IQVIA fined $7.8 million by Italian DPA for inadequate health data anonymization

Italian DPA Imposes Fine on IQVIA

Italy's Data Protection Authority (GPDP) has issued a fine of €7 million ($7.8M) against IQVIA, a multinational healthcare data analysis company. The penalty stems from findings that IQVIA's data-processing practices were insufficient, potentially compromising the privacy of approximately one million patients.

Data Anonymization Failures Identified

The GPDP's investigation, initiated in April 2025, concluded that IQVIA's Italian division created a database of health information for about one million patients by aggregating data from 800 general practitioners. Although the company used unique codes instead of patient names, the GPDP determined these codes, combined with detailed information like year of birth, sex, diagnoses, and location data, could enable tracking and re-identification of individual patients over time.

For a subset of 3,300 patients, the database also included names, tax identification numbers, addresses, and contact details, further exacerbating the privacy risks.

GDPR Violations and Lack of Data Retention

Beyond the anonymization issues, IQVIA was found to have processed patient data without an appropriate legal basis and without informing the patients, which constitutes a violation of the General Data Protection Regulation (GDPR). The GPDP also noted that IQVIA did not establish or follow any data retention periods, with some records dating back to 2001.

Compliance Order Issued

In addition to the financial penalty, Italian authorities have ordered IQVIA to bring its data processing practices into compliance with regulations within 120 days. IQVIA stated it is committed to responsible data use and continues to cooperate with the Authority, maintaining robust safeguards including pseudonymization and encryption.