[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTKhiBTn3Mk9sZBHgDbgIua_zI557z-Ib5E3tuOowVow":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"fcbebc72-9dc5-4028-a33a-be7b4390d93c","Garante per la protezione dei dati personali (Italy) - 710\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-710-2026-1db143","← Older revision Revision as of 08:11, 14 October 2026 Line 116: Line 116: }} }} The DPA issued a €7,000,000 fine on a controller after a routine inspection of their services uncovered a breach which resulted in the disclosure of 3,780 patients’ data. The DPA’s investigation uncovered unlawful processing operations by the controller as a result of lack of understanding of obligations, violations of GDPR principles, inadequate data protection by design and the absence of a DPIA. The DPA issued a €7 m fine on a controller after a routine inspection of their services uncovered a data breach which resulted in the disclosure of 3,780 patients’ data. In particular, the DPA held that the data was not sufficiently anonymized not to be personal data and were processed without a legal basis. == English Summary == == English Summary == === Facts === === Facts === The DPA started an investigation after IQVIA (the controller) notified a data breach which had been uncovered following the routine inspection of their services. The inspection concerned the collection of personal data from patients from 800 general practitioners (GP) used for observational studied sponsored by pharmaceutical companies. The data breach revealed that the system was able to transfer information entered by GP’s and primary care physicians into free-text fields. This resulted in personal data, capable of identifying patients and doctors, to be found in the controller’s database. Approximately 3,780 patients’ data was affected, of whom 3,080 individuals’ health data was disclosed. The DPA started an ex officio investigation after IQVIA (the controller) notified a data breach which had been uncovered following the routine inspection of their services. The inspection concerned the collection of personal data from patients from 800 general practitioners (GP) used for observational studied sponsored by pharmaceutical companies. The data breach revealed that the system was able to transfer information entered by GP’s and primary care physicians into free-text fields. This resulted in personal data, capable of identifying patients and doctors, to be found in the controller’s database. Approximately 3,780 patients’ data was affected, of whom 3,080 individuals’ health data was disclosed. An add-on was installed onto the GP’s software which extracted all information concerning patients and transmitted it to the controller’s database which contained over 1 million individuals’ personal data. This database was construed of longitudinal records which meant that a singular patient could be followed by the use of the persistent patient identifier. Amongst the personal data included therein was diagnoses, prescriptions, medical exams, and other health related data. An add-on was installed onto the GP’s software which extracted all information concerning patients and transmitted it to the controller’s database which contained over 1 million individuals’ personal data. This database was construed of longitudinal records which meant that a singular patient could be followed by the use of the persistent patient identifier. Amongst the personal data included therein was diagnoses, prescriptions, medical exams, and other health related data. Line 171: Line 171: == Comment == == Comment == ''Share your comments here!'' ''Share your comments here!'' See [[CNIL (France) - SAN-2026-008]] for the decision by the French DPA from earlier this year which found IQVIA France in violation of the GDPR, specifically Articles 14 and 25 GDPR. == Further Resources == == Further Resources ==","Italy's Garante per la protezione dei dati personali (DPA) has issued a €7 million fine to IQVIA for violations of the GDPR. The fine was imposed after a routine inspection uncovered a data breach that led to the disclosure of 3,780 patients' data, including sensitive health information. The DPA found that IQVIA engaged in unlawful processing operations due to a lack of understanding of GDPR obligations, inadequate data protection by design, and the absence of a Data Protection Impact Assessment (DPIA).","Italy's DPA fines IQVIA €7M for GDPR violations after patient data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_710\u002F2026&diff=53399&oldid=53371","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-10-14T08:11:18+00:00","2026-10-14T10:00:16.543448+00:00",7,[17],{"name":18,"type":19},"IQVIA","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":22,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":125},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":80,"name":81,"problem":82,"products":83},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":109,"name":110,"problem":111,"products":112},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[113,119],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":143},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","IQVIA was fined €7 million after a routine inspection revealed a data breach exposing sensitive health information of 3,780 patients, driven by unlawful data processing, inadequate data protection by design, and the complete absence of a Data Protection Impact Assessment (DPIA). The root cause was a fundamental lack of organisational understanding of GDPR obligations, meaning privacy and security requirements were never properly embedded into data processing workflows. This matters because health data is among the most sensitive categories under GDPR, carrying heightened legal obligations and significantly greater potential for harm to affected individuals. Organisations handling special category data must treat compliance not as a checkbox exercise but as an ongoing operational discipline integrated from the earliest stages of system and process design.",[131,132,133,134,135,136,137,138,139,140,141,142],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 30 – Records of processing activities","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.PO-P1 – Policies and procedures","NIST SP 800-53 PT-2 – Authority to process personally identifiable information","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{}]