[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgTfy86nxCcn-4oFOGp3AECaREM12OOSJy2675X36BIs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"62ec92d2-470c-4880-9934-329175ff00fb","iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","fcbebc72-9dc5-4028-a33a-be7b4390d93c","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","IQVIA was fined €7 million after a routine inspection revealed a data breach exposing sensitive health information of 3,780 patients, driven by unlawful data processing, inadequate data protection by design, and the complete absence of a Data Protection Impact Assessment (DPIA). The root cause was a fundamental lack of organisational understanding of GDPR obligations, meaning privacy and security requirements were never properly embedded into data processing workflows. This matters because health data is among the most sensitive categories under GDPR, carrying heightened legal obligations and significantly greater potential for harm to affected individuals. Organisations handling special category data must treat compliance not as a checkbox exercise but as an ongoing operational discipline integrated from the earliest stages of system and process design.","**Immediate actions:**\n- Conduct an urgent audit of all data processing activities involving special category (e.g., health) data to identify unlawful processing operations.\n- Engage a qualified Data Protection Officer (DPO) or external privacy counsel to assess current GDPR compliance posture and remediate gaps.\n\n**Long-term improvements:**\n- Embed Privacy by Design and by Default principles into all new data processing projects, ensuring data minimisation and appropriate safeguards are built in from inception.\n- Establish a mandatory DPIA process for all high-risk processing activities, particularly those involving health, biometric, or other special category data.\n- Develop and maintain a comprehensive Records of Processing Activities (RoPA) register to ensure full visibility of all data flows and legal bases.\n\n**Detection & governance measures:**\n- Implement regular internal privacy audits and third-party assessments to proactively identify compliance failures before regulatory inspection.\n- Deliver role-specific GDPR training for all staff handling personal data, with annual refreshers and documented completion records.\n- Establish a data breach detection and response procedure with defined escalation paths, ensuring timely notification obligations under GDPR Article 33 are met.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 30 – Records of processing activities","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.PO-P1 – Policies and procedures","NIST SP 800-53 PT-2 – Authority to process personally identifiable information","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{},"published","2026-10-14T10:20:50.236298+00:00","2026-10-14T10:20:50.218+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_710\u002F2026&diff=53399&oldid=53371","garante-per-la-protezione-dei-dati-personali-italy-710-2026-1db143","Garante per la protezione dei dati personali (Italy) - 710\u002F2026",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":58,"name":59,"problem":60},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":62,"name":63,"problem":64},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]