Italy Fines IQVIA €7 Million for Flaws in Patient Data Protection
Italy has fined IQVIA €7 million after finding that anonymization codes in a health database of one million patients allowed re-identification.
The Italian Data Protection Authority has imposed a fine of 7 million euros, or approximately 7.8 million dollars, on IQVIA Solutions Italy over violations in handling health data, according to ThaiCERT, citing BleepingComputer.
The case involves a health database covering about one million patients, with data collected from nearly 800 general practitioners. The authority found that the codes used to anonymize patient identities were insufficient, as it remained possible to re-identify individuals by combining data.
The authority concluded that the data processing lacked an appropriate legal basis, a fundamental requirement under European data protection laws. It ordered the company to rectify its status within 120 days.
IQVIA indicated that it may appeal the decision. The case represents an important precedent in handling health data and instances where removing names alone is insufficient to protect privacy, a matter relevant to pharmaceutical companies and medical research firms in the region processing patient data across borders. European laws emphasize treating health data as a sensitive category requiring additional safeguards before collection or use.
What do these terms mean?
Anonymization: Removing names and direct identifying data from records, while retaining the ability to link records to one another.
Re-identification: Restoring the identity of the data subject from a reportedly anonymous record by combining it with other information.
Legal basis for processing: A lawful reason allowing the collection and processing of personal data, such as consent or legitimate interest.
Data protection authority: The supervisory body in a country responsible for enforcing privacy laws and issuing fines against violators.
Weekly Newsletter
Read between the lines before everyone else. Decode the most important economic, tech, and decision-maker movements in the region.. in 5 minutes every Saturday.
