Overview of the Fine
The Italian Data Protection Authority fined IQVIA Solutions Italy S.r.l. EUR 7,000,000 for unlawful processing of health data. Part of a multinational group in health data analytics and clinical research, IQVIA's database contained health information on about one million patients from 800 general practitioners. This data was used for studies, partly commissioned by pharmaceutical companies.
IQVIA claimed the data was anonymous, but the authority disagreed, finding it pseudonymous at best. The data was processed without a legal basis, adequate patient information, a data protection impact assessment (DPIA), or sufficient security measures.
Key Events
- April 2025: Inspections were conducted at IQVIA.
- Parallel Investigation: The inquiry was linked to a personal data breach notified by IQVIA.
- Decision: A EUR 7,000,000 fine was imposed, with a 120-day deadline to comply with the General Data Protection Regulation.
- Mitigating Factors: Data transfers were suspended by general practitioners, and IQVIA cooperated during proceedings.
A critical takeaway for your team: self-reporting a breach can lead to a broader examination of data processing practices.
Identified Failures
The authority identified six key failures:
1. Anonymization Issues: A persistent identifier allowed tracking of individuals over time. Combined with other data, this posed a re-identification risk.
2. Directly Identifying Data: The database contained identifiable information on approximately 3,370 patients.
3. Lack of Legal Basis: Health data processing requires a lawful basis and a condition for processing special category data, neither of which were properly established.
4. Inadequate Patient Information: Patients were not adequately informed about the data processing.
5. Undefined Retention Periods: No appropriate retention periods were established.
6. Missing DPIA and Security Measures: No DPIA was conducted, and security measures were inadequate.
The authority also required that general practitioners be appointed as processors, highlighting a gap in role allocation.
GDPR Requirements
Under the GDPR, the following requirements were not met:
Recital 26 and Article 4(1): Data is anonymous only if individuals cannot be identified by reasonably likely means. Pseudonymized data remains personal data.
Article 5(1)(a), (c), and (e): Lawfulness, fairness, transparency, Data Minimisation, and storage limitation were not adhered to.
Article 6 and Article 9: Processing operations need a lawful basis and a condition for processing health data. Research purposes require meeting specific conditions and safeguards.
Articles 12 to 14: Patients must be informed about who is processing their data and why.
Article 28: A processor arrangement is required when one party processes data on behalf of another.
Article 32: Security measures must match the risk level, especially for large-scale health data.
Article 35: A DPIA is required for high-risk processing, such as large-scale processing of special category data.
For teams running an ISO/IEC 27001 program, note that ISO/IEC 27002 includes controls on data masking and pseudonymization. These support but do not replace legal requirements.
Actionable Steps for Your Team
1. Validate Anonymization Claims: Document a re-identification assessment before labeling data as anonymous. Check for persistent identifiers and quasi-identifiers.
2. Conduct DPIAs Early: Integrate DPIAs into project planning to ensure compliance before data processing begins.
3. Define Roles Clearly: Determine and document who is the controller, joint controller, or processor for each data flow.
4. Establish Legal Basis and Article 9 Conditions: Record these for each purpose, including secondary uses.
5. Ensure Transparency: Confirm that patients are informed about data use, and review notices against actual data flows.
6. Set Retention Periods: Define and enforce retention periods for each dataset.
7. Audit for Direct Identifiers: Regularly scan datasets for direct identifiers and treat any findings as incidents.
8. Be Prepared for Broader Inquiries: Assume a breach notification may lead to a wider investigation. Ensure your documentation is robust.
9. Plan for Cooperation: Have a strategy to pause processing and respond to regulators efficiently.
The key takeaway is that regulators assess anonymization by outcome. If individuals can be identified, the data is considered personal, and all GDPR obligations apply.
