Italy
IQVIA Solutions Italy S.r.l.
GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-09-23.
Case details
- Authority
- Italian Data Protection Authority (Garante)
- Date
- 2026-09-23
- Controller / Processor
- IQVIA Solutions Italy S.r.l.
- Sector
- Health Care
- Quoted Articles
- Art. 5 (1) a), e), f) GDPR, Art. 5 (2) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 (1) b), d) GDPR, Art. 35 GDPR
- Type of violation
- Insufficient legal basis for data processing
Summary
The Italian DPA has imposed a fine of EUR 7,000,000 on IQVIA Solutions Italy S.r.l. IQVIA offered a software add-on which was installed by around 800 general practitioners. Through this, it collected health-related personal data on more than 1,000,000 patients. This data was used in the controller's own database for studies commissioned by pharmaceutical companies. The controller claimed that all data was anonymous. However, the authority found that each patient was assigned a stable code containing their detailed long-term medical history. Therefore, it was possible for the controller to identify individual data subjects using reasonable means. The authority also found that IQVIA was the controller of that data because it decided the purpose of the data processing. However, it did not have a legal basis for processing the data, did not inform patients, did not have a deletion policy, did not appoint doctors as processors and did not complete a DPIA.
Related fines