The Italian Data Protection Agency (GPDP) has fined IQVIA 7 million euros ($7.8 million) for poor data processing practices that the agency said could have put about a million patients at risk of data disclosure and deanonymization.
IQVIA is a multinational company providing healthcare data analytics, technology and clinical research services. The company claims on its website that it operates in over 100 countries and manages 68 petabytes of data and 1.2 billion patient records.
Italian authorities investigated IQVIA’s data processing practices in April 2025 and ruled last month that, despite its claims, the company did not provide adequate guarantees for the anonymization of health data.
GPDP found that IQVIA’s Italian division created a database containing the health information of around a million patients by aggregating data from 800 general practitioners.
While the company used a unique code instead of patient names in these records, the DPA found that these could be used to track and de-anonymize patients over time.
“The code assigned to each patient made it possible to track them over time,” GPDP explained an announcement Published late last week.
“In combination with very detailed information (year of birth, gender, diagnoses, symptoms, prescriptions, tests, vaccinations and location data), it was possible to filter out individual patients and re-identify them using reasonable means.”
In addition, IQVIA processed data without an appropriate legal basis and without informing patients, which violates the GDPR (General Data Protection Regulation).
Finally, IQVIA allegedly did not establish or follow data retention periods because GPDP findings records date back to 2001.
The company also provided names, tax identification numbers, addresses and contact information for a subset of 3,300 patients in IQVIA’s database.
In addition to the $7.8 million fine, Italian authorities also ordered the company to bring its practices into compliance within 120 days.
BleepingComputer reached out to the company with questions about the fine and a spokesperson provided us with the following statement:
“IQVIA is committed to responsible use of data and information and continues to cooperate with the agency. Protecting data is IQVIA’s top priority and we maintain strict safeguards, including the use of pseudonymization and encryption, to support responsible data use in healthcare.”
IQVIA recognizes the decision of the Italian Data Protection Authority and reserves the right to appeal. The data set to which the decision of the Italian Data Protection Authority refers is not used by IQVIA for the performance of clinical research services and is not related to the conduct of clinical studies on behalf of the sponsors.
We have worked constructively with the Italian Data Protection Authority throughout this process and have already taken steps to take the necessary measures to ensure full compliance with the Authority’s guidelines.”
