Italy's Data Protection Authority (GPDP) has assessed a €7 million ($7.8M) penalty against IQVIA for deficient data-handling procedures that exposed approximately one million patients to potential re-identification and unauthorized disclosure. IQVIA operates as a multinational provider of healthcare data analysis, technology infrastructure, and clinical research support across more than 100 countries, managing 68 petabytes of information spanning 1.2 billion patient records according to company statements.
The Italian authority launched its investigation into IQVIA's data practices in April 2025, concluding last month that the organization failed to deliver sufficient anonymization protections despite public assurances to the contrary. Authorities determined that IQVIA's Italian operations had assembled a database comprising health records from roughly one million patients by consolidating information sourced from 800 general practitioners.
Although IQVIA substituted unique identifiers for patient names within the dataset, the GPDP established that these codes permitted longitudinal tracking and subsequent re-identification of individuals. The regulator stated: "The code associated with each patient made it possible to track them over time. Combined with a very detailed set of information (year of birth, sex, diagnoses, symptoms, prescriptions, tests, vaccinations, as well as location data), it made it possible to single out individual patients and, using reasonable means, reidentify them."
The enforcement action identified multiple regulatory violations. IQVIA processed personal health information without sufficient legal justification and failed to notify patients of such processing, breaching the General Data Protection Regulation (GDPR). The authority also found that the company maintained no defined data retention schedule, with some records retained since 2001. For a subset comprising 3,300 individuals, IQVIA's database retained direct identifiers including names, tax identification numbers, residential addresses, and telephone contact information.
Beyond the monetary penalty, Italian authorities mandated that IQVIA remediate its practices within 120 days. In a statement to BleepingComputer, an IQVIA representative responded: "IQVIA is committed to the responsible use of data and information and continues to cooperate with the Authority. Protecting data is a core priority for IQVIA, and we maintain robust safeguards, including the use of pseudonymization and encryption, to support responsible data use in healthcare. IQVIA acknowledges the decision adopted by the Italian Data Protection Authority and reserves the right to appeal. The dataset to which the Italian Data Protection Authority's decision relates is not used by IQVIA in conduct of clinical research services and does not relate to the conduct of clinical trials on behalf of the sponsors. We have engaged constructively with the Italian Data Protection Authority throughout this process and have already taken steps to adopt the measures necessary to ensure full alignment with the Authority's guidance."