPR, by merely describing itself as a technological or financial partner. Nature of the personal data processed As regards the matter of anonymisation, the DPA made reference to the EDPB anonymisation framework, and identified three risks. The DPA held that the Patient ID did not sufficiently counter the risk of re-identification of individuals. Particularly, because even where a patient’s name was not present, a combination with other characteristics in the data set did not necessarily prevent making the individual significantly distinct from others and thus allowed for singling out. Furthermore, the DPA found the present case materially different to the CJEU SRB Judgement (C-413/23). In particular, the DPA stressed the necessity for a case-by-case analysis of identifiability and to consider it from the perspective of the entity processing the data. Whilst there was no contention about the general principle underlying the judgment, the DPA held that the controller was not just a passive recipient of pseudonymised data, but rather that they were actively involved in both the processing and anonymisation process. The DPA therefore found it insufficient for the controller to rely on the fact that another party was in possession of the re-identification key. Legal basis, Information Obligations and Transparency The DPA found that the collection and alleged anonymisation (both of which constitute a form of processing requiring a legal basis) by the controller of the personal data of patients was undertaken in absence of an appropriate legal basis. The DPA found a violation of Article 5(1)(a) and 13 GDPR. The DPA held that whilst there was a contract between the controller and the GP’s, this did not provide a legal basis, as the data subjects, whose personal data was the subject matter, were not part of that contract. Similarly, considering the sensitive nature of the data, even under contractual necessity, the controller would have to identify one of the exceptions under Article 9(2) GDPR, which was not the case. The DPA also found a failure by the controller to provide a legal basis for the anonymisation, which is considered a processing operation. Finally, the DPA rejected the controllers claim that the information necessitated by Article 13 GDPR was not provided because the data was anonymous. The DPA found the reliance by the controller on the fact that the GP’s had the obligation to inform was insufficient. The DPA stressed that even the privacy notice did not include all elements required by Article 13 GDPR. Principle of storage limitation Regardless of the fact that the controller acknowledged the measures taken to comply with the principle of storage limitation, the DPA found that the controller retained historical data yet failed to establish an appropriate procedure for personal data erasure. The DPA held that such storage is inconsistent with the purposes for which the data was being processed and retained beyond the period necessary to achieve those purposes. Therefore, the DPA found a violation of Article 5(1)(e) GDPR. The role of general practitioners and processor obligations The DPA held that the controller failed to designate the primary care physicians and GPs as processors under Article 28 GDPR, concerning the transmission of their patient’s data to the controller. The DPA found that the GP’s could not have been regarded as controllers of the data as they were not determining the purposes and means of the processing activities. The data breach and principle of integrity and confidentiality The DPA established that in reality, the controller’s software add-on transferred and processed personal data of identifiable indviduals to the controller. This brought about the disclosure and processing of 3,370 patients’ data to SIMG, 3,080 of which included patients’ health data. The DPA found that the controller failed to implement appropriate technical and organisational measures in violation of both Articles 5(1)(f), and 32 GDPR. Principle of accountability and privacy by design The DPA further criticised the controller, as there was a lack of evidence suggesting that the controller conducted the necessary analyses to mitigate the risk of re-identification and risks posed by the data collection software to the rights and freedoms of data subjects. The DPA emphasised that the mere implementation of generic technical and organisational measures or reliance on an existing technical solution is insufficient. The DPA found a violation of Article 5(2) GDPR and Article 25 GDPR, the principle of accountability and data protection by design respectively. Data Protection Impact Assessment The DPA held that the controller violated its obligations under Article 35 GDPR for having initiated the DPIA however failed to complete the processes prior to commencing with its processing operations. The DPA highlighted the nature of data, that is sensitive data, and the clarification by the EDPB in its guidelines for the need to conduct a DPIA for such data. In light of its assessment, the DPA found the controller in violation of Articles 5(1)(a), (e), (f) and (2), Article 9, Article 13, Article 25, Article 28, Article 32 and Article 35 GDPR, and imposed a fine of €7,000,000 on them.